botan2

LOW

maintainer the-k 17 votes scanned 2026-10-27 00:23:28.674093

View on AUR

Why flagged

The source is a tarball from the project's official domain (botan.randombit.net), which is not on the whitelist but is plausibly legitimate; the package builds from source and includes PGP verification, reducing risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official domain (botan.randombit.net), which is not on the whitelist but is plausibly legitimate; the package builds from source and includes PGP verification, reducing risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 source=(https://botan.randombit.net/releases/Botan-"${pkgver}".tar.xz{,.asc}

PKGBUILD

1 offending line(s) highlighted

      1#!/hint/bash -e
    
      2#
    
      3# Maintainer: Ľubomír 'the-k' Kučera <lubomir.kucera.jr at gmail.com>
    
      4# Contributor: Antonio Rojas <arojas@archlinux.org>
    
      5# Contributor: Alexander F. Rødseth <xyproto@archlinux.org>
    
      6# Contributor: Angel Velasquez <angvp@archlinux.org>
    
      7# Contributor: Douglas Soares de Andrade <douglas@archlinux.org>
    
      8# Contributor: d'Ronin <daronin@2600.com>
    
      9# Contributor: Hexchain Tong <richard0053@gmail.com>
    
      10# Contributor: Jack Lloyd <jack@randombit.net>
    
      11
    
      12pkgname=botan2
    
      13pkgver=2.19.5
    
      14pkgrel=5
    
      15pkgdesc='Crypto library written in C++ (legacy version)'
    
      16arch=(x86_64)
    
      17url='https://botan.randombit.net/'
    
      18license=(BSD)
    
      19depends=(
    
      20  glibc
    
      21)
    
      22makedepends=(
    
      23  boost
    
      24  python
    
      25  python-setuptools
    
      26  python-sphinx
    
      27)
    
      28optdepends=('python: for using botan2.py')
    
      29source=(https://botan.randombit.net/releases/Botan-"${pkgver}".tar.xz{,.asc}
    
      30        boost-fixes.patch
    
      31        fix-oaep-unpad-breaking-change.patch
    
      32        CVE-2024-50382.patch
    
      33        CVE-2024-50383.patch
    
      34)
    
      35sha256sums=('dfeea0e0a6f26d6724c4af01da9a7b88487adb2d81ba7c72fcaf52db522c9ad4'
    
      36            'SKIP'
    
      37            '4d6e04836b934671b893b7df207159b7a945191f25c134a8ab95ff43bd6ae536'
    
      38            '4cdf87b7b8f6a7eda78df335944af806e63ab22cec528914306cf14c35a45d90'
    
      39            '34a34279260487a5f62859ba5abddb0cdcfdf0b62b1c49acf60117a941df0e07'
    
      40            '4493316d4d04e152f3dd980b4710741bd620db404af59fba846f269ce2efeaa1')
    
      41validpgpkeys=('621DAF6411E1851C4CF9A2E16211EBF1EFBADFBC') # Botan Distribution Key
    
      42
    
      43declare -gA _depends=(
    
      44  [bzip2]="libbz2.so"
    
      45  [libgcc]="libgcc_s.so"
    
      46  [libstdc++]="libstdc++.so"
    
      47  [sqlite]="libsqlite3.so"
    
      48  [xz]="liblzma.so"
    
      49  [zlib]="libz.so"
    
      50)
    
      51makedepends+=(
    
      52  "${!_depends[@]}"
    
      53)
    
      54
    
      55prepare() {
    
      56  cd "Botan-${pkgver}"
    
      57
    
      58  patch -p0 -i ../boost-fixes.patch
    
      59  patch -p1 -i ../fix-oaep-unpad-breaking-change.patch
    
      60
    
      61  patch -p1 -i ../CVE-2024-50382.patch
    
      62  patch -p1 -i ../CVE-2024-50383.patch
    
      63}
    
      64
    
      65build() {
    
      66  cd Botan-$pkgver
    
      67
    
      68  ./configure.py \
    
      69    --prefix=/usr \
    
      70    --with-bzip \
    
      71    --with-lzma \
    
      72    --with-zlib \
    
      73    --with-boost \
    
      74    --with-sqlite3 \
    
      75    --with-os-feature=getrandom \
    
      76    --build-targets=shared,tests
    
      77  make
    
      78}
    
      79
    
      80check() {
    
      81  cd Botan-$pkgver
    
      82
    
      83  LD_LIBRARY_PATH="$PWD" ./botan-test
    
      84}
    
      85
    
      86package() {
    
      87  # shellcheck disable=SC2206
    
      88  depends+=(
    
      89    ${_depends[@]}
    
      90  )
    
      91
    
      92  : "${pkgdir:?}"
    
      93
    
      94  DESTDIR="$pkgdir" make -C Botan-$pkgver install
    
      95  install -Dm644 Botan-$pkgver/license.txt "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      96}
    
      97
    
      98: "${arch[@]}"
    
      99: "${depends[@]}"
    
      100: "${license[@]}"
    
      101: "${makedepends[@]}"
    
      102: "${optdepends[@]}"
    
      103: "${pkgdesc}"
    
      104: "${pkgrel}"
    
      105: "${source[@]}"
    
      106: "${sha256sums[@]}"
    
      107: "${url}"
    
      108: "${validpgpkeys[@]}"
    
      109

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2