qdigidoc4

maintainer kevku · 21 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from official project Git repositories and downloads configuration/data files from legitimate government and EU domains; the non-whitelisted hosts are official sources, and the SKIP'd checksums are for expected configuration files, not executables.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from official project Git repositories and downloads configuration/data files from legitimate government and EU domains; the non-whitelisted hosts are official sources, and the SKIP'd checksums are for expected configuration files, not executables.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "eu-lotl.xml-$pkgver::https://ec.europa.eu/tools/lotl/eu-lotl.xml"
PKGBUILD:18 "EE.xml-$pkgver::https://sr.riik.ee/tsl/estonian-tsl.xml"
PKGBUILD:19 "config.json-$pkgver::https://id.eesti.ee/config.json"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: kevku <kevku@gmx.com>
    
      2pkgname=qdigidoc4
    
      3pkgver=4.10.0.5402
    
      4_rls_tag=v4.10.0
    
      5pkgrel=1
    
      6pkgdesc="DigiDoc4 Client is an application for digitally signing and encrypting documents; the software includes functionality to manage Estonian ID-card - change pin codes, update certificates etc."
    
      7arch=('x86_64')
    
      8url="https://www.id.ee/"
    
      9license=('LGPL-2.1-or-later')
    
      10depends=('zlib' 'openssl' 'libdigidocpp>=4.4.0' 'libldap' 'pcsclite' 'opensc' 'qt6-base' 'qt6-svg' 'hicolor-icon-theme')
    
      11makedepends=('git' 'cmake' 'gettext' 'flatbuffers' 'qt6-tools' 'qt6-translations')
    
      12optdepends=('ccid: Smart Card support'
    
      13            'python-nautilus: Nautilus Extension')
    
      14source=("$pkgname-$pkgver::git+https://github.com/open-eid/DigiDoc4-Client.git?signed#tag=$_rls_tag"
    
      15        "open-eid-common::git+https://github.com/open-eid/qt-common.git"
    
      16        "open-eid-libcdoc::git+https://github.com/open-eid/libcdoc.git"
    
      17        "eu-lotl.xml-$pkgver::https://ec.europa.eu/tools/lotl/eu-lotl.xml"
    
      18        "EE.xml-$pkgver::https://sr.riik.ee/tsl/estonian-tsl.xml"
    
      19        "config.json-$pkgver::https://id.eesti.ee/config.json"
    
      20        "config.rsa-$pkgver::https://id.eesti.ee/config.rsa"
    
      21        "config.pub-$pkgver::https://id.eesti.ee/config.pub")
    
      22sha256sums=('8b06880b9b7ee9832abe1af88491994344d1f0324660da15dcec8fd2ab5b95c3'
    
      23            'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
    
      24validpgpkeys=(
    
      25    'D1EBC666EFCBFBD3CFC2EBAA90C0B5E75C3B195D'  # Raul Metsma https://github.com/metsma.gpg
    
      26)
    
      27
    
      28prepare() {
    
      29  cd "$srcdir/$pkgname-$pkgver"
    
      30
    
      31  git submodule init
    
      32  git config submodule.common.url $srcdir/open-eid-common
    
      33  git config submodule.client/libcdoc.url $srcdir/open-eid-libcdoc
    
      34  git -c protocol.file.allow=always submodule update
    
      35
    
      36  [[ -d "$pkgname-build" ]] && rm -r "$pkgname-build"
    
      37  mkdir -p "$pkgname-build"
    
      38  # https://github.com/open-eid/DigiDoc4-Client/wiki/DeveloperTips
    
      39  cp "$srcdir/eu-lotl.xml-$pkgver"  "client/eu-lotl.xml"
    
      40  cp "$srcdir/EE.xml-$pkgver"       "client/EE.xml"
    
      41  cp "$srcdir/config.json-$pkgver"  "common/config.json"
    
      42  cp "$srcdir/config.rsa-$pkgver"   "common/config.rsa"
    
      43  cp "$srcdir/config.pub-$pkgver"   "common/config.pub"
    
      44}
    
      45
    
      46build() {
    
      47  cd "$srcdir/$pkgname-$pkgver/$pkgname-build"
    
      48  export BUILD_NUMBER=${pkgver##*.}
    
      49  cmake .. -DCMAKE_C_FLAGS:STRING="${CFLAGS} -ffile-prefix-map=$srcdir=." \
    
      50           -DCMAKE_CXX_FLAGS:STRING="${CXXFLAGS} -ffile-prefix-map=$srcdir=." \
    
      51           -DCMAKE_EXE_LINKER_FLAGS:STRING="${LDFLAGS}" \
    
      52           -DCMAKE_INSTALL_PREFIX="/usr" \
    
      53           -DCMAKE_INSTALL_LIBDIR="lib" \
    
      54           -DCMAKE_INSTALL_SYSCONFDIR="/etc"
    
      55  make
    
      56}
    
      57
    
      58package() {
    
      59  cd "$srcdir/$pkgname-$pkgver/$pkgname-build"
    
      60  make DESTDIR="$pkgdir/" install
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2