claws-mail-gtk2-git

LOW
maintainer dreieck 1 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package builds from a legitimate project git repository and applies publicly available patches; the non-whitelisted hosts are for patch files only, which are checksummed and do not introduce unverifiable executable code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project git repository and applies publicly available patches; the non-whitelisted hosts are for patch files only, which are checksummed and do not introduce unverifiable executable code.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:144 "${_pkgname}::git://git.claws-mail.org/claws.git#branch=${_gitbranch}"
  • PKGBUILD:146 "0002_protectedheaders.patch::http://web.archive.org/web/20240721164745/https://www.thewildbeast.co.uk/claws-mail/bugzilla/attachment.cgi?id=2331"

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: dreieck
2# Contributor: Christian Hesse
3
4_USE_CCACHE=false
5# _USE_CCACHE=true
6_WITH_NETWORKMANAGER=false
7# _WITH_NETWORKMANAGER=true
8_WITH_VALGRIND=false
9# _WITH_VALGRIND=true
10_TOOLKIT='gtk2'
11# _TOOLKIT='gtk3'
12
13_pkgname='claws-mail'
14case "${_TOOLKIT}" in
15 'gtk2')
16 _pkgvariant="${_TOOLKIT}"
17 _gitbranch="${_TOOLKIT}"
18 ;;
19 'gtk3')
20 _pkgvariant="protectedheaders"
21 _gitbranch='master'
22 ;;
23 *)
24 _pkgvariant="${_TOOLKIT}-protectedheaders"
25 _gitbranch="${_TOOLKIT}"
26 ;;
27esac
28
29pkgname="${_pkgname}-${_pkgvariant}-git"
30epoch=0
31pkgver=3.21.0+2.r11815.20240610.e6f6d119d
32pkgrel=2
33pkgdesc="A GTK based e-mail client. Latest git checkout, built against '${_TOOLKIT}'. Patched to use charset supersets to decode titles and to display protected headers."
34arch=(
35 'i686'
36 'x86_64'
37)
38license=('GPL3.0-or-later')
39url='https://www.claws-mail.org/'
40depends=(
41 'cairo'
42 'compface'
43 'dbus-glib'
44 'desktop-file-utils'
45 'enchant'
46 'gdk-pixbuf2'
47 'glib2'
48 'glibc'
49 'gnutls'
50 'gpgme'
51 "${_TOOLKIT}"
52 'hicolor-icon-theme'
53 'libice'
54 'libetpan'
55 'libsm'
56 'libldap'
57 'librsvg'
58 'nettle'
59 'pango'
60 'startup-notification'
61)
62makedepends=(
63 'git'
64 'python>=3'
65 'spamassassin'
66 # dependencies for plugins:
67 'bogofilter'
68 'dillo'
69 'gumbo-parser'
70 'libcanberra'
71 'libgdata'
72 'libical'
73 'libnotify'
74 'libytnef'
75 'poppler-glib'
76 'pygtk'
77 # dependencies to build the docs:
78 'docbook-utils'
79 'lynx'
80 'texlive-core'
81 'texlive-formatsextra'
82)
83optdepends=(
84 'claws-mail-theme-basicsvg: BasicSVG icon theme for Claws Mail.'
85 'claws-mail-tango-theme: Tango icon theme for Claws Mail.'
86 'papirus-claws-mail-theme: Papirus icon theme for Claws Mail.'
87 "claws-mail-plugin-reloader: Reload plugins from the 'tools' menu (for development)."
88 'bash: for some extra tools.'
89 'at-spi2-core: for many plugins.'
90 'bogofilter: for bogofilter plugin.'
91 'curl: for vcalendar, rssyl and spamreport plugins.'
92 'dbus: for notification plugin.'
93 'libx11: for notification plugin.'
94 'dillo: for dillo html viewer plugin.'
95 'expat: for rssyl plugin.'
96 'fontconfig: for litehtml_viewer plugin.'
97 'freetype2: for litehtml_viewer plugin.'
98 'gcc-libs: for litehtml_viewer plugin.'
99 'gumbo-parser: for litehtml_viewer plugin.'
100 'ghostscript: for pdf viewer plugin.'
101 'harfbuzz: for many plugins'
102 'jpilot: for jpilot (palm pilot connection) plugin.'
103 'libarchive: for archive plugin and various other plugins.'
104 'libcanberra: for notification plugin.'
105 'libgpg-error: for GPG and S-MIME plugins.'
106 'libical: for vcalendar plugin.'
107 'libnotify: for notification plugin.'
108 'libytnef: for tnef_parse plugin.'
109 'libxcrypt: for perl plugin.'
110 'perl: needed for some tools and perl plugin.'
111 'poppler-glib: for pdf viewer plugin.'
112 'python2: needed for some tools and python plugin.'
113 'python>=3: for some tools/ plugins.'
114 'spamassassin: for spamassassin plugin.'
115 'zlib: for many plugins.'
116 'json-glib: for gdata plugin.'
117 'libgdata: for gdata plugin.'
118 'libgoa: for gdata plugin.'
119 'libxml2: for gdata plugin.'
120 'libsoup: for gdata and fancy html viewer plugins.'
121)
122replaces=(
123 'claws-mail-extra-plugins'
124 'sylpheed-claws'
125)
126conflicts=(
127 'claws'
128 "${_pkgname}"
129 "${_pkgname}-${_pkgvariant}"
130 "${_pkgname}-bash-completion"
131 'claws-mail-extra-plugins'
132 'sylpheed-claws'
133)
134provides=(
135 "claws=${pkgver}"
136 "${_pkgname}=${pkgver}"
137 "${_pkgname}-${_TOOLKIT}=${pkgver}"
138 "${_pkgname}-title-superset=${pkgver}"
139 "${_pkgname}-protectedheaders=${pkgver}"
140 "${_pkgname}-bash-completion"
141 "claws-mail-extra-plugins=${pkgver}"
142)
143source=(
144 "${_pkgname}::git://git.claws-mail.org/claws.git#branch=${_gitbranch}"
145 "0001_encoding.diff::https://aur.archlinux.org/cgit/aur.git/plain/0001_encoding.diff?h=claws-mail-title-superset" ## NOTE!, if this gets removed, adapt the `provides` array and the `$pkgdesc`!
146 "0002_protectedheaders.patch::http://web.archive.org/web/20240721164745/https://www.thewildbeast.co.uk/claws-mail/bugzilla/attachment.cgi?id=2331" ## NOTE!, if this gets removed, adapt the `provides` array and the `$pkgdesc`!
147 "0002_protectedheaders.patch.AUTHORS.patch" # Fixes `0002_protectedheaders.patch` so that it applies to the changed `AUTHORS` file.
148)
149sha256sums=(
150 'SKIP'
151 '79e2b664d039f5cc0cf642359923e3d100ffc4ab070fc54c02d5792b624e26f6'
152 '383f4ea03102ed2c8f19365b9bf2b757969d1617fcfd0a8375126f388cc60301'
153 '1b505ea5396961e3c7fed5eb6478609644ba22324c3e4c03346aca017b095116'
154)
155if [ "${_TOOLKIT}" == "gtk2" ]; then
156 source+=("protectedheaders.patch.for-gtk2.patch")
157 sha256sums+=('3b1e568398950eb93d879353cfd6d49d81f7e1790c24972f36846f22ef4106cb')
158fi
159
160
161if "${_USE_CCACHE}"; then
162 makedepends+=('ccache')
163 options+=('ccache')
164fi
165if [ "${_TOOLKIT}" == "gtk2" ]; then
166 _fancy_config_opts=('--disable-fancy-plugin')
167else
168 makedepends+=('webkit2gtk')
169 optdepends+=('webkit2gtk: for fancy webkit html viewer plugin')
170 _fancy_config_opts=('--enable-fancy-plugin')
171fi
172if "${_WITH_NETWORKMANAGER}"; then
173 makedepends+=('networkmanager')
174 optdepends+=('networkmanager: for NetworkManager network connection query.')
175 _networkmanager_config_opts=('--enable-networkmanager')
176else
177 _networkmanager_config_opts=('--disable-networkmanager')
178fi
179if "${_WITH_VALGRIND}"; then
180 makedepends+=('valgrind')
181 _valgrind_config_opts=('--enable-valgrind')
182else
183 _valgrind_config_opts=('--disable-valgrind')
184fi
185
186
187prepare() {
188 cd "${srcdir}/${_pkgname}"
189
190 patch -N --follow-symlinks -i "${srcdir}/0002_protectedheaders.patch.AUTHORS.patch" "${srcdir}/0002_protectedheaders.patch"
191
192 if [ "${_TOOLKIT}" == "gtk2" ]; then
193 msg2 "Patching '0002_protectedheaders.patch' for GTK2 ..."
194 patch -N --follow-symlinks -i "${srcdir}/protectedheaders.patch.for-gtk2.patch" -o "${srcdir}/0002_protectedheaders-${_TOOLKIT}.patch" "${srcdir}/0002_protectedheaders.patch"
195 else
196 cp "${srcdir}/0002_protectedheaders.patch" "${srcdir}/0002_protectedheaders-${_TOOLKIT}.patch"
197 fi
198
199 for _patch in "${srcdir}/0001_encoding.diff" "${srcdir}/0002_protectedheaders-${_TOOLKIT}.patch"; do
200 msg2 "Applying patch '${_patch}' ..."
201 patch -N -p1 --follow-symlinks -i "${_patch}"
202 done
203
204 msg2 "Generating git log ..."
205 git log > "${srcdir}/git.log"
206
207 # Generate ./configure
208 # if [ ! -e configure ]; then
209 msg2 "Generating './configure' ..."
210 NOCONFIGURE=1 ./autogen.sh
211 # fi
212}
213
214pkgver() {
215 cd "${srcdir}/${_pkgname}"
216
217 _ver="$(git describe --tags | sed -E -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
218 _rev="$(git rev-list --count HEAD)"
219 _date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
220 _hash="$(git rev-parse --short HEAD)"
221
222 if [ -z "${_ver}" ]; then
223 error "Could not determine version."
224 return 1
225 else
226 printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
227 fi
228}
229
230build() {
231 cd "${srcdir}/${_pkgname}"
232
233 _configure_opts=(
234 --prefix=/usr
235 --disable-static
236 --enable-shared
237 --enable-nls
238 --enable-manual
239 --enable-libsm
240 --enable-ipv6
241 --enable-gnutls
242 --enable-enchant
243 --enable-crash-dialog
244 --disable-generic-umpc
245 --enable-compface
246 --enable-pthread
247 --enable-startup-notification
248 --enable-dbus
249 --enable-ldap
250 --enable-jpilot
251 "${_networkmanager_config_opts[@]}"
252 --enable-libetpan
253 "${_valgrind_config_opts[@]}"
254 --disable-alternate-addressbook # add --enable-alternate-addressbook to the options to use the new/alternate address book (which could break things!). Do not forget to add claws-contacts to the dependencies then
255 --enable-svg
256 --enable-deprecated
257 --enable-acpi_notifier-plugin
258 --enable-address_keeper-plugin
259 --enable-archive-plugin
260 --enable-att_remover-plugin
261 --enable-attachwarner-plugin
262 --enable-bogofilter-plugin
263 --enable-bsfilter-plugin
264 --enable-clamd-plugin
265 --enable-dillo-plugin
266 "${_fancy_config_opts[@]}"
267 --enable-fetchinfo-plugin
268 --enable-gdata-plugin
269 --enable-libravatar-plugin
270 --enable-litehtml_viewer-plugin
271 --enable-mailmbox-plugin
272 --enable-managesieve-plugin
273 --enable-newmail-plugin
274 --enable-notification-plugin
275 --enable-pdf_viewer-plugin
276 --enable-perl-plugin
277 --enable-python-plugin
278 --enable-pgpcore-plugin
279 --enable-pgpmime-plugin
280 --enable-pgpinline-plugin
281 --enable-rssyl-plugin
282 --enable-smime-plugin
283 --enable-spamassassin-plugin
284 --enable-spam_report-plugin
285 --enable-tnef_parse-plugin
286 --enable-vcalendar-plugin
287 --enable-demo-plugin
288 )
289
290 msg2 "Running './configure <options>' ..."
291 ./configure "${_configure_opts[@]}"
292 msg2 "Running 'make' ..."
293 make
294
295 # build extra tools
296 pushd tools 2>/dev/null
297 msg2 "Running 'make' in './tools/' ..."
298 make
299 popd 2>/dev/null
300}
301
302package() {
303 cd "${srcdir}/${_pkgname}"
304
305 msg2 "Runnung 'make install' ..."
306 make DESTDIR="${pkgdir}" install
307
308 # install extra tools
309 msg2 "Installing extra tools ..."
310 # all executables and .conf files; only top directory
311 pushd tools 2>/dev/null
312 for _file in *.pl *.sh *.py tb2claws-mail update-po uudec uuooffice; do
313 install -D -v -m755 "${_file}" "${pkgdir}/usr/lib/${_pkgname}/tools/${_file}"
314 done
315 for _file in *.txt *.conf README; do
316 install -D -v -m644 "${_file}" "${pkgdir}/usr/lib/${_pkgname}/tools/${_file}"
317 done
318 for _dir in kdeservicemenu; do
319 cp -arv "${_file}" "${pkgdir}/usr/lib/${_pkgname}"/tools/
320 done
321 popd 2>/dev/null
322
323 # Install more information
324 msg2 "Installing extra documentation and license ..."
325 for _docfile in ABOUT-NLS AUTHORS ChangeLog* INSTALL NEWS README RELEASE_NOTES version; do
326 install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/${_docfile}"
327 done
328 install -D -v -m644 "${srcdir}/git.log" "${pkgdir}/usr/share/doc/${_pkgname}/git.log"
329 ln -svr "${pkgdir}/usr/lib/${_pkgname}/tools/README" "${pkgdir}/usr/share/doc/${_pkgname}/README-tools"
330 ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/COPYING" "${pkgdir}/usr/share/doc/${_pkgname}/COPYING"
331 install -D -v -m644 'COPYING' "${pkgdir}/usr/share/licenses/${pkgname}/COPYING"
332
333 # Install bash completion
334 msg2 "Installing bash completion ..."
335 install -D -v -m644 "tools/bash_completion/claws-mail" "${pkgdir}/usr/share/bash-completion/completions/${_pkgname}"
336}
337

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion