firma4ng-bin

LOW

maintainer darkbasic 0 votes scanned 2026-09-25 15:13:55.089390

View on AUR

Why flagged

The binary tarball is downloaded from the official InfoCamere/id.infocamere.it vendor domain, has a pinned SHA-256 checksum, and an inner archive checksum is also verified; the package installs a seed archive as read-only data and a launcher script (syntax-checked only), with no remote code execution or obfuscated payloads present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The binary tarball is downloaded from the official InfoCamere/id.infocamere.it vendor domain, has a pinned SHA-256 checksum, and an inner archive checksum is also verified; the package installs a seed archive as read-only data and a launcher script (syntax-checked only), with no remote code execution or obfuscated payloads present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "${_archive}::https://id.infocamere.it/assets/software/Firma4NG_linux.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Local AUR-style binary package. Review before building; not published to AUR.
    
      2# The runtime is deliberately per-user so upstream updates cannot modify /opt.
    
      3pkgname=firma4ng-bin
    
      4pkgver=1.6.20
    
      5pkgrel=2
    
      6pkgdesc='InfoCamere Firma4NG signing and verification (binary, per-user runtime)'
    
      7arch=('x86_64')
    
      8url='https://id.infocamere.it/documentazione/it/software_di_firma.html'
    
      9license=('LicenseRef-Bit4id')
    
      10depends=(
    
      11  'bash' 'coreutils' 'tar' 'util-linux' 'xdg-utils'
    
      12  'glibc' 'gcc-libs' 'pcsclite'
    
      13  'lib32-glibc' 'lib32-gcc-libs' 'lib32-glib2'
    
      14  'lib32-libx11' 'lib32-libxext' 'lib32-libxrender'
    
      15  'lib32-libsm' 'lib32-fontconfig' 'lib32-zlib'
    
      16)
    
      17optdepends=(
    
      18  'ccid: PC/SC driver for compatible USB smart-card readers'
    
      19  'xorg-xwayland: run the bundled X11 GUI in a Wayland session'
    
      20)
    
      21provides=("firma4ng=$pkgver")
    
      22conflicts=('firma4ng')
    
      23# Vendor bytes remain unchanged; no stripping or debug-package splitting.
    
      24options=('!strip' '!debug')
    
      25
    
      26_archive="Firma4NG_linux-${pkgver}.tar.gz"
    
      27_source_dir="Firma4NG_${pkgver}"
    
      28_inner_sha256='39807b7e667514874c6ca54fc2567fe4056491f6ec7766b0ed56a2f7377491bb'
    
      29source=(
    
      30  "${_archive}::https://id.infocamere.it/assets/software/Firma4NG_linux.tar.gz"
    
      31  'firma4ng'
    
      32  'firma4ng.desktop'
    
      33  'README.md'
    
      34)
    
      35noextract=("$_archive")
    
      36sha256sums=(
    
      37  '36d39e7ca23f54e392d344901c02de5168b6700c20c2a8ca51a77d0f77811c14'
    
      38  '313c63c6c05144c1b26174e5288dde8bba0325df8675bde03eec7bc6d23f8947'
    
      39  '0458c13dcb4fb2effd0285705af41001a70e9963caddfaa3a4197bfdefc4a9b2'
    
      40  'fbb300231fef1a263711efd2ca476a3ae135d948dd0bd08ca093f7b096643ac2'
    
      41)
    
      42
    
      43prepare() {
    
      44  # GNU tar detects compression automatically when reading this archive file.
    
      45  # Extract only the seed archive, license, upstream README, and application icon.
    
      46  tar -xf "$srcdir/$_archive" -C "$srcdir" \
    
      47    --no-same-owner --no-same-permissions \
    
      48    "$_source_dir/Firma4NG.tar.gz" \
    
      49    "$_source_dir/licenza.txt" \
    
      50    "$_source_dir/README.txt" \
    
      51    "$_source_dir/resources/icons/Firma4NG.png" || return 1
    
      52
    
      53  printf '%s  %s\n' "$_inner_sha256" \
    
      54    "$srcdir/$_source_dir/Firma4NG.tar.gz" | sha256sum --check - || return 1
    
      55}
    
      56
    
      57check() {
    
      58  # No vendor code, installer, smart-card operation, or network update is run.
    
      59  bash -n "$srcdir/firma4ng" || return 1
    
      60  tar -tzf "$srcdir/$_source_dir/Firma4NG.tar.gz" > /dev/null || return 1
    
      61}
    
      62
    
      63package() {
    
      64  local _vendor="$srcdir/$_source_dir"
    
      65
    
      66  # A root-owned seed, read-only to ordinary users; the launcher creates a private writable copy.
    
      67  install -Dm644 "$_vendor/Firma4NG.tar.gz" \
    
      68    "$pkgdir/opt/firma4ng/Firma4NG.tar.gz" || return 1
    
      69  printf '%s  Firma4NG.tar.gz\n' "$_inner_sha256" \
    
      70    > "$pkgdir/opt/firma4ng/SHA256SUMS" || return 1
    
      71  printf '%s-%s\n' "$pkgver" "$pkgrel" \
    
      72    > "$pkgdir/opt/firma4ng/seed-version" || return 1
    
      73  chmod 644 "$pkgdir/opt/firma4ng/"{SHA256SUMS,seed-version} || return 1
    
      74
    
      75  install -Dm755 "$srcdir/firma4ng" "$pkgdir/usr/bin/firma4ng" || return 1
    
      76  install -Dm644 "$srcdir/firma4ng.desktop" \
    
      77    "$pkgdir/usr/share/applications/firma4ng.desktop" || return 1
    
      78  install -Dm644 "$_vendor/resources/icons/Firma4NG.png" \
    
      79    "$pkgdir/usr/share/icons/hicolor/256x256/apps/firma4ng.png" || return 1
    
      80  install -Dm644 "$_vendor/licenza.txt" \
    
      81    "$pkgdir/usr/share/licenses/$pkgname/LICENSE" || return 1
    
      82  install -Dm644 "$_vendor/README.txt" \
    
      83    "$pkgdir/usr/share/doc/$pkgname/UPSTREAM-README.txt" || return 1
    
      84  install -Dm644 "$srcdir/README.md" \
    
      85    "$pkgdir/usr/share/doc/$pkgname/README.md" || return 1
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-25 15:13:55	Low	3
2026-09-25 15:12:17	Medium	2