wiso-steuer-2025
LOW
maintainer Auerhuhn
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from official vendor sources (buhl-data.com, download.buhl.de) which are plausibly the project's own; the eval is used safely to restore a trap after a wine command, not to execute remote code; the non-whitelisted hosts are official update/download domains for the software vendor; the installed files are self-contained and no untrusted remote execution occurs.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from official vendor sources (buhl-data.com, download.buhl.de) which are plausibly the project's own; the eval is used safely to restore a trap after a wine command, not to execute remote code; the non-whitelisted hosts are official update/download domains for the software vendor; the installed files are self-contained and no untrusted remote execution occurs.
-
PKGBUILD:151
eval "${_restoretrap}"
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:34
'https://update1.buhl-data.com/ESD/Steuer/2025/WISOSteuer2025.exe' -
PKGBUILD:36
"https://download.buhl.de/hotline/db/9/${_updater_name}.exe"
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: Claudia Pellegrino <auerhuhn@archlinux.org>
2
3
pkgname=wiso-steuer-2025
4
pkgver=32.12.3380
5
pkgrel=1
6
pkgdesc='File your German tax return for the tax year 2024'
7
arch=('x86_64')
8
url='https://www.buhl.de/produkte/wiso-steuer'
9
depends=(
10
'bash'
11
'coreutils'
12
'wine'
13
'wine-mono'
14
'wine-gecko'
15
'winetricks'
16
'zenity'
17
)
18
makedepends=(
19
'cabextract'
20
'imagemagick'
21
'p7zip'
22
'pev'
23
'unshield'
24
)
25
license=('LicenseRef-custom')
26
options=('!strip')
27
install="${pkgname}.install"
28
29
_updater_name="WISOSteuer2025Update$(
30
awk <<< "${pkgver}" -F . '{ print $1$3 }'
31
)"
32
33
source=(
34
'https://update1.buhl-data.com/ESD/Steuer/2025/WISOSteuer2025.exe'
35
'https://update1.buhl-data.com/Steuer/2025/Handbuch_WISO_Steuer_Win.pdf'
36
"https://download.buhl.de/hotline/db/9/${_updater_name}.exe"
37
'wiso-steuer-2025.bash'
38
'wiso-steuer-2025.desktop'
39
)
40
41
sha512sums=('SKIP'
42
'SKIP'
43
'f350b914ad5f1afb1da79f6560759814230d83879752ab5532bd411fdc8e79d2583239900c587c1ffa3d3ed03fccbeb0d229b88aa3c785f17a41c1f60a21be71'
44
'5a4f740a89c70c2dfd721142dd8b0135ee1e503686d4efcf6b59f9a0984d0a9f4d9780a3261988a51c068ef1ede2e4c98803095fd44ba52f1cb08b0f4f47e2dd'
45
'ede44188da134d5d120c6c8c4d619d91e998a1b9f28497e82307a99a65a7791e492d9c3e7ae2d6c297ef7a12e87a5579cd86bd36b805a5bc0ad1ff7197addaaa')
46
47
prepare() {
48
_extract_original_installer \
49
"${srcdir}/WISOSteuer2025.exe" \
50
"${srcdir}/${pkgname}" "${srcdir}/${pkgname}-support"
51
_stage_original_app \
52
"${srcdir}/${pkgname}" \
53
"${srcdir}/${pkgname}-staging"
54
_run_updater_in_place \
55
"${srcdir}/${_updater_name}.exe" \
56
"${srcdir}/${pkgname}-staging"
57
}
58
59
_extract_original_installer() {
60
local _original_exe _extracted_installer _extracted_support_files
61
_original_exe="${1?}"
62
_extracted_installer="${2?}"
63
_extracted_support_files="${3?}"
64
65
echo >&2 'Extracting original installer'
66
mkdir -p "${srcdir}/${pkgname}-cab"
67
7z x -o"${srcdir}/${pkgname}-cab" "${_original_exe}"
68
unshield -d "${_extracted_installer}" x \
69
"${srcdir}/${pkgname}-cab/data1.cab"
70
mkdir -p "${_extracted_support_files}"
71
cp -R --preserve=mode "${srcdir}/${pkgname}-cab/ISSetupPrerequisites" \
72
"${_extracted_support_files}/"
73
}
74
75
_stage_original_app() {
76
local _extracted _staging
77
_extracted="${1?}"
78
_staging="${2?}"
79
80
echo >&2 'Staging app directory'
81
cd "${_extracted}"
82
install -D -t "${_staging}/plugins2" \
83
elster.plugins2/*
84
find . \
85
-regex './letstrade5\|./\(dokumente\|elster\.\|letstrade5\.scraper\|qt\.files\.\|starter\|_Support_\).*' \
86
-prune -o \
87
-type f -exec install -t "${_staging}" '{}' ';'
88
install -D -t "${_staging}/letstrade5" \
89
letstrade5/*
90
install -D -t "${_staging}/letstrade5/Scraper" \
91
letstrade5.scraper/*
92
install -D -t "${_staging}/letstrade5/Scraper/Plugins" \
93
letstrade5.scraper.plugins/*
94
install -D -t "${_staging}/letstrade5/Scraper/extensions/GeckoScraper" \
95
letstrade5.scraper.extensions.geckoscraper/*
96
install -D -t "${_staging}/letstrade5/Scraper/extensions/GeckoScraper/chrome/content" \
97
letstrade5.scraper.extensions.geckoscraper.chrome.content/*
98
