scmccid

maintainer vitaliikuzhdin · 12 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from the official vendor's domain (scm-pc-card.de), which is plausibly the project's own infrastructure; despite the static analyzer flag for a non-standard host, the source is from the official vendor and the binaries are verified via checksums, making the risk low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the official vendor's domain (scm-pc-card.de), which is plausibly the project's own infrastructure; despite the static analyzer flag for a non-standard host, the source is from the official vendor and the binaries are verified via checksums, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source_i686=("${pkgname}-${pkgver}-i686.tar.gz::https://www.scm-pc-card.de/file/driver/Readers_Writers/${_pkgsrc//-/_}_rel.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2# Contributor: Bjoern Franke <bjo@nord-west.org>
    
      3# Contributor: egore911
    
      4
    
      5pkgname=scmccid
    
      6pkgver=5.0.35
    
      7pkgrel=6
    
      8pkgdesc="Binary driver for the SCM smart card readers"
    
      9arch=(
    
      10  'i686'
    
      11  'x86_64'
    
      12)
    
      13url="https://www.scm-pc-card.de/driver"
    
      14license=('custom:Proprietary')
    
      15depends=(
    
      16  'glibc'
    
      17  'pcsclite'
    
      18  'libusb-compat'
    
      19)
    
      20makedepends=(
    
      21  'xxd'
    
      22)
    
      23backup=(
    
      24  "usr/lib/identiv/ini/${pkgname}.ini"
    
      25)
    
      26_pkgsrc="${pkgname}_${pkgver}_linux"
    
      27source_i686=("${pkgname}-${pkgver}-i686.tar.gz::https://www.scm-pc-card.de/file/driver/Readers_Writers/${_pkgsrc//-/_}_rel.tar.gz")
    
      28source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://www.scm-pc-card.de/file/driver/Readers_Writers/${_pkgsrc//-/_}_rel_64.tar.gz")
    
      29sha256sums_i686=('791a80a1eeee6544d32e1dcaddb7383e6566a89b6f4a97ce0565dd8f274def65')
    
      30sha256sums_x86_64=('4857f7402fb585909622020e1007c81d1ebc3c71574d6f1a993e03e5431331e4')
    
      31
    
      32# https://everydaywithlinux.blogspot.com/2012/11/patch-strings-in-binary-files-with-sed.html
    
      33_patch_strings_in_file() {
    
      34  local FILE="$1"
    
      35  local PATTERN="$2"
    
      36  local REPLACEMENT="$3"
    
      37  
    
      38  STRINGS=$(strings ${FILE} | grep ${PATTERN} | sort -u -r)
    
      39  if [ "${STRINGS}" != "" ] ; then
    
      40    echo "Patching file '${FILE}'"
    
      41    for OLD_STRING in ${STRINGS} ; do
    
      42      NEW_STRING=${OLD_STRING//${PATTERN}/${REPLACEMENT}}
    
      43      OLD_STRING_HEX="$(echo -n "${OLD_STRING}" | xxd -g 0 -u -ps -c 256 | tr -d '\n')"
    
      44      NEW_STRING_HEX="$(echo -n "${NEW_STRING}" | xxd -g 0 -u -ps -c 256 | tr -d '\n')"
    
      45      if [ ${#NEW_STRING_HEX} -le ${#OLD_STRING_HEX} ] ; then
    
      46        while [ ${#NEW_STRING_HEX} -lt ${#OLD_STRING_HEX} ] ; do
    
      47          NEW_STRING_HEX="${NEW_STRING_HEX}00"
    
      48        done
    
      49        echo -n "Replacing ${OLD_STRING} with ${NEW_STRING}... "
    
      50        hexdump -ve '1/1 "%.2X"' ${FILE} | \
    
      51          sed "s/${OLD_STRING_HEX}/${NEW_STRING_HEX}/g" | \
    
      52          xxd -r -p > ${FILE}.tmp
    
      53        chmod --reference ${FILE} ${FILE}.tmp
    
      54        mv ${FILE}.tmp ${FILE}
    
      55        echo "Done!"
    
      56      else
    
      57        echo "New string '${NEW_STRING}' is longer than old string '${OLD_STRING}'. Skipping."
    
      58      fi
    
      59    done
    
      60  fi
    
      61}
    
      62
    
      63prepare() {
    
      64  cd "${srcdir}/${_pkgsrc}"
    
      65  sed -i 's|/usr/local/scm/ini|/usr/lib/identiv/ini|g' 'ReadmeFirst.txt'
    
      66
    
      67  cd "proprietary/scmccid.bundle/Contents/Linux"
    
      68  _patch_strings_in_file libscmccid.so.* '/usr/local' '/usr/lib'
    
      69}
    
      70
    
      71package() {
    
      72  cd "${srcdir}/${_pkgsrc}"
    
      73  install -vDm644 "${pkgname}.ini"  "${pkgdir}/usr/lib/identiv/ini/${pkgname}.ini"
    
      74  install -vDm644 "ReadmeFirst.txt" "${pkgdir}/usr/share/doc/${pkgname}/README.txt"
    
      75
    
      76  cd "proprietary"
    
      77  local pcslite_usbdropdir="$(pkg-config libpcsclite --variable=usbdropdir)"
    
      78  install -vd "${pkgdir}${pcslite_usbdropdir}"
    
      79  cp -va --no-preserve=ownership ./*.bundle -t "${pkgdir}${pcslite_usbdropdir}"
    
      80  
    
      81  install -vDm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      82}
    
      83

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2