firmaok-bin

LOW

maintainer grufo 0 votes scanned 2026-09-24 01:43:24.893483

View on AUR

Why flagged

The tarball is downloaded from postecert.poste.it, which is the official Italian Poste Italiane certificate/signature portal and plausibly the project's own distribution host; the package installs it as a data file under /opt rather than executing it at build time, and the wrapper script is generated from a local .in template with checksums provided for all sources.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The tarball is downloaded from postecert.poste.it, which is the official Italian Poste Italiane certificate/signature portal and plausibly the project's own distribution host; the package installs it as a data file under /opt rather than executing it at build time, and the wrapper script is generated from a local .in template with checksums provided for all sources.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://postecert.poste.it/firma/download/${_appname}setup/${_apptitle}_${_pkgsuffx}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: grufo <madmurphy333 AT gmail DOT com>
    
      2
    
      3_apptitle='firmaOK'
    
      4_pkgsuffx='Linux'
    
      5_appname="${_apptitle,,}"
    
      6pkgname="${_appname}-bin"
    
      7pkgver='1.6.31'
    
      8pkgrel=1
    
      9pkgdesc='Digital signature app by the Italian Poste company'
    
      10arch=('any')
    
      11url='https://postecert.poste.it/firma/newfirmaok.shtml'
    
      12license=('custom:firmaok')
    
      13provides=("${_appname}")
    
      14conflicts=("${pkgname}-git" "${pkgname}-bin")
    
      15depends=('hicolor-icon-theme' 'bash' 'qt5-base' 'openssl' 'python' 'gnome-keyring' 'curl')
    
      16source=("https://postecert.poste.it/firma/download/${_appname}setup/${_apptitle}_${_pkgsuffx}.tar.gz"
    
      17        "${_appname}.in"
    
      18        'Licenza.pdf'
    
      19        "${_appname}.desktop"
    
      20        "${_appname}.png"
    
      21        "${_appname}.svg"
    
      22        'pen.svg')
    
      23sha512sums=('3306bf0a2aa139e10162cbfc3011e3819e6d654d1e71187f061b8df7eccf06360893dbb39e5af5fb5066646cad933f9ea7b0ca1cdb6f11b1a9283c99aa6b94b9'
    
      24            'a1d8220bdc74945118985a12fed4d58ffb262e87ebea088294e44bafd64d5ba6fda838ccb12ffa653ba5a19321500b585a671495645a0f3c48c9eaba8d3f9348'
    
      25            '9189dbcd9f123c5a929952d657d71766cda45fdb0aec7453387b014fb72fe6a04e02976e18071f2194aad4bef883dc6ee0f054df4510e6e51fe91495d0ea97fd'
    
      26            'a50a6b93c2f757a496616e8a217b5dc1b83802fffa800c9778e5d060303aea5e72148c2907ffab7fe26c782ba470847e2ddace0ffd16f8a7f4eeb1b049427c92'
    
      27            '5a1f0e0674ced7dd5fb44732ea9b2c2156531383a20d4b469768a6c052f9271b7e51073eb38c9af62d9091f4da9cb5f73fc9a068510a8d34cc429e80ced03077'
    
      28            '8e46cf58a42dc279dc4c6ed307afcc4897197cce6f07e630d4bdd42d34cb31866a5a365d7bd1ed277dcf598bb22271f2a6b8335456b338b70b3df33b1b44fd94'
    
      29            '6a2004c3afa3d10991fbb748c9aaef648cab1c0e06c6af444f65f3b17f959701743ac8f95cbc2a71f0a35ef69fd65e7da566a7d20c151582abfd31a125a73f53')
    
      30options=('!strip')
    
      31noextract=("${_apptitle}_${_pkgsuffx}.tar.gz")
    
      32install="${_appname}.install"
    
      33
    
      34# Make a string suitable for `sed`, by escaping `[]/&$.*^\` - syntax: `_sed_escape STRING`
    
      35_sed_escape() {
    
      36	echo "${1}" | sed 's/[]\/&.*$^[]/\\&/g'
    
      37}
    
      38
    
      39package() {
    
      40
    
      41	cd "${srcdir}"
    
      42
    
      43	local _sed_subst="
    
      44		s/@PACKAGE_NAME@/$(_sed_escape "${pkgname}")/g
    
      45		s/@PACKAGE_VERSION@/$(_sed_escape "${pkgver}")/g
    
      46		s/@APP_NAME@/$(_sed_escape "${_appname}")/g
    
      47		s/@PACKAGE_RELEASE@/$(_sed_escape "${pkgrel}")/g
    
      48		s/@PACKAGE_TITLE@/$(_sed_escape "${_apptitle}")/g
    
      49		s/@PACKAGE_SUFFIX@/$(_sed_escape "${_srcsuffx}")/g
    
      50	"
    
      51
    
      52	install -dm755 "${pkgdir}/usr/bin"
    
      53	sed "${_sed_subst}" "${_appname}.in" > "${pkgdir}/usr/bin/${_appname}"
    
      54	chmod +x "${pkgdir}/usr/bin/${_appname}"
    
      55
    
      56	install -dm755 "${pkgdir}/usr/share/icons/hicolor/scalable/apps/"
    
      57	install -Dm644 "${srcdir}/${_appname}.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/firmaok.png"
    
      58
    
      59	install -dm755 "${pkgdir}/usr/share/icons/hicolor/256x256/apps/"
    
      60	install -Dm644 "${srcdir}/${_appname}.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/firmaok.png"
    
      61
    
      62	install -dm755 "${pkgdir}/opt/${_appname}"
    
      63	install -Dm644 "${srcdir}/firmaOK_Linux.tar.gz" "${pkgdir}/opt/${_appname}/${pkgname}-${pkgver}.tar.gz"
    
      64	install -Dm644 "${srcdir}/pen.svg" "${pkgdir}/opt/${_appname}/pen.svg"
    
      65
    
      66	install -dm755 "${pkgdir}/usr/share/applications/"
    
      67	install -Dm644 "${srcdir}/${_appname}.desktop" "${pkgdir}/usr/share/applications/${_appname}.desktop"
    
      68
    
      69	install -dm755 "${pkgdir}/usr/share/licenses/${_appname}/"
    
      70	install -Dm644 "${srcdir}/Licenza.pdf" "${pkgdir}/usr/share/licenses/${_appname}/licenza.pdf"
    
      71
    
      72}
    
      73
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-24 01:43:24	Low	3
2026-09-24 01:41:16	Medium	2