install -D -t "${_staging}/letstrade5/Scraper/extensions/GeckoScraper/components" \
99
letstrade5.scraper.extensions.geckoscraper.components/*
100
install -D -t "${_staging}/letstrade5/Scraper/extensions/GeckoScraper/defaults/preferences" \
101
letstrade5.scraper.extensions.geckoscraper.defaults.preferences/*
102
install -D -t "${_staging}/letstrade5/Scraper/xulrunner" \
103
letstrade5.scraper.xulrunner/*
104
install -DT \
105
'_Support_Language_Independent_OS_Independent_Files/lic_steuer_win_mac.txt' \
106
"${_staging}/lizenztext.txt"
107
#shellcheck disable=SC2016
108
find . -maxdepth 1 -regex './qt.files.[^_]*' -printf '%f\n' \
109
| cut -d . -f 3 \
110
| xargs -r -L 1 \
111
bash -c 'install -D -t "${1}/${2}" "qt.files.${2}"/*' _ "${_staging}"
112
install -D -t "${_staging}/translations/qtwebengine_locales" \
113
qt.files.translations_qtwebengine_locales/*
114
install -D -t "${_staging}/sqldrivers" \
115
qt.files.sqldrivers/*
116
install -DT -m 755 starter.sparbuch.dl/wisodl2025.exe "${_staging}/WISO2025.EXE"
117
}
118
119
_run_updater_in_place() {
120
local _updater_exe _staging
121
local _exitstatus _patchlog _restoretrap WINEARCH WINEDEBUG WINEPREFIX
122
_updater_exe="${1?}"
123
_staging="${2?}"
124
125
export WINEARCH WINEDEBUG WINEPREFIX
126
WINEARCH=win64
127
WINEDEBUG=fixme-all
128
WINEPREFIX="$(mktemp -dt tmp.XXXXXXXX.wine.pkgbuild)"
129
130
cd "${_staging}"
131
132
echo >&2 'Extracting updater'
133
wine "${_updater_exe}" \
134
"/extract_all:$(winepath -w "${srcdir}/${pkgname}-updater-cab")"
135
unshield -d "${srcdir}/${pkgname}-updater" x \
136
"${srcdir}/${pkgname}-updater-cab/Disk1/data1.cab"
137
138
echo >&2 'Staging updater'
139
install -D -t . \
140
"${srcdir}/${pkgname}-updater/_Support_Language_Independent_OS_Independent_Files/btspatcher.exe" \
141
"${srcdir}/${pkgname}-updater/_Support_Language_Independent_OS_Independent_Files"/*.inf \
142
"${srcdir}/${pkgname}-updater/_Support_Language_Independent_OS_Independent_Files"/*.rtp
143
144
echo >&2 'Running updater in place'
145
_restoretrap=$(trap -p ERR)
146
trap - ERR
147
set +e
148
wine btspatcher.exe -test
149
_exitstatus=$?
150
set -e
151
eval "${_restoretrap}"
152
153
echo >&2 'Cleaning up temporary Wine prefix'
154
wineserver -w
155
rm -rf "${WINEPREFIX}"
156
157
echo >&2 'Checking updater result'
158
if [[ $_exitstatus -ne 51 ]]; then
159
_patchlog="$(
160
find . -maxdepth 1 -name '*.patch.log' -exec realpath '{}' + \
161
| sort -R | head -1
162
)"
163
printf >&2 'Unexpected exit status: %d\n' "${_exitstatus}"
164
if [[ -n "${_patchlog}" ]]; then
165
printf >&2 'See full patch log for details: %s\n' "${_patchlog}"
166
fi
167
exit 1
168
fi
169
170
echo >&2 'Cleaning up staging directory'
171
rm -fv -- btspatcher.log *.inf *.rtp
172
}
173
174
package() {
175
cd "${pkgname}"
176
177
echo >&2 'Packaging the licenses'
178
install -D -m 644 -t "${pkgdir}/usr/share/licenses/${pkgname}" \
179
'files.lizenz.fremd/fremdlizenz.pdf'
180
iconv -f cp1252 -t utf-8 \
181
'_Support_Language_Independent_OS_Independent_Files/lic_steuer_win_mac.txt' \
182
> "${pkgdir}/usr/share/licenses/${pkgname}/lic_steuer_win_mac.txt"
183
184
echo >&2 'Packaging program files'
185
mkdir -p "${pkgdir}/usr/lib/${pkgname}"
186
cp -R --preserve=mode "../${pkgname}-staging" \
187
"${pkgdir}/usr/lib/${pkgname}/app"
188
189
echo >&2 'Packaging support files'
190
install -D -t "${pkgdir}/usr/lib/${pkgname}/support" \
191
"../${pkgname}-support"/ISSetupPrerequisites/*/VC_redist.x64.exe
192
193
echo >&2 'Packaging the documentation'
194
install -D -m 644 -t "${pkgdir}/usr/share/doc/${pkgname}" \
195
../Handbuch_WISO_Steuer_Win.pdf
196
install -D -m 644 -t "${pkgdir}/usr/share/doc/${pkgname}/Dokumente" \
197
'dokumente.freibetrag'/*.pdf \
198
'dokumente.steuern'/*.pdf
199
ln -fns "/usr/share/doc/${pkgname}/Dokumente" "${pkgdir}/usr/lib/${pkgname}/app/"
200
201
echo >&2 'Packaging app icon'
202
mkdir -p "${pkgdir}/usr/share/pixmaps"
203
magick 'icon.wisoakt/wisoakt.ico' \
204
-delete 1,2,3,4,5 "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
205
206
echo >&2 'Packaging launcher'
207
install -D -m 755 -T "../${pkgname}.bash" \
208
"${pkgdir}/usr/bin/${pkgname}"
209
210
echo >&2 'Packaging desktop file'
211
install -D -m 755 -t "${pkgdir}/usr/share/applications" \
212
"../${pkgname}.desktop"
213
}
214
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |