infonotary-client-software

LOW

maintainer s.pantaleev 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a .deb from the project's official repository over HTTP, which is not on a standard host whitelist, but the source is the official upstream release and the checksum is verified; the worst case of a swapped source is limited to supply-chain risk of a prebuilt binary, but no remote code execution or obfuscation is present.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a .deb from the project's official repository over HTTP, which is not on a standard host whitelist, but the source is the official upstream release and the checksum is verified; the worst case of a swapped source is limited to supply-chain risk of a prebuilt binary, but no remote code execution or obfuscation is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:48 source=('http://repository.infonotary.com/install/linux/DEBS24/pool/non-free/i/infonotary-client-software/infonotary-client-software_'$pkgver'_all.deb')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Slavi Pantaleev <slavi at devture.com>
    
      2
    
      3pkgname=infonotary-client-software
    
      4pkgver=3.0.29
    
      5pkgrel=2
    
      6pkgdesc="InfoNotary client software - InfoNotary e-Doc Signer and InfoNotary Smart Card Manager."
    
      7arch=('x86_64')
    
      8url="http://www.infonotary.com/"
    
      9license=('unknown')
    
      10# Version 3 is a jpackage'd Java (Swing + JavaFX/GTK3) application with a bundled JRE.
    
      11# The deb only declares `xdg-utils`; the rest was determined by inspecting the bundled native libraries.
    
      12depends=(
    
      13	glibc
    
      14	zlib
    
      15	libgcc
    
      16	libstdc++
    
      17	gtk3
    
      18	freetype2
    
      19	fontconfig
    
      20	libx11
    
      21	libxext
    
      22	libxrender
    
      23	libxtst
    
      24	libxi
    
      25	libxxf86vm
    
      26	libgl
    
      27	pcsclite
    
      28	xdg-utils
    
      29	hicolor-icon-theme
    
      30)
    
      31replaces=(infonotary-scardmanager)
    
      32conflicts=(infonotary-scardmanager)
    
      33optdepends=(
    
      34	'ccid: generic USB Chip/Smart Card Interface Devices driver'
    
      35	'omnikey_ifdokccid: driver for OmniKey smart card readers'
    
      36	'bit4id-ipki: Bit4ID Universal Middleware (Smart Card driver)'
    
      37	'bit4id-xpki: Bit4ID Universal Middleware (Smart Card driver)'
    
      38	'sac-core: SafeNet Authentication Client (Smart Card driver for Thales/Gemalto IDPrime)'
    
      39	'pcsc-tools: smartcard tools (pcsc_scan)'
    
      40	'opensc: a set of libraries and utilities to work with smart cards'
    
      41	'alsa-lib: sound support'
    
      42)
    
      43# Upstream removes old versions from the pool when publishing a new one.
    
      44# To find the current version and its checksum, read the apt index (the pool has no directory listing):
    
      45#   curl -s https://repository.infonotary.com/install/linux/DEBS24/dists/noble/non-free/binary-amd64/Packages | grep -A12 '^Package: infonotary-client-software'
    
      46# (suite taken from https://repository.infonotary.com/install/linux/infonotary_u2404.list)
    
      47# Don't guess URLs: the server is behind a WAF (BunkerWeb) that bans the client IP after a burst of 404s.
    
      48source=('http://repository.infonotary.com/install/linux/DEBS24/pool/non-free/i/infonotary-client-software/infonotary-client-software_'$pkgver'_all.deb')
    
      49sha256sums=('526e5984c8943f3a9c4b9ece81f0b34e5a18aacd3287840b470302c31f0f5b0c')
    
      50install=$pkgname.install
    
      51
    
      52package() {
    
      53	bsdtar -xOf "$srcdir/infonotary-client-software_${pkgver}_all.deb" 'data.tar.*' \
    
      54		| bsdtar -xf - -C "$pkgdir" --no-same-owner --no-same-permissions
    
      55
    
      56	# The deb ships files with odd permissions (group-writable, 754, executable data files, ..)
    
      57	chmod -R go-w "$pkgdir"
    
      58	chmod 755 "$pkgdir"/usr/bin/*
    
      59	chmod 644 "$pkgdir"/usr/share/applications/*.desktop "$pkgdir"/usr/share/mime/packages/*.xml
    
      60	find "$pkgdir/usr/share/icons" -type f -exec chmod 644 {} +
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 19:18:20	Medium	1