nhiicc

LOW

maintainer imrehg 6 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt binary from the official government healthcare website, which is a trusted source for this software; the binary is not obfuscated and is installed transparently, with no remote code execution or data exfiltration observed.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the official government healthcare website, which is a trusted source for this software; the binary is not obfuscated and is installed transparently, with no remote code execution or data exfiltration observed.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("CMS_mNHIICC_Setup-${pkgver}.Linux.zip::https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/CMS_mNHIICC_Setup.Linux.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gergely Imreh <gergely at imreh dot net>
    
      2# Contributor: Chih-Hsuan Yen <base64_decode("eXUzYWN0eHQydHR0ZmlteEBjaHllbi5jYwo=")>
    
      3
    
      4# Testing pages:
    
      5# * https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/webtesting/SampleY.aspx
    
      6# * /usr/share/nhiicc/html/ESample.html in this package
    
      7
    
      8pkgname=nhiicc
    
      9epoch=1
    
      10pkgver=20240710.1
    
      11pkgrel=4
    
      12pkgdesc='台灣健保卡網路註冊憑證元件 (National Health Insurance IC Card)'
    
      13arch=('x86_64')
    
      14url='https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/mEventesting.htm'
    
      15# Proprietary freeware with no published licence terms (see LICENSE-NHIICC),
    
      16# plus the OpenSSL 1.1.1f statically linked into the binary
    
      17license=('LicenseRef-NHIICC AND OpenSSL')
    
      18# bash, sed and openssl are for regen-certs.sh and nhiicc.install; the binary has
    
      19# OpenSSL 1.1 built in
    
      20depends=('glibc' 'pcsclite' 'bash' 'sed' 'openssl')
    
      21makedepends=('patchelf')
    
      22# Prebuilt binary: leave it as shipped and don't split out an empty debug package
    
      23options=(!debug !strip)
    
      24source=("CMS_mNHIICC_Setup-${pkgver}.Linux.zip::https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/CMS_mNHIICC_Setup.Linux.zip"
    
      25        "nhiicc.service"
    
      26        "nhiicc.rules"
    
      27        "regen-certs.sh"
    
      28        "LICENSE-NHIICC"
    
      29        "OPENSSL-LICENSE::https://raw.githubusercontent.com/openssl/openssl/OpenSSL_1_1_1f/LICENSE")
    
      30noextract=("CMS_mNHIICC_Setup-${pkgver}.Linux.zip")
    
      31# The zip's MD5 is published on https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/Eventesting.aspx
    
      32# (3bbad14d8ce82a504811319e06c3cdac for 20240710.1)
    
      33sha256sums=('fb3473fd1a1a8c65c0972d8a39570abdbbb537cc32cac5c4c51527b1c1fce196'
    
      34            'e20d49f865ded8caaf303b30634700b8746d87c2bb7fd7b8ead4b2e2e7b06b3e'
    
      35            '9b61d872e67f81d46f43a8ebafa65eb283233d4e1edbf396ecf0ec37567b47aa'
    
      36            '317539908f0bbf6b41adf8f963b52aa44288a5a6ce9cb5e7bdd9fc52fa65b1d9'
    
      37            'f3cf7e345b86f8db1609bc1db96f744be175cc8d383003d0c6324ca5e16c3396'
    
      38            'c32913b33252e71190af2066f08115c69bc9fddadf3bf29296e20c835389841c')
    
      39b2sums=('3464fc13d444ad99b948ca5703bc33c30857c470a5a92289292a3b84893b606db769bb2efcb7bb185b87b9dc3e5e98426fdafc45ab2195d3f5764d2fc22d6634'
    
      40        '92aa5b489477bb19cae941692db66e6f40647d1f781ff5f9c5f50809dccebac2dabc287e5ca6019d9e7857c9d0da61ea6330511098c0fcd9d34596452ea9fb0e'
    
      41        '259a15130384efbc458575b0399b6324abe78daa96fead85d988a09a44097cbdeff0743d3593d11e60d966034df59c7986eebc57b6bf30509fb1ccfcdc6116fb'
    
      42        '538394cf5e3cc8926debde97ed6022c9a64c80139e4af14f4aa7ab33d85464d45326f5e4ea9b64a0a8c9ac20874883722276e1f7e8935aa1e2f713bdf3c579ea'
    
      43        '75e0183671fdef0d5f6967b7d4cfc304c9523513bd36efa4a05db440116d9cae15bc07d7eb8bc7ba7ce3c91e64755a8a9ee61ba7bdfd97d3ed8e5eae32a912c6'
    
      44        'b79601ce4c3097e4733735a13dab9da9a347c42f2b037a3f851541a8956aa35c51fb67578611a7da024c9f9660199cd9b9abddf8700fa5d18873efb196cf5ebc')
    
