softplan-websigner
MEDIUM
maintainer tioguda
5 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from a non-whitelisted, project-owned host (softplan.com.br), which is an unverifiable binary artifact; if the host were compromised, an attacker could silently replace the executable, posing a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("${pkgname}-${pkgver}-64.deb::https://websigner.softplan.com.br/Downloads/${_pkgver}/webpki-chrome-64-deb")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted, project-owned host (softplan.com.br), which is an unverifiable binary artifact; if the host were compromised, an attacker could silently replace the executable, posing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: tioguda <guda.flavio@gmail.com>
2
# Maintainer: Pedro Henrique Quitete Barreto <pedrohqb@gmail.com>
3
4
pkgname=softplan-websigner
5
_pkgver=2.15.0
6
pkgver=${_pkgver}.1
7
pkgrel=2
8
pkgdesc="The Web Signer native application.. An easy solution for using digital certificates in Web applications."
9
arch=('x86_64')
10
url="https://websigner.softplan.com.br"
11
license=('custom')
12
depends=('desktop-file-utils' 'glib2' 'gtk3>=3.6' 'hicolor-icon-theme' 'xdg-utils')
13
options=('!strip' '!emptydirs')
14
install=${pkgname}.install
15
DLAGENTS=('https::/usr/bin/curl -k -o %o %u')
16
source=("${pkgname}-${pkgver}-64.deb::https://websigner.softplan.com.br/Downloads/${_pkgver}/webpki-chrome-64-deb")
17
sha512sums=('54bb4dd51f3ea442db2789f15bde5ee3e5fb92a7b8dc269198b700f75a731918c8eaefa7c7aa3a6c08086e7d0efc133f55b6f112fc8213b7401cc850e250f6de')
18
19
package(){
20
21
# Extract package data
22
tar xf data.tar.zst -C "${pkgdir}"
23
24
# Fix directory structure differences
25
rm -rf "${pkgdir}"/usr/lib/*
26
mv "${pkgdir}"/usr/lib64/* "${pkgdir}"/usr/lib
27
rm -rf "${pkgdir}"/usr/lib64
28
29
# Archify folder permissions
30
cd ${pkgdir}
31
for d in $(find . -type d); do
32
chmod 755 $d
33
done
34
35
}
36
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |