webpatente

maintainer D3v1n · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt .deb binaries (executed code) from a PHP endpoint on rmastri.it, which is the maintainer's own personal/unofficial host rather than an official distribution channel. The binaries are extracted and installed directly. While the maintainer appears to be the upstream author (same domain as the url= field), the source is still a personal PHP endpoint with no reproducible/verifiable release artifacts, and only MD5 checksums (weak, collision-prone) are used for integrity verification. This is a genuine supply-chain concern: the PHP endpoint could serve different content at any time, and there is no way to independently verify the binaries match any canonical upstream release. This fits the medium category: executed binaries from an unofficial/personal host with weak integrity checks, but no evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("contrattodilicenzauf2014.pdf::https://www.rmastri.it/request.php?129")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt .deb binaries (executed code) from a PHP endpoint on rmastri.it, which is the maintainer's own personal/unofficial host rather than an official distribution channel. The binaries are extracted and installed directly. While the maintainer appears to be the upstream author (same domain as the url= field), the source is still a personal PHP endpoint with no reproducible/verifiable release artifacts, and only MD5 checksums (weak, collision-prone) are used for integrity verification. This is a genuine supply-chain concern: the PHP endpoint could serve different content at any time, and there is no way to independently verify the binaries match any canonical upstream release. This fits the medium category: executed binaries from an unofficial/personal host with weak integrity checks, but no evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# -*- Mode: shell-script -*-
    
      2# Maintainer: Roberto Mastri <rmastri@liceomalpighi.bo.it>
    
      3# Builder: lobisquit <enricolovisotto@gmail.com>
    
      4
    
      5pkgname=webpatente
    
      6pkgver=4.4.13
    
      7pkgrel=1
    
      8pkgdesc="Practise to obtain Italian driving license"
    
      9arch=('i686' 'x86_64')
    
      10url="http://www.rmastri.it/"
    
      11license=(costum)
    
      12
    
      13depends=("gtk2" "libxt" "dbus-glib" "alsa-lib" "desktop-file-utils")
    
      14
    
      15source=("contrattodilicenzauf2014.pdf::https://www.rmastri.it/request.php?129")
    
      16source_i686=("$pkgname-$pkgver-i686.deb::https://www.rmastri.it/request.php?131")
    
      17source_x86_64=("$pkgname-$pkgver-x86_64.deb::https://www.rmastri.it/request.php?139")
    
      18
    
      19install=$pkgname.install
    
      20
    
      21package () {
    
      22  ar x $pkgname-$pkgver-$CARCH.deb
    
      23  tar xvf $srcdir/data.tar.xz -C $pkgdir
    
      24
    
      25  # fix permissions
    
      26  chmod -R 755 $pkgdir/usr/
    
      27  chmod -R 775 $pkgdir/usr/share/doc/webpatente/
    
      28  chmod -R 775 $pkgdir/usr/lib/webpatente/
    
      29  chmod -R 775 $pkgdir/usr/lib/mime/
    
      30}
    
      31
    
      32md5sums=('418af5c47148aee9597fdc426edf2395')
    
      33md5sums_i686=('fddaabae0dacd0a207f2dbdb0a1c902c')
    
      34md5sums_x86_64=('d5cb9deca7f12891bf28ecf560cfcd24')
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2