webpatente

MEDIUM

maintainer D3v1n 5 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads prebuilt .deb binaries (executed code) from a PHP endpoint on rmastri.it, which is the maintainer's own personal/unofficial host rather than an official distribution channel. The binaries are extracted and installed directly. While the maintainer appears to be the upstream author (same domain as the url= field), the source is still a personal PHP endpoint with no reproducible/verifiable release artifacts, and only MD5 checksums (weak, collision-prone) are used for integrity verification. This is a genuine supply-chain concern: the PHP endpoint could serve different content at any time, and there is no way to independently verify the binaries match any canonical upstream release. This fits the medium category: executed binaries from an unofficial/personal host with weak integrity checks, but no evidence of active malice.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("contrattodilicenzauf2014.pdf::https://www.rmastri.it/request.php?129")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt .deb binaries (executed code) from a PHP endpoint on rmastri.it, which is the maintainer's own personal/unofficial host rather than an official distribution channel. The binaries are extracted and installed directly. While the maintainer appears to be the upstream author (same domain as the url= field), the source is still a personal PHP endpoint with no reproducible/verifiable release artifacts, and only MD5 checksums (weak, collision-prone) are used for integrity verification. This is a genuine supply-chain concern: the PHP endpoint could serve different content at any time, and there is no way to independently verify the binaries match any canonical upstream release. This fits the medium category: executed binaries from an unofficial/personal host with weak integrity checks, but no evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# -*- Mode: shell-script -*-
    
      2# Maintainer: Roberto Mastri <rmastri@liceomalpighi.bo.it>
    
      3# Builder: lobisquit <enricolovisotto@gmail.com>
    
      4
    
      5pkgname=webpatente
    
      6pkgver=4.4.13
    
      7pkgrel=1
    
      8pkgdesc="Practise to obtain Italian driving license"
    
      9arch=('i686' 'x86_64')
    
      10url="http://www.rmastri.it/"
    
      11license=(costum)
    
      12
    
      13depends=("gtk2" "libxt" "dbus-glib" "alsa-lib" "desktop-file-utils")
    
      14
    
      15source=("contrattodilicenzauf2014.pdf::https://www.rmastri.it/request.php?129")
    
      16source_i686=("$pkgname-$pkgver-i686.deb::https://www.rmastri.it/request.php?131")
    
      17source_x86_64=("$pkgname-$pkgver-x86_64.deb::https://www.rmastri.it/request.php?139")
    
      18
    
      19install=$pkgname.install
    
      20
    
      21package () {
    
      22  ar x $pkgname-$pkgver-$CARCH.deb
    
      23  tar xvf $srcdir/data.tar.xz -C $pkgdir
    
      24
    
      25  # fix permissions
    
      26  chmod -R 755 $pkgdir/usr/
    
      27  chmod -R 775 $pkgdir/usr/share/doc/webpatente/
    
      28  chmod -R 775 $pkgdir/usr/lib/webpatente/
    
      29  chmod -R 775 $pkgdir/usr/lib/mime/
    
      30}
    
      31
    
      32md5sums=('418af5c47148aee9597fdc426edf2395')
    
      33md5sums_i686=('fddaabae0dacd0a207f2dbdb0a1c902c')
    
      34md5sums_x86_64=('d5cb9deca7f12891bf28ecf560cfcd24')
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2