podpisgov

LOW

maintainer Kamilcuk 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a tarball from a Polish government domain (pz.gov.pl) hosting the official application; despite being a non-whitelisted host, it is plausibly the project's official source, and the package builds from official upstream files without executing remote code or introducing untrusted binaries.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a Polish government domain (pz.gov.pl) hosting the official application; despite being a non-whitelisted host, it is plausibly the project's official source, and the package builds from official upstream files without executing remote code or introducing untrusted binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("${pkgname}.tar.gz::https://pz.gov.pl/PodpisGOV/linux/PodpisGOV.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kamil cukrowski <kmilcukrowski@gmail.com>
    
      2# Contributor: TechniKris <technikrisdev at gmail dot com>
    
      3pkgname=podpisgov
    
      4pkgver=1.5.5.4
    
      5pkgrel=1
    
      6pkgdesc="An application for digital signatures by Poland government."
    
      7arch=('any')
    
      8url="https://podpis.gov.pl/ui/wp/podpis-gov"
    
      9license=('CC-BY-NC-4.0' 'LGPL-3.0-only' 'GPL-3.0-only')
    
      10depends=('java8-openjfx' # or 'java-openjfx<21', since JavaFX 21 dropped GTK2
    
      11  'libappindicator-gtk2')
    
      12source=("${pkgname}.tar.gz::https://pz.gov.pl/PodpisGOV/linux/PodpisGOV.tar.gz")
    
      13sha256sums=('0a6f5aa745b12c64be33c62822bd0efed355444c08accf60d2d28ce1a1ee8d1e')
    
      14
    
      15prepare() {
    
      16  # Remove bundled Java
    
      17  rm -rf "${srcdir}/PodpisGOV/jre"
    
      18  # Use system Java
    
      19  sed --in-place \
    
      20    -e 's/"$SCRIPTPATH\/jre\/bin\/java"/"\/usr\/lib\/jvm\/default-runtime\/bin\/java"/g' \
    
      21    "${srcdir}/PodpisGOV/PodpisGOV"
    
      22}
    
      23
    
      24mkdir_link() {
    
      25  echo "$2 -> $1"
    
      26  install -d "$(dirname "$2")"
    
      27  ln -s "$opt/$1" "$2"
    
      28}
    
      29
    
      30package() {
    
      31  # This path is hardocded in the desktop link.
    
      32  local opt=/opt/PodpisGOV
    
      33  local mydir="${pkgdir}$opt"
    
      34  # Create the installation directory
    
      35  install -d "${mydir}"
    
      36  # Move the extracted content to the target directory
    
      37  mv "${srcdir}/PodpisGOV/"* "${mydir}/"
    
      38  # Install executable.
    
      39  mkdir_link "PodpisGOV" "${pkgdir}/usr/bin/PodpisGOV"
    
      40  # Install the desktop file
    
      41  mkdir_link "PodpisGOV.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      42  # Install the license file
    
      43  mkdir_link "Licenses/License-pl.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2