claws-mail-protectedheaders-git

LOW
maintainer dreieck 1 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package builds Claws Mail from its official git repository and applies a well-documented patch from the AUR, which is normal for AUR packages; the non-whitelisted host is the AUR itself, hosting a benign patch file, not an executable or malicious payload.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds Claws Mail from its official git repository and applies a well-documented patch from the AUR, which is normal for AUR packages; the non-whitelisted host is the AUR itself, hosting a benign patch file, not an executable or malicious payload.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:157 "${_pkgname}::git://git.claws-mail.org/claws.git#branch=${_gitbranch}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: dreieck (https://aur.archlinux.org/account/dreieck)
2# Contributor: Christian Hesse
3
4_USE_CCACHE=false
5if which ccache > /dev/null 2>&1; then
6 _USE_CCACHE=true
7fi
8_WITH_NETWORKMANAGER=false
9# _WITH_NETWORKMANAGER=true
10# _WITH_VALGRIND=false
11_WITH_VALGRIND=true
12# _TOOLKIT='gtk2'
13_TOOLKIT='gtk3'
14# _PROTECTEDHEADERSPATCHVARIANT=nopicturesplease # Use the patch from https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4426#c39, or a newer one sent e.g. manually via email.
15# _PROTECTEDHEADERSPATCHVARIANT=filippo # Use the patch from https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4007#c4.
16_PROTECTEDHEADERSPATCHVARIANT=none # Do not patch any protectedheaders patch. Used for debugging and workaround.
17
18_pkgname='claws-mail'
19case "${_TOOLKIT}" in
20 'gtk2')
21 _pkgvariant="${_TOOLKIT}"
22 _gitbranch="${_TOOLKIT}"
23 ;;
24 'gtk3')
25 _pkgvariant="protectedheaders"
26 _gitbranch='master'
27 ;;
28 *)
29 _pkgvariant="${_TOOLKIT}-protectedheaders"
30 _gitbranch="${_TOOLKIT}"
31 ;;
32esac
33
34pkgname="${_pkgname}-${_pkgvariant}-git"
35epoch=0
36pkgver=4.4.0+57.r13774.20260905.63a4906dd
37pkgrel=1
38pkgdesc="A GTK based e-mail client. Latest git checkout, built against '${_TOOLKIT}'. Patched to use charset supersets to decode titles and to display protected headers."
39arch=(
40 'i686'
41 'x86_64'
42)
43license=('GPL-3.0-or-later')
44url='https://www.claws-mail.org/'
45depends=(
46 'cairo'
47 'compface'
48 'dbus-glib'
49 'enchant'
50 'gdk-pixbuf2'
51 'glib2'
52 'glibc'
53 'gnutls'
54 'gpgme'
55 "${_TOOLKIT}"
56 'hicolor-icon-theme'
57 'libice'
58 'libetpan'
59 'libsm'
60 'libldap'
61 'librsvg'
62 'nettle'
63 'pango'
64 'startup-notification'
65)
66makedepends=(
67 'ayatana-ido'
68 'git'
69 'glib2-devel'
70 'python>=3'
71 'spamassassin'
72 # dependencies for plugins:
73 'bogofilter'
74 'dillo'
75 'gumbo-parser>=0.12'
76 'libayatana-appindicator'
77 'libcanberra'
78 'libdbusmenu-glib'
79 'libgdata'
80 'libgoa'
81 'libical'
82 'libnotify'
83 'libxml2'
84 'libytnef'
85 'poppler-glib'
86 # 'pygtk' # This requires python2 stuff to build. Most probably obsolete as (make) dependency.
87 # dependencies to build the docs:
88 'docbook-utils'
89 'lynx'
90 'texlive-bin'
91 'texlive-core'
92 'texlive-formatsextra'
93)
94optdepends=(
95 'claws-mail-theme-basicsvg: BasicSVG icon theme for Claws Mail.'
96 'claws-mail-tango-theme: Tango icon theme for Claws Mail.'
97 'papirus-claws-mail-theme: Papirus icon theme for Claws Mail.'
98 "claws-mail-plugin-reloader: Reload plugins from the 'tools' menu (for development)."
99 'bash: for some extra tools.'
100 'at-spi2-core: for many plugins.'
101 'bogofilter: for bogofilter plugin.'
102 'curl: for vcalendar, rssyl and spamreport plugins.'
103 'dbus: for notification plugin.'
104 'libx11: for notification plugin.'
105 'dillo: for dillo html viewer plugin.'
106 'expat: for rssyl plugin.'
107 'fontconfig: for litehtml_viewer plugin.'
108 'freetype2: for litehtml_viewer plugin.'
109 'gcc-libs: for litehtml_viewer plugin.'
