softplan-websigner

maintainer tioguda · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-whitelisted, project-owned host (softplan.com.br), which is an unverifiable binary artifact; if the host were compromised, an attacker could silently replace the executable, posing a supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("${pkgname}-${pkgver}-64.deb::https://websigner.softplan.com.br/Downloads/${_pkgver}/webpki-chrome-64-deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted, project-owned host (softplan.com.br), which is an unverifiable binary artifact; if the host were compromised, an attacker could silently replace the executable, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: tioguda <guda.flavio@gmail.com>
    
      2# Maintainer: Pedro Henrique Quitete Barreto <pedrohqb@gmail.com>
    
      3
    
      4pkgname=softplan-websigner
    
      5_pkgver=2.15.0
    
      6pkgver=${_pkgver}.1
    
      7pkgrel=2
    
      8pkgdesc="The Web Signer native application.. An easy solution for using digital certificates in Web applications."
    
      9arch=('x86_64')
    
      10url="https://websigner.softplan.com.br"
    
      11license=('custom')
    
      12depends=('desktop-file-utils' 'glib2' 'gtk3>=3.6' 'hicolor-icon-theme' 'xdg-utils')
    
      13options=('!strip' '!emptydirs')
    
      14install=${pkgname}.install
    
      15DLAGENTS=('https::/usr/bin/curl -k -o %o %u')
    
      16source=("${pkgname}-${pkgver}-64.deb::https://websigner.softplan.com.br/Downloads/${_pkgver}/webpki-chrome-64-deb")
    
      17sha512sums=('54bb4dd51f3ea442db2789f15bde5ee3e5fb92a7b8dc269198b700f75a731918c8eaefa7c7aa3a6c08086e7d0efc133f55b6f112fc8213b7401cc850e250f6de')
    
      18
    
      19package(){
    
      20
    
      21    # Extract package data
    
      22    tar xf data.tar.zst -C "${pkgdir}"
    
      23
    
      24    #  Fix directory structure differences
    
      25    rm -rf "${pkgdir}"/usr/lib/*
    
      26    mv "${pkgdir}"/usr/lib64/* "${pkgdir}"/usr/lib
    
      27    rm -rf "${pkgdir}"/usr/lib64
    
      28
    
      29    # Archify folder permissions
    
      30    cd ${pkgdir}
    
      31    for d in $(find . -type d); do
    
      32        chmod 755 $d
    
      33    done
    
      34
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2