wiso-steuer-2026
maintainer Auerhuhn
· 4 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads the official installer and documentation from the vendor's own domains (buhl.de, buhl-data.com), which are plausibly controlled by the software vendor; the files are not executed remotely but extracted and repackaged locally, and the PDF documentation having a SKIP'd checksum does not enable code execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official installer and documentation from the vendor's own domains (buhl.de, buhl-data.com), which are plausibly controlled by the software vendor; the files are not executed remotely but extracted and repackaged locally, and the PDF documentation having a SKIP'd checksum does not enable code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
"https://download.buhl.de/hotline/db/9/${_installer_name}.exe" -
PKGBUILD:34
'https://update1.buhl-data.com/Steuer/2026/Handbuch_WISO_Steuer_Win.pdf'
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Claudia Pellegrino <auerhuhn@archlinux.org>
2
3
pkgname=wiso-steuer-2026
4
pkgver=33.9.3580
5
pkgrel=1
6
pkgdesc='File your German tax return for the tax year 2025'
7
arch=('x86_64')
8
url='https://www.buhl.de/produkte/wiso-steuer'
9
depends=(
10
'bash'
11
'coreutils'
12
'wine'
13
'wine-mono'
14
'wine-gecko'
15
'winetricks'
16
'zenity'
17
)
18
makedepends=(
19
'imagemagick'
20
'msitools'
21
'p7zip'
22
'pev'
23
)
24
license=('LicenseRef-custom')
25
options=('!strip')
26
install="${pkgname}.install"
27
28
_installer_name="WISOSteuer2026Update$(
29
awk <<< "${pkgver}" -F . '{ print $1$3 }'
30
)"
31
32
source=(
33
"https://download.buhl.de/hotline/db/9/${_installer_name}.exe"
34
'https://update1.buhl-data.com/Steuer/2026/Handbuch_WISO_Steuer_Win.pdf'
35
'wiso-steuer-2026.bash'
36
'wiso-steuer-2026.desktop'
37
)
38
39
sha512sums=('2e180a7402dae282a7c2cb0bd2e91f5bffefbfc93f6f9ce01fe3f2d1e29092e9153b4aaec1a8eab12a1c509c70a9556114747d17e4cc0ac89d3aa1ed555fd819'
40
'SKIP'
41
'a5c60dcf26a22cf151caf32ad293ea1ac9ddac0e5c93cc14f25b5aa1fd886d4c4f149654d8498e3a0335c30ff178c7ad5b936141f0a01c3bd853836790997480'
42
'f49b6c1d54c907253d2ad378c248f21da0ee98053b4bd090a9b92363c574902eb8364b0b8e2e759bdd09fcab315672c8d22fc06d9915207fb91170d9a7ef04ba')
43
44
prepare() {
45
mkdir -p "${srcdir}/${pkgname}-msi"
46
7z x -o"${srcdir}/${pkgname}-msi" "${srcdir}/${_installer_name}.exe"
47
# Use a symlink to strip the first three path elements
48
mkdir -p "${srcdir}/${pkgname}-staging" \
49
"${srcdir}/${pkgname}-tmpextract/PFiles64/WISO"
50
ln -fns \
51
"${srcdir}/${pkgname}-staging" \
52
"${srcdir}/${pkgname}-tmpextract/PFiles64/WISO/Steuersoftware 2026"
53
msiextract -C "${srcdir}/${pkgname}-tmpextract" \
54
"${srcdir}/${pkgname}-msi/sparbgtst.msi"
55
}
56
57
package() {
58
cd "${pkgname}-staging"
59
60
echo >&2 'Packaging the licenses'
61
install -D -m 644 -t "${pkgdir}/usr/share/licenses/${pkgname}" \
62
'fremdlizenz.pdf'
63
64
echo >&2 'Packaging program files and documentation'
65
install -D -m 644 -t "${pkgdir}/usr/share/doc/${pkgname}" \
66
../Handbuch_WISO_Steuer_Win.pdf
67
install -D -m 644 -t "${pkgdir}/usr/share/doc/${pkgname}/dokumente" \
68
dokumente/*
69
rm -rf dokumente
70
mkdir -p "${pkgdir}/usr/lib/${pkgname}"
71
cp -R --preserve=mode "../${pkgname}-staging" \
72
"${pkgdir}/usr/lib/${pkgname}/app"
73
ln -fns "/usr/share/doc/${pkgname}/dokumente" "${pkgdir}/usr/lib/${pkgname}/app/"
74
75
echo >&2 'Packaging app icon'
76
mkdir -p "${pkgdir}/usr/share/pixmaps"
77
magick 'wisoakt.ico' \
78
-delete 1,2,3,4,5,6,7,8 "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
79
80
echo >&2 'Packaging launcher'
81
install -D -m 755 -T "../${pkgname}.bash" \
82
"${pkgdir}/usr/bin/${pkgname}"
83
84
echo >&2 'Packaging desktop file'
85
install -D -m 755 -t "${pkgdir}/usr/share/applications" \
86
"../${pkgname}.desktop"
87
}
88
Changes since previous scan
--- PKGBUILD @ 2026-07-28 00:07+++ PKGBUILD @ 2026-08-03 00:08@@ -1,7 +1,7 @@ # Maintainer: Claudia Pellegrino <auerhuhn@archlinux.org> pkgname=wiso-steuer-2026-pkgver=33.7.3410+pkgver=33.9.3580 pkgrel=1 pkgdesc='File your German tax return for the tax year 2025' arch=('x86_64')@@ -36,7 +36,7 @@ 'wiso-steuer-2026.desktop' ) -sha512sums=('090b305663f27bce262786cace4964aebbd4d2fba1888dfbcbad92282e6a09972d9546c6c6a7b3b0afcbb527103bd4e333817207f13b5237a32dc6a031fa4b04'+sha512sums=('2e180a7402dae282a7c2cb0bd2e91f5bffefbfc93f6f9ce01fe3f2d1e29092e9153b4aaec1a8eab12a1c509c70a9556114747d17e4cc0ac89d3aa1ed555fd819' 'SKIP' 'a5c60dcf26a22cf151caf32ad293ea1ac9ddac0e5c93cc14f25b5aa1fd886d4c4f149654d8498e3a0335c30ff178c7ad5b936141f0a01c3bd853836790997480' 'f49b6c1d54c907253d2ad378c248f21da0ee98053b4bd090a9b92363c574902eb8364b0b8e2e759bdd09fcab315672c8d22fc06d9915207fb91170d9a7ef04ba')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 19:39:35 | MEDIUM | 1 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |