softplan-websigner
MEDIUM
maintainer tioguda
5 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt .deb from a non-whitelisted, project-owned host (softplan.com.br), which is an unverifiable binary artifact; if the host were compromised, an attacker could silently replace the executable, posing a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("${pkgname}-${pkgver}-64.deb::https://websigner.softplan.com.br/Downloads/${_pkgver}/webpki-chrome-64-deb")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted, project-owned host (softplan.com.br), which is an unverifiable binary artifact; if the host were compromised, an attacker could silently replace the executable, posing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: tioguda <guda.flavio@gmail.com>
2
# Maintainer: Pedro Henrique Quitete Barreto <pedrohqb@gmail.com>
3
4
pkgname=softplan-websigner
5
_pkgver=2.15.0
6
pkgver=${_pkgver}.1
7
pkgrel=2
8
pkgdesc="The Web Signer native application.. An easy solution for using digital certificates in Web applications."
9
arch=('x86_64')
10
url="https://websigner.softplan.com.br"
11
license=('custom')
12
depends=('desktop-file-utils' 'glib2' 'gtk3>=3.6' 'hicolor-icon-theme' 'xdg-utils')
13
options=('!strip' '!emptydirs')
14
install=${pkgname}.install
15
DLAGENTS=('https::/usr/bin/curl -k -o %o %u')
16
source=("${pkgname}-${pkgver}-64.deb::https://websigner.softplan.com.br/Downloads/${_pkgver}/webpki-chrome-64-deb")
17
sha512sums=('54bb4dd51f3ea442db2789f15bde5ee3e5fb92a7b8dc269198b700f75a731918c8eaefa7c7aa3a6c08086e7d0efc133f55b6f112fc8213b7401cc850e250f6de')
18
19
package(){
20
21
# Extract package data
22
tar xf data.tar.zst -C "${pkgdir}"
23
24
# Fix directory structure differences
25
rm -rf "${pkgdir}"/usr/lib/*
26
mv "${pkgdir}"/usr/lib64/* "${pkgdir}"/usr/lib
27
rm -rf "${pkgdir}"/usr/lib64
28
29
# Archify folder permissions
30
cd ${pkgdir}
31
for d in $(find . -type d); do
32
chmod 755 $d
33
done
34
35
}
36
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |