infocamere-sign-desktop-bin
LOW
maintainer alfyardy
0 votes
scanned 2026-11-05 22:13:23.184832
Why flagged
Downloads a prebuilt binary zip from the official InfoCamere government/vendor domain (id.infocamere.it) with a pinned sha256 checksum; the source is the project's own official distribution infrastructure, not a personal or anonymous host, so the supply-chain risk is low despite being a prebuilt executable.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads a prebuilt binary zip from the official InfoCamere government/vendor domain (id.infocamere.it) with a pinned sha256 checksum; the source is the project's own official distribution infrastructure, not a personal or anonymous host, so the supply-chain risk is low despite being a prebuilt executable.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:39
source=("$_zip::https://id.infocamere.it/assets/software/infocameresign_linux.zip"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Alfredo Ardito <alfredo at ardito dot it>
2
3
pkgname=infocamere-sign-desktop-bin
4
pkgver=1.1.0
5
pkgrel=1
6
pkgdesc="InfoCamere Sign Desktop: Italian qualified electronic signature (CAdES/PAdES) with smartcard"
7
arch=('x86_64')
8
url="https://id.infocamere.it/download_software.html"
9
license=('LicenseRef-InfoCamere-EULA')
10
depends=(
11
'pcsclite' 'ccid'
12
# Electron frontend
13
'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'gtk3' 'libcups'
14
'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes'
15
'libxkbcommon' 'libxrandr' 'mesa' 'nspr' 'nss' 'pango' 'systemd-libs'
16
'hicolor-icon-theme' 'xdg-utils'
17
)
18
makedepends=('python')
19
optdepends=(
20
'bit4id-xpki: Bit4id reader driver for Bit4id readers not covered by ccid, and a system-wide PKCS#11 module'
21
'pcsc-tools: pcsc_scan, to check that the reader and card are detected'
22
'gnome-shell-extension-appindicator: tray icon on GNOME'
23
'libnotify: desktop notifications from the launcher'
24
)
25
provides=('infocamere-sign-desktop')
26
conflicts=('infocamere-sign-desktop')
27
# The engine is a self-contained bundle (own glibc, Python, OpenSSL):
28
# stripping or touching its libraries breaks it.
29
options=('!strip' '!debug')
30
install=$pkgname.install
31
32
# Fix for "signing with 3 or more visible signatures hangs forever":
33
# raises the engine's WebSocket message limit from 16 MiB to this many MiB
34
# (about 7 MB per visible signature). Set to 0 to install the app unmodified.
35
_ws_limit_mib=256
36
37
# Upstream reuses the same unversioned URL for every release.
38
_zip="infocameresign_linux-$pkgver.zip"
39
source=("$_zip::https://id.infocamere.it/assets/software/infocameresign_linux.zip"
40
'infocamere-sign'
41
'infocamere-sign-desktop.desktop'
42
'fix-ws-limit.py')
43
noextract=("$_zip")
44
sha256sums=('165461666b514409f325d3253eee3297a4223adf9c1d79a8a280a54231d7c376'
45
'31ffa12c33c4979396bf5eea17c94471b7b4c857d06fbd631bafd17ae0e0e212'
46
'e9c1f66f144834a2d0731ae880b83057b268e539b3edc45aa32c4b6f18899213'
47
'd73139e0cddd8991428e95c6230379ad6aea91f1db85a0a1b986a2135ab8dd17')
48
49
prepare() {
50
rm -rf app
51
mkdir app
52
bsdtar -xf "$_zip" -C app
53
54
# Upstream may publish a new release at the same URL: fail clearly.
55
local _ver
56
_ver=$(sed -n 's/^ *"version" *: *"\([^"]*\)".*/\1/p' app/etc/configuration.conf | head -n1)
57
if [[ "$_ver" != "$pkgver" ]]; then
58
error "The downloaded zip contains version $_ver, but this PKGBUILD is for $pkgver."
59
error "Please flag the package out of date on the AUR."
60
return 1
61
fi
62
63
if (( _ws_limit_mib > 0 )); then
64
python3 -I fix-ws-limit.py app/lib/python314.zip "$_ws_limit_mib"
65
fi
66
}
67
68
package() {
69
local _opt="$pkgdir/opt/infocamere-sign-desktop"
70
install -d "$_opt"
71
cp -a app/bin app/etc app/lib "$_opt/"
72
73
# Upstream ships everything world-writable (0666/0777)
74
chmod -R u=rwX,go=rX "$_opt"
75
chmod 0755 "$_opt/bin/InfoCamere Sign Desktop Engine.exe" \
76
"$_opt/bin/frontend/InfoCamere Sign Desktop.exe" \
77
"$_opt/bin/frontend/chrome_crashpad_handler" \
78
"$_opt/etc/sign_engine/mutool.exe"
79
80
install -Dm755 infocamere-sign "$pkgdir/usr/bin/infocamere-sign"
81
install -Dm644 infocamere-sign-desktop.desktop \
82
"$pkgdir/usr/share/applications/infocamere-sign-desktop.desktop"
83
install -Dm644 app/infocamere_sign_desktop.png \
84
"$pkgdir/usr/share/icons/hicolor/256x256/apps/infocamere-sign-desktop.png"
85
86
local _lic=app/bin/frontend/resources/app.asar.unpacked/dist/firma4-frontend/assets/pdf/license-agreements
87
install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname" "$_lic"/license-agreement-*.pdf
88
install -Dm644 app/bin/frontend/LICENSE.electron.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
89
}
90
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-05 22:13:23 | Low | 3 |
| 2026-11-05 22:10:45 | Medium | 2 |