110 'gumbo-parser>=0.12: for litehtml_viewer plugin.'
111 'ghostscript: for pdf viewer plugin.'
112 'harfbuzz: for many plugins'
113 'jpilot: for jpilot (palm pilot connection) plugin.'
114 'libarchive: for archive plugin and various other plugins.'
115 'ayatana-ido: for notification plugin.'
116 'libcanberra: for notification plugin.'
117 'libdbusmenu-glib: for notification plugin.'
118 'libayatana-appindicator: for notification plugon.'
119 'libgpg-error: for GPG and S-MIME plugins.'
120 'libical: for vcalendar plugin.'
121 'libnotify: for notification plugin.'
122 'libytnef: for tnef_parse plugin.'
123 'libxcrypt: for perl plugin.'
124 'perl: needed for some tools and perl plugin.'
125 'poppler-glib: for pdf viewer plugin.'
126 'python2: needed for some tools and python plugin.'
127 'python>=3: for some tools/ plugins.'
128 'spamassassin: for spamassassin plugin.'
129 'zlib: for many plugins.'
130 'json-glib: for gdata plugin.'
131 'libgdata: for gdata plugin.'
132 'libgoa: for gdata plugin.'
133 'libxml2: for gdata plugin.'
134)
135replaces=(
136 'claws-mail-extra-plugins'
137 'sylpheed-claws'
138)
139conflicts=(
140 'claws'
141 "${_pkgname}"
142 "${_pkgname}-${_pkgvariant}"
143 "${_pkgname}-bash-completion"
144 'claws-mail-extra-plugins'
145 'sylpheed-claws'
146)
147provides=(
148 "claws=${pkgver}"
149 "${_pkgname}=${pkgver}"
150 "${_pkgname}-${_TOOLKIT}=${pkgver}"
151 "${_pkgname}-title-superset=${pkgver}"
152 "${_pkgname}-protectedheaders=${pkgver}"
153 "${_pkgname}-bash-completion"
154 "claws-mail-extra-plugins=${pkgver}"
155)
156source=(
157 "${_pkgname}::git://git.claws-mail.org/claws.git#branch=${_gitbranch}"
158 "0000_encoding.diff::https://aur.archlinux.org/cgit/aur.git/plain/0001_encoding.diff?h=claws-mail-title-superset" ## NOTE!, if this gets removed, adapt the `provides` array and the `$pkgdesc`!
159)
160sha256sums=(
161 'SKIP' # Main upstream git source
162 '79e2b664d039f5cc0cf642359923e3d100ffc4ab070fc54c02d5792b624e26f6' # '0000_encoding.diff'
163)
164case "${_PROTECTEDHEADERSPATCHVARIANT}" in
165 'nopicturesplease')
166 #source+=("0002_protectedheaders.patch::http://web.archive.org/web/20240721164745/https://www.thewildbeast.co.uk/claws-mail/bugzilla/attachment.cgi?id=2331")
167 #sha256sums+=('383f4ea03102ed2c8f19365b9bf2b757969d1617fcfd0a8375126f388cc60301')
168 #source+=('protected-headers.nopicturesplease.2026-01-21.6500e351c6889502e15a0b7365dba516142c9d65.patch')
169 source+=('protected-headers.nopicturesplease.2026-02-06.450a0ac32ea2c7f621ee21a86d8d53d3766efc14.patch')
170 sha256sums+=('f802afc82887fc0601f819cb05196ed9cc2dae08e9d482d9a0456ed79a1230b4')
171 if [ "${_TOOLKIT}" == "gtk2" ]; then
172 source+=("protectedheaders.patch.for-gtk2.patch")
173 sha256sums+=('3b1e568398950eb93d879353cfd6d49d81f7e1790c24972f36846f22ef4106cb')
174 fi
175 ;;
176 'filippo')
177 source+=("read_enc_subject.tar.gz::http://web.archive.org/web/20240721164805/https://www.thewildbeast.co.uk/claws-mail/bugzilla/attachment.cgi?id=2350")
178 sha256sums+=('70b2595830dce73d85600190258389216b4aa613f88ebbedc6088a806c7b01f1')
179 ;;
180 'none')
181 true
182 ;;
183 *)
184 error "Please edit the 'PKGBUILD' to specify a valid provider of the protected headers patch (variable '_PROTECTEDHEADERSPATCHVARIANT' at the beginning of the 'PKGBUILD')."
185 exit 1
186 ;;
187esac
188
189
190if "${_USE_CCACHE}"; then
191 makedepends+=('ccache')
192 options+=('ccache')
193fi
194if [ "${_TOOLKIT}" == "gtk2" ]; then
195 _fancy_config_opts=('--disable-fancy-plugin')
196else
197 makedepends+=(
198 'libsoup3