safesignidentityclient

maintainer pedrohqb · 12 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt binaries (RPM and DEB) from assets.ctfassets.net, which is Contentful's CDN — a generic content delivery platform, not the official vendor's own infrastructure. While KPN/AET may legitimately host their downloads there, it is not a verifiable official vendor domain and there is no way to confirm the chain of custody. The binaries are extracted and installed directly (PKCS#11 provider libraries, token manager executables), meaning any compromise or substitution at that CDN would result in arbitrary code execution on the user's system. SHA256 checksums are present, which mitigates silent substitution after the fact, but does not address whether the original upload was legitimate. This is a genuine medium-severity supply-chain concern: executed binary code from a non-canonical host with no GPG signature verification, even if not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("https://assets.ctfassets.net/zuadwp3l2xby/3b4YS8ts1cuD4BnUoQGZXl/93f644f03cc226b2adab290be11c6cd5/SafeSignICStandardLinux4.5.0.0-AET.000redhat10x86_64.rpm" "https://assets.ctfassets.net/zuadwp3l2xby/6vGICRnQgQ8TkcHTgcouIr/5acf96dcbc0364aa9228606d3969ef97/SafeSignICStandardLinux4.5.0.0-AET.000ub2404x86_64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads prebuilt binaries (RPM and DEB) from assets.ctfassets.net, which is Contentful's CDN — a generic content delivery platform, not the official vendor's own infrastructure. While KPN/AET may legitimately host their downloads there, it is not a verifiable official vendor domain and there is no way to confirm the chain of custody. The binaries are extracted and installed directly (PKCS#11 provider libraries, token manager executables), meaning any compromise or substitution at that CDN would result in arbitrary code execution on the user's system. SHA256 checksums are present, which mitigates silent substitution after the fact, but does not address whether the original upload was legitimate. This is a genuine medium-severity supply-chain concern: executed binary code from a non-canonical host with no GPG signature verification, even if not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Pedro Henrique Quitete Barreto <pedrohqb@gmail.com>
    
      2# Contributor: Geyslan G. Bem <geyslan@gmail.com>
    
      3# Contributor: Denis A. Altoé Falqueto <denisfalqueto@gmail.com>
    
      4pkgname=safesignidentityclient
    
      5pkgver=4.5.0.0
    
      6pkgrel=1
    
      7pkgdesc="Smart card PKCS#11 provider and token manager"
    
      8arch=('x86_64')
    
      9url="https://certificaat.kpn.com/installatie-en-gebruik/installatie/pas-usb-stick/linux/"
    
      10license=('custom:copyright')
    
      11options=(!debug)
    
      12depends=('gcc-libs' 'glib2' 'glibc' 'hicolor-icon-theme' 'pcsclite' 'libsm' 'libx11' 'cairo' 'pango'
    
      13         'gdk-pixbuf2' 'at-spi2-core' 'gtk3' 'libxxf86vm' 'openssl' 'gdbm')
    
      14optdepends=('ccid: Generic support for CCID devices',
    
      15            'acsccid: ACS CCID PC/SC driver',
    
      16            'scmccid: binary driver for the SCM Smart Card Readers')
    
      17source_x86_64=("https://assets.ctfassets.net/zuadwp3l2xby/3b4YS8ts1cuD4BnUoQGZXl/93f644f03cc226b2adab290be11c6cd5/SafeSignICStandardLinux4.5.0.0-AET.000redhat10x86_64.rpm" "https://assets.ctfassets.net/zuadwp3l2xby/6vGICRnQgQ8TkcHTgcouIr/5acf96dcbc0364aa9228606d3969ef97/SafeSignICStandardLinux4.5.0.0-AET.000ub2404x86_64.deb")
    
      18sha256sums_x86_64=('2f5ea4622fda213c9bfc8bf4da51dac09983a349326f9275309565dbdb123378' '7742e21e3141e51e307d7613b4046886bc7c4aa203835dcf5c43cd348f2a1b91')
    
      19noextract=('SafeSignICStandardLinux4.5.0.0-AET.000ub2404x86_64.deb')
    
      20
    
      21# preparing the package to use the Ubuntu libraries as they are compatible with Arch
    
      22
    
      23prepare() {
    
      24  ar x SafeSignICStandardLinux4.5.0.0-AET.000ub2404x86_64.deb
    
      25  mkdir safesign-deb
    
      26  tar xvf data.tar.zst -C safesign-deb
    
      27  rm -rf ${srcdir}/usr/lib64
    
      28  mv ${srcdir}/safesign-deb/usr/lib/ ${srcdir}/usr/lib64 
    
      29}
    
      30
    
      31package() {
    
      32  install -d ${pkgdir}/usr
    
      33  cp -R ${srcdir}/usr/{bin,share} ${pkgdir}/usr/
    
      34
    
      35  install -d ${pkgdir}/usr/lib
    
      36  cp -R ${srcdir}/usr/lib64/. ${pkgdir}/usr/lib/
    
      37
    
      38  install -d ${pkgdir}/usr/share/licenses/${pkgname}
    
      39  install -m 644 ${srcdir}/usr/share/doc/${pkgname}/copyright ${pkgdir}/usr/share/licenses/${pkgname}/copyright
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2