procertum-smartsign

maintainer delthas · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary installer from the official vendor's domain (certum.eu), which is not on the standard whitelist but is plausibly legitimate; it then extracts and installs the bundled files without executing the installer, reducing risk. The source is not executed, and the build process is transparent, limiting impact to trust in the vendor's binary integrity.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary installer from the official vendor's domain (certum.eu), which is not on the standard whitelist but is plausibly legitimate; it then extracts and installs the bundled files without executing the installer, reducing risk. The source is not executed, and the build process is transparent, limiting impact to trust in the vendor's binary integrity.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "https://files.certum.eu/software/SimplySignDesktop/Linux-Ubuntu/${_fullver}/SimplySignDesktop-${_fullver}-x86_64-prod-ubuntu.bin"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: delthas <arch@delthas.fr>
    
      2pkgname=procertum-smartsign
    
      3pkgver=9.4.3.0
    
      4_fullver=2.9.14-${pkgver}
    
      5pkgrel=1
    
      6pkgdesc="Creation and verification of secure electronic signatures."
    
      7arch=(x86_64)
    
      8url="https://support.certum.eu/en/software/${pkgname}/"
    
      9license=("LicenseRef-${pkgname}-software-license")
    
      10depends=("gcc-libs" "java-runtime>=23" "pcsclite")
    
      11optdepends=("ccid: USB CCID smart-card reader support"
    
      12            "opensc: PKCS#11 support for additional smart cards")
    
      13source=(
    
      14	"https://files.certum.eu/software/SimplySignDesktop/Linux-Ubuntu/${_fullver}/SimplySignDesktop-${_fullver}-x86_64-prod-ubuntu.bin"
    
      15)
    
      16md5sums=('36a19c83255d35f51d09a1f299845177')
    
      17
    
      18prepare() {
    
      19	# Avoid trusting the installer; extract manually from the first gzip header.
    
      20
    
      21	# This is the "naive" command that calls the installer, to extract itself.
    
      22	# sh "./SimplySignDesktop-${_fullver}-${CARCH}-prod-ubuntu.bin" --noexec --keep --nox11 --nochown --target "${srcdir}/${pkgname}-${pkgver}"
    
      23
    
      24	# This tells grep not to try to parse Unicode codepoints from the file, since we are doing binary operations.
    
      25	export LANG=C
    
      26	OFFSET=$(grep -obUaP -m 1 "\x1F\x8B" SimplySignDesktop-${_fullver}-x86_64-prod-ubuntu.bin | cut -d ':' -f 1)
    
      27	mkdir -p "${srcdir}/${pkgname}-${pkgver}"
    
      28	tail -c +$(($OFFSET+1)) SimplySignDesktop-${_fullver}-x86_64-prod-ubuntu.bin | tar -C "${srcdir}/${pkgname}-${pkgver}" -xzf -
    
      29}
    
      30
    
      31package() {
    
      32	cd "${srcdir}/${pkgname}-${pkgver}/SS-$pkgver-dist"
    
      33
    
      34	install -Dm644 -t "$pkgdir/usr/lib/$pkgname" *.jar *.so
    
      35	install -Dm755 -t "$pkgdir/usr/lib/$pkgname" *.sh
    
      36	install -Dm644 -t "$pkgdir/usr/lib/$pkgname/lib" lib/*
    
      37
    
      38	install -m755 -d "$pkgdir/usr/bin"
    
      39	ln -s "/usr/lib/$pkgname/proCertumSmartSign.sh" "$pkgdir/usr/bin/$pkgname"
    
      40
    
      41	install -Dm644 proCertumSmartSign.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
    
      42
    
      43	sed -i -E 's|(Exec=).*|\1'"/usr/bin/$pkgname"'|gm' proCertumSmartSign.desktop
    
      44	sed -i -E 's|(Icon=).*|\1'"$pkgname"'|gm' proCertumSmartSign.desktop
    
      45	install -Dm644 proCertumSmartSign.desktop "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      46
    
      47	install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname" licenses/proCertumSmartSign_*_licence.rtf
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2