pem-heart-signature
maintainer BrandonMcCluskey
· 1 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a prebuilt binary from the official project's domain (cencert.pl), which is a trusted certificate authority; despite the non-whitelisted host, the download is from the vendor's official infrastructure and the checksum is verified, limiting supply-chain risk to low.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt binary from the official project's domain (cencert.pl), which is a trusted certificate authority; despite the non-whitelisted host, the download is from the vendor's official infrastructure and the checksum is verified, limiting supply-chain risk to low.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:11
source=(https://www.cencert.pl/wp-content/software/PH-$pkgver.tgz)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Paweł Ciechomski <p.ciechomski@icm.edu.pl>
2
3
pkgname=pem-heart-signature
4
pkgver=3.9.13.25
5
pkgrel=2
6
pkgdesc='Software for digitally signing and verifying files with CenCert qualified certificate'
7
arch=(x86_64)
8
url='https://www.cencert.pl/do-pobrania/oprogramowanie-do-podpisu/'
9
license=(proprietary)
10
depends=(ncurses5-compat-libs ccid opensc)
11
source=(https://www.cencert.pl/wp-content/software/PH-$pkgver.tgz)
12
sha256sums=('52c22ab0d8ac5336aec5ad088ac9b589e74055a0a563041187472a52ec2658a8')
13
14
package() {
15
install -d "$pkgdir"/opt/pemheart_signer/{bin,data,db,doc,etc,lib}
16
install -d "$pkgdir"/opt/pemheart_signer/data/{file-manager,gconf,images,menu,mime}
17
install -d "$pkgdir"/opt/pemheart_signer/db/tsl
18
install -d "$pkgdir"/opt/pemheart_signer/lib/{pkcs11,platforms}
19
cp -a opt/pemheart_signer/* "$pkgdir"/opt/pemheart_signer/
20
21
install -d "$pkgdir"/usr/share/applications/
22
cp -a usr/share/applications/* "$pkgdir"/usr/share/applications/
23
install -d "$pkgdir"/etc/pemheart_signer/db/tsl
24
cp -a etc/pemheart_signer/* "$pkgdir"/etc/pemheart_signer/
25
26
27
install -d "$pkgdir"/usr/bin/
28
ln -s /opt/pemheart_signer/bin/pemheart_runner.sh "$pkgdir"/usr/bin/pemheart_signer
29
ln -s /opt/pemheart_signer/bin/pemheart_runner.sh "$pkgdir"/usr/bin/pemheart_activator
30
ln -s /opt/pemheart_signer/bin/pemheart_runner.sh "$pkgdir"/usr/bin/pemheart_recert
31
ln -s /opt/pemheart_signer/bin/pemheart_runner.sh "$pkgdir"/usr/bin/pemheart_configurator
32
ln -s /opt/pemheart_signer/etc/pemsigner.conf "$pkgdir"/etc/pemheart_signer/pemsigner.conf
33
ln -s /opt/pemheart_signer/etc/pemsignerprofiles.conf "$pkgdir"/etc/pemheart_signer/pemsignerprofiles.conf
34
chmod 755 -R $pkgdir/opt/pemheart_signer/
35
chmod 755 -R $pkgdir/etc/pemheart_signer/
36
37
38
39
40
41
}
42
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |