botan2

MEDIUM

maintainer the-k 16 votes scanned 2026-09-11 15:22:58.728112

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=(https://botan.randombit.net/releases/Botan-${pkgver}.tar.xz{,.asc}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ľubomír 'the-k' Kučera <lubomir.kucera.jr at gmail.com>
    
      2# Contributor: Antonio Rojas <arojas@archlinux.org>
    
      3# Contributor: Alexander F. Rødseth <xyproto@archlinux.org>
    
      4# Contributor: Angel Velasquez <angvp@archlinux.org>
    
      5# Contributor: Douglas Soares de Andrade <douglas@archlinux.org>
    
      6# Contributor: d'Ronin <daronin@2600.com>
    
      7# Contributor: Hexchain Tong <richard0053@gmail.com>
    
      8# Contributor: Jack Lloyd <jack@randombit.net>
    
      9
    
      10pkgname=botan2
    
      11pkgver=2.19.5
    
      12pkgrel=5
    
      13pkgdesc='Crypto library written in C++ (legacy version)'
    
      14arch=(x86_64)
    
      15url='https://botan.randombit.net/'
    
      16license=(BSD)
    
      17depends=(
    
      18  glibc
    
      19)
    
      20makedepends=(
    
      21  boost
    
      22  python
    
      23  python-setuptools
    
      24  python-sphinx
    
      25)
    
      26optdepends=('python: for using botan2.py')
    
      27source=(https://botan.randombit.net/releases/Botan-${pkgver}.tar.xz{,.asc}
    
      28        boost-fixes.patch
    
      29        fix-oaep-unpad-breaking-change.patch
    
      30        CVE-2024-50382.patch
    
      31        CVE-2024-50383.patch
    
      32)
    
      33sha256sums=('dfeea0e0a6f26d6724c4af01da9a7b88487adb2d81ba7c72fcaf52db522c9ad4'
    
      34            'SKIP'
    
      35            '4d6e04836b934671b893b7df207159b7a945191f25c134a8ab95ff43bd6ae536'
    
      36            '4cdf87b7b8f6a7eda78df335944af806e63ab22cec528914306cf14c35a45d90'
    
      37            '34a34279260487a5f62859ba5abddb0cdcfdf0b62b1c49acf60117a941df0e07'
    
      38            '4493316d4d04e152f3dd980b4710741bd620db404af59fba846f269ce2efeaa1')
    
      39validpgpkeys=('621DAF6411E1851C4CF9A2E16211EBF1EFBADFBC') # Botan Distribution Key
    
      40
    
      41declare -gA _depends=(
    
      42  [bzip2]="libbz2.so"
    
      43  [libgcc]="libgcc_s.so"
    
      44  [libstdc++]="libstdc++.so"
    
      45  [sqlite]="libsqlite3.so"
    
      46  [xz]="liblzma.so"
    
      47  [zlib]="libz.so"
    
      48)
    
      49makedepends+=(
    
      50  "${!_depends[@]}"
    
      51)
    
      52
    
      53prepare() {
    
      54  cd "Botan-${pkgver}"
    
      55
    
      56  patch -p0 -i ../boost-fixes.patch
    
      57  patch -p1 -i ../fix-oaep-unpad-breaking-change.patch
    
      58
    
      59  patch -p1 -i ../CVE-2024-50382.patch
    
      60  patch -p1 -i ../CVE-2024-50383.patch
    
      61}
    
      62
    
      63build() {
    
      64  cd Botan-$pkgver
    
      65
    
      66  ./configure.py \
    
      67    --prefix=/usr \
    
      68    --with-bzip \
    
      69    --with-lzma \
    
      70    --with-zlib \
    
      71    --with-boost \
    
      72    --with-sqlite3 \
    
      73    --with-os-feature=getrandom \
    
      74    --build-targets=shared,tests
    
      75  make
    
      76}
    
      77
    
      78check() {
    
      79  cd Botan-$pkgver
    
      80
    
      81  LD_LIBRARY_PATH="$PWD" ./botan-test
    
      82}
    
      83
    
      84package() {
    
      85  # shellcheck disable=SC2206
    
      86  depends+=(
    
      87    ${_depends[@]}
    
      88  )
    
      89
    
      90  DESTDIR="$pkgdir" make -C Botan-$pkgver install
    
      91  install -Dm644 Botan-$pkgver/license.txt "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      92}
    
      93

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-11 15:22:58	Medium	1
2026-06-19 22:34:54	Clean	2