qdigidoc4

LOW

maintainer kevku 21 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads source code from official project repositories (GitHub.com/open-eid) and configuration/data files from legitimate Estonian government domains; while checksums are skipped for some sources, all content is either buildable source or non-executable data, and the hosts, though not whitelisted, are plausibly official and project-specific.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from official project repositories (GitHub.com/open-eid) and configuration/data files from legitimate Estonian government domains; while checksums are skipped for some sources, all content is either buildable source or non-executable data, and the hosts, though not whitelisted, are plausibly official and project-specific.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "eu-lotl.xml-$pkgver::https://ec.europa.eu/tools/lotl/eu-lotl.xml"
PKGBUILD:18 "EE.xml-$pkgver::https://sr.riik.ee/tsl/estonian-tsl.xml"
PKGBUILD:19 "config.json-$pkgver::https://id.eesti.ee/config.json"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: kevku <kevku@gmx.com>
    
      2pkgname=qdigidoc4
    
      3pkgver=4.11.0.5421
    
      4_rls_tag=v4.11.0
    
      5pkgrel=1
    
      6pkgdesc="DigiDoc4 Client is an application for digitally signing and encrypting documents; the software includes functionality to manage Estonian ID-card - change pin codes, update certificates etc."
    
      7arch=('x86_64')
    
      8url="https://www.id.ee/"
    
      9license=('LGPL-2.1-or-later')
    
      10depends=('zlib' 'openssl' 'libdigidocpp>=4.5.0' 'libldap' 'pcsclite' 'opensc' 'qt6-base' 'qt6-svg' 'hicolor-icon-theme')
    
      11makedepends=('git' 'cmake' 'gettext' 'flatbuffers' 'qt6-tools' 'qt6-translations')
    
      12optdepends=('ccid: Smart Card support'
    
      13            'python-nautilus: Nautilus Extension')
    
      14source=("$pkgname-$pkgver::git+https://github.com/open-eid/DigiDoc4-Client.git?signed#tag=$_rls_tag"
    
      15        "open-eid-common::git+https://github.com/open-eid/qt-common.git"
    
      16        "open-eid-libcdoc::git+https://github.com/open-eid/libcdoc.git"
    
      17        "eu-lotl.xml-$pkgver::https://ec.europa.eu/tools/lotl/eu-lotl.xml"
    
      18        "EE.xml-$pkgver::https://sr.riik.ee/tsl/estonian-tsl.xml"
    
      19        "config.json-$pkgver::https://id.eesti.ee/config.json"
    
      20        "config.rsa-$pkgver::https://id.eesti.ee/config.rsa"
    
      21        "config.pub-$pkgver::https://id.eesti.ee/config.pub")
    
      22sha256sums=('5aa57a9f4f6a1218050da0f6744530b236d2318524739530ad7677117b1f8fca'
    
      23            'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
    
      24validpgpkeys=(
    
      25    'D1EBC666EFCBFBD3CFC2EBAA90C0B5E75C3B195D'  # Raul Metsma https://github.com/metsma.gpg
    
      26)
    
      27
    
      28prepare() {
    
      29  cd "$srcdir/$pkgname-$pkgver"
    
      30
    
      31  git submodule init
    
      32  git config submodule.common.url $srcdir/open-eid-common
    
      33  git config submodule.client/libcdoc.url $srcdir/open-eid-libcdoc
    
      34  git -c protocol.file.allow=always submodule update
    
      35
    
      36  [[ -d "$pkgname-build" ]] && rm -r "$pkgname-build"
    
      37  mkdir -p "$pkgname-build"
    
      38  # https://github.com/open-eid/DigiDoc4-Client/wiki/DeveloperTips
    
      39  cp "$srcdir/eu-lotl.xml-$pkgver"  "client/eu-lotl.xml"
    
      40  cp "$srcdir/EE.xml-$pkgver"       "client/EE.xml"
    
      41  cp "$srcdir/config.json-$pkgver"  "common/config.json"
    
      42  cp "$srcdir/config.rsa-$pkgver"   "common/config.rsa"
    
      43  cp "$srcdir/config.pub-$pkgver"   "common/config.pub"
    
      44}
    
      45
    
      46build() {
    
      47  cd "$srcdir/$pkgname-$pkgver/$pkgname-build"
    
      48  export BUILD_NUMBER=${pkgver##*.}
    
      49  cmake .. -DCMAKE_C_FLAGS:STRING="${CFLAGS} -ffile-prefix-map=$srcdir=." \
    
      50           -DCMAKE_CXX_FLAGS:STRING="${CXXFLAGS} -ffile-prefix-map=$srcdir=." \
    
      51           -DCMAKE_EXE_LINKER_FLAGS:STRING="${LDFLAGS}" \
    
      52           -DCMAKE_INSTALL_PREFIX="/usr" \
    
      53           -DCMAKE_INSTALL_LIBDIR="lib" \
    
      54           -DCMAKE_INSTALL_SYSCONFDIR="/etc"
    
      55  make
    
      56}
    
      57
    
      58package() {
    
      59  cd "$srcdir/$pkgname-$pkgver/$pkgname-build"
    
      60  make DESTDIR="$pkgdir/" install
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2