rfirma-bin

LOW

maintainer Crstian 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs a prebuilt .deb from the project's official GitHub releases, which is verifiable and signed; the source is trustworthy and matches project infrastructure, but the low vote count and recent upload contribute to a low-severity flag.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt .deb from the project's official GitHub releases, which is verifiable and signed; the source is trustworthy and matches project infrastructure, but the low vote count and recent upload contribute to a low-severity flag.

PKGBUILD

      1# Maintainer: Crstian <me@crstian.me>
    
      2#
    
      3# El paquete no compila nada: instala el `.deb` de la Release tal cual, que es
    
      4# el mismo fichero que pasa `packaging/verify-packages.sh` y que firma
    
      5# `release.yml` (ADR-0015). Lo que cambia en cada version es `pkgver` y los
    
      6# resúmenes, y los escribe `packaging/aur/update.sh` desde la Release firmada.
    
      7
    
      8pkgname=rfirma-bin
    
      9pkgver=0.15.0
    
      10pkgrel=1
    
      11pkgdesc='Firma y cofirma de PDFs en PAdES con firma visible'
    
      12arch=('x86_64')
    
      13url='https://rfirma.sgomez.me'
    
      14license=('EUPL-1.2')
    
      15# Cada soname que enlazan `usr/bin/rfirma` y `librfirma_crypto.so`, a su paquete,
    
      16# y `hicolor-icon-theme` por las cuatro tallas del icono. `glibc` y `libgcc` no
    
      17# estan: son `base`.
    
      18depends=(
    
      19    'at-spi2-core'
    
      20    'cairo'
    
      21    'dbus'
    
      22    'gdk-pixbuf2'
    
      23    'glib2'
    
      24    'gtk3'
    
      25    'hicolor-icon-theme'
    
      26    'libsoup3'
    
      27    'openssl'
    
      28    'pcsclite'
    
      29    'webkit2gtk-4.1'
    
      30    'zlib'
    
      31)
    
      32optdepends=(
    
      33    'ccid: lectores de tarjetas USB, que pcscd no trae de serie'
    
      34    'nautilus-python: «Firmar con rFirma» en el menú contextual de Nautilus'
    
      35    'opensc: módulo PKCS#11 del DNIe y de otras tarjetas'
    
      36)
    
      37provides=('rfirma')
    
      38conflicts=('rfirma' 'rfirma-git')
    
      39makedepends=('libarchive')
    
      40options=('!strip' '!debug')
    
      41
    
      42_url='https://github.com/sgomez/rfirma'
    
      43source=("rfirma_${pkgver}_amd64.deb::${_url}/releases/download/v${pkgver}/rfirma_${pkgver}_amd64.deb"
    
      44        "LICENSE.md::https://raw.githubusercontent.com/sgomez/rfirma/v${pkgver}/LICENSE.md")
    
      45sha256sums=('054883b43fe2914e098548bc8366ac4f4db637d9877b525e2408c9c8611f8309'
    
      46            '2ffd0c9fce8949ae80445aac3b3a24975c053607cb9149f477fc6e4f6a4a2843')
    
      47
    
      48package() {
    
      49    # makepkg ya ha desarmado el `.deb`: lo que se instala es su `data.tar.*` entero.
    
      50    bsdtar -xf data.tar.gz -C "$pkgdir"
    
      51    install -Dm644 LICENSE.md "$pkgdir/usr/share/licenses/$pkgname/EUPL-1.2.txt"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 09:19:50	Low	2