steuern-lu-np-2023

maintainer thomasgassmann · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a shell script (steuern.lu.2023nP.sh) from steuersoftware.lu.ch and immediately executes it during the prepare() phase. The host appears to be the official Canton of Lucerne tax software distribution server (lu.ch is the official domain for the Canton of Lucerne, Switzerland), so this is likely a legitimate government software package rather than a personal or unofficial host. However, the checksum is set to SKIP, meaning there is no integrity verification of the downloaded and executed script. This is a genuine supply-chain concern: if the host is compromised, the download is intercepted (MITM), or the file is silently updated, arbitrary code will execute on the builder's system with no checksum to detect tampering. The combination of executing a downloaded script with SKIP'd checksum is a real medium-severity risk regardless of the apparent legitimacy of the source host. The .desktop file has a proper checksum. The package itself appears to be legitimate tax software, not piracy.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "https://steuersoftware.lu.ch/steuern23/steuern.lu.2023nP.sh"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a shell script (steuern.lu.2023nP.sh) from steuersoftware.lu.ch and immediately executes it during the prepare() phase. The host appears to be the official Canton of Lucerne tax software distribution server (lu.ch is the official domain for the Canton of Lucerne, Switzerland), so this is likely a legitimate government software package rather than a personal or unofficial host. However, the checksum is set to SKIP, meaning there is no integrity verification of the downloaded and executed script. This is a genuine supply-chain concern: if the host is compromised, the download is intercepted (MITM), or the file is silently updated, arbitrary code will execute on the builder's system with no checksum to detect tampering. The combination of executing a downloaded script with SKIP'd checksum is a real medium-severity risk regardless of the apparent legitimacy of the source host. The .desktop file has a proper checksum. The package itself appears to be legitimate tax software, not piracy.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Thomas Gassmann <thomas@gassmann.dev>
    
      2
    
      3pkgname=steuern-lu-np-2023
    
      4pkgver=2023.1
    
      5pkgrel=3
    
      6pkgdesc="Lucerne tax declaration software for natural persons 2023"
    
      7arch=(any)
    
      8url="https://steuern.lu.ch/steuererklaerung/steuererklaerung_natp/Installation"
    
      9license=('custom')
    
      10depends=("java-environment" "bash")
    
      11source=(
    
      12  "https://steuersoftware.lu.ch/steuern23/steuern.lu.2023nP.sh"
    
      13  "$pkgname.desktop"
    
      14)
    
      15sha256sums=(
    
      16  'SKIP'
    
      17  '43ef0bd8903205ac63b529d7bd73ac90b79fc59ed10f56e894ec570e0eb02b2a'
    
      18)
    
      19
    
      20prepare() {
    
      21  chmod +x "$srcdir"/steuern.lu.2023nP.sh
    
      22	"$srcdir"/steuern.lu.2023nP.sh -q \
    
      23		-Dall=true \
    
      24		-V'addToPath$Integer'=1 \
    
      25		-dir "$srcdir/steuern-lu-np-2023"
    
      26}
    
      27
    
      28package() {
    
      29  mkdir -p "$pkgdir"/opt/steuern-lu-np-2023
    
      30  cp -R "$srcdir"/steuern-lu-np-2023/* "$pkgdir"/opt/steuern-lu-np-2023
    
      31  install -Dm644 "$srcdir"/$pkgname.desktop \
    
      32    "$pkgdir"/usr/share/applications/$pkgname.desktop
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2