      45install=nhiicc.install
    
      46
    
      47prepare() {
    
      48  # The zip only wraps a single .tar.xz
    
      49  bsdtar -xOf "CMS_mNHIICC_Setup-${pkgver}.Linux.zip" | bsdtar -x
    
      50
    
      51  # Delete insecure RUNPATH pointing into the vendor's build tree
    
      52  patchelf --remove-rpath mLNHIICC_Setup/x64/mLNHIICC
    
      53}
    
      54
    
      55check() {
    
      56  local _bin="mLNHIICC_Setup/x64/mLNHIICC"
    
      57  # Running it would bind port 7777, so only make sure the RUNPATH is gone
    
      58  # and that the loader resolves every library against the system
    
      59  [[ -z "$(patchelf --print-rpath "${_bin}")" ]]
    
      60  /usr/lib/ld-linux-x86-64.so.2 --list "${_bin}" > /dev/null
    
      61}
    
      62
    
      63package() {
    
      64  install -Dm755 mLNHIICC_Setup/x64/mLNHIICC -t "${pkgdir}/usr/bin"
    
      65  install -Dm755 "${srcdir}/regen-certs.sh" -t "${pkgdir}/usr/share/nhiicc"
    
      66  cp -dr --no-preserve=ownership mLNHIICC_Setup/html "${pkgdir}/usr/share/nhiicc/"
    
      67  install -Dm644 "${srcdir}/nhiicc.service" -t "${pkgdir}/usr/lib/systemd/system"
    
      68  install -Dm644 "${srcdir}/nhiicc.rules" -t "${pkgdir}/usr/share/polkit-1/rules.d"
    
      69  install -Dm644 "${srcdir}/LICENSE-NHIICC" "${srcdir}/OPENSSL-LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      70}
    
      71

Changes since previous scan

--- PKGBUILD @ 2026-10-25 00:20
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,4 +1,5 @@
-# Maintainer: Chih-Hsuan Yen <base64_decode("eXUzYWN0eHQydHR0ZmlteEBjaHllbi5jYwo=")>
+# Maintainer: Gergely Imreh <gergely at imreh dot net>
+# Contributor: Chih-Hsuan Yen <base64_decode("eXUzYWN0eHQydHR0ZmlteEBjaHllbi5jYwo=")>
 
 # Testing pages:
 # * https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/webtesting/SampleY.aspx
@@ -7,41 +8,64 @@
 pkgname=nhiicc
 epoch=1
 pkgver=20240710.1
-pkgrel=3
-arch=(x86_64)
+pkgrel=4
+pkgdesc='台灣健保卡網路註冊憑證元件 (National Health Insurance IC Card)'
+arch=('x86_64')
 url='https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/mEventesting.htm'
-license=(custom)
-pkgdesc='台灣健保卡網路註冊憑證元件 (National Health Insurance IC Card)'
-# sed and openssl are for commands used in nhiicc.install
-depends=(pcsclite sed openssl)
-makedepends=(patchelf)
-optdepends=(
-  'lib32-pcsclite: for using card readers with 32-bit driver only'
-)
-source=("CMS_mNHIICC_Setup-$pkgver.Linux.zip"::"https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/CMS_mNHIICC_Setup.Linux.zip"
-        nhiicc.service
-        nhiicc.rules
-        regen-certs.sh)
-noextract=("CMS_mNHIICC_Setup-$pkgver.Linux.zip")
-# See https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/mEventesting.htm for MD5 sums
-md5sums=('3bbad14d8ce82a504811319e06c3cdac'
-         '3a7ba068b49eab2edca614ea2495e706'
-         'e4a249ff4e638527a0bde9deec6eeb5a'
-         '97e402f39fffe35e411419d062f6baf8')
+# Proprietary freeware with no published licence terms (see LICENSE-NHIICC),
+# plus the OpenSSL 1.1.1f statically linked into the binary
+license=('LicenseRef-NHIICC AND OpenSSL')
+# bash, sed and openssl are for regen-certs.sh and nhiicc.install; the binary has
+# OpenSSL 1.1 built in
+depends=('glibc' 'pcsclite' 'bash' 'sed' 'openssl')
+makedepends=('patchelf')
+# Prebuilt binary: leave it as shipped and don't split out an empty debug package
+options=(!debug !strip)
+source=("CMS_mNHIICC_Setup-${pkgver}.Linux.zip::https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/CMS_mNHIICC_Setup.Linux.zip"
+        "nhiicc.service"
+        "nhiicc.rules"
+        "regen-certs.sh"
+        "LICENSE-NHIICC"
+        "OPENSSL-LICENSE::https://raw.githubusercontent.com/openssl/openssl/OpenSSL_1_1_1f/LICENSE")
+noextract=("CMS_mNHIICC_Setup-${pkgver}.Linux.zip")
+# The zip's MD5 is published on https://cloudicweb.nhi.gov.tw/cloudic/system/SMC/Eventesting.aspx
+# (3bbad14d8ce82a504811319e06c3cdac for 20240710.1)
+sha256sums=('fb3473fd1a1a8c65c0972d8a39570abdbbb537cc32cac5c4c51527b1c1fce196'
+            'e20d49f865ded8caaf303b30634700b8746d87c2bb7fd7b8ead4b2e2e7b06b3e'
+            '9b61d872e67f81d46f43a8ebafa65eb283233d4e1edbf396ecf0ec37567b47aa'
+            '317539908f0bbf6b41adf8f963b52aa44288a5a6ce9cb5e7bdd9fc52fa65b1d9'
+            'f3cf7e345b86f8db1609bc1db96f744be175cc8d383003d0c6324ca5e16c3396'
+            'c32913b33252e71190af2066f08115c69bc9fddadf3bf29296e20c835389841c')
+b2sums=('3464fc13d444ad99b948ca5703bc33c30857c470a5a92289292a3b84893b606db769bb2efcb7bb185b87b9dc3e5e98426fdafc45ab2195d3f5764d2fc22d6634'
+        '92aa5b489477bb19cae941692db66e6f40647d1f781ff5f9c5f50809dccebac2dabc287e5ca6019d9e7857c9d0da61ea6330511098c0fcd9d34596452ea9fb0e'
+        '259a15130384efbc458575b0399b6324abe78daa96fead85d988a09a44097cbdeff0743d3593d11e60d966034df59c7986eebc57b6bf30509fb1ccfcdc6116fb'
+        '538394cf5e3cc8926debde97ed6022c9a64c80139e4af14f4aa7ab33d85464d45326f5e4ea9b64a0a8c9ac20874883722276e1f7e8935aa1e2f713bdf3c579ea'
+        '75e0183671fdef0d5f6967b7d4cfc304c9523513bd36efa4a05db440116d9cae15bc07d7eb8bc7ba7ce3c91e64755a8a9ee61ba7bdfd97d3ed8e5eae32a912c6'
+        'b79601ce4c3097e4733735a13dab9da9a347c42f2b037a3f851541a8956aa35c51fb67578611a7da024c9f9660199cd9b9abddf8700fa5d18873efb196cf5ebc')
 install=nhiicc.install
 
 prepare() {
-  bsdtar xOf CMS_mNHIICC_Setup-${pkgver}.Linux.zip | bsdtar x
+  # The zip only wraps a single .tar.xz
+  bsdtar -xOf "CMS_mNHIICC_Setup-${pkgver}.Linux.zip" | bsdtar -x
 
-  # Delete insecure RUNPATH
+  # Delete insecure RUNPATH pointing into the vendor's build tree
   patchelf --remove-rpath mLNHIICC_Setup/x64/mLNHIICC
 }
 
-package() {
-  install -Dm755 mLNHIICC_Setup/x64/mLNHIICC -t "$pkgdir"/usr/bin
-  install -Dm755 regen-certs.sh -t "$pkgdir"/usr/share/nhiicc/
-  cp -dr mLNHIICC_Setup/html "$pkgdir"/usr/share/nhiicc/
-  install -Dm644 nhiicc.service -t "$pkgdir"/usr/lib/systemd/system/
-  install -Dm644 nhiicc.rules -t "$pkgdir"/usr/share/polkit-1/rules.d
+check() {
+  local _bin="mLNHIICC_Setup/x64/mLNHIICC"
+  # Running it would bind port 7777, so only make sure the RUNPATH is gone
+  # and that the loader resolves every library against the system
+  [[ -z "$(patchelf --print-rpath "${_bin}")" ]]
+  /usr/lib/ld-linux-x86-64.so.2 --list "${_bin}" > /dev/null
 }
 
+package() {
+  install -Dm755 mLNHIICC_Setup/x64/mLNHIICC -t "${pkgdir}/usr/bin"
+  install -Dm755 "${srcdir}/regen-certs.sh" -t "${pkgdir}/usr/share/nhiicc"
+  cp -dr --no-preserve=ownership mLNHIICC_Setup/html "${pkgdir}/usr/share/nhiicc/"
+  install -Dm644 "${srcdir}/nhiicc.service" -t "${pkgdir}/usr/lib/systemd/system"
+  install -Dm644 "${srcdir}/nhiicc.rules" -t "${pkgdir}/usr/share/polkit-1/rules.d"
+  install -Dm644 "${srcdir}/LICENSE-NHIICC" "${srcdir}/OPENSSL-LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+}
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 11:42:44	Medium	1
2026-10-25 00:20:48	Medium	2
2026-10-24 15:40:54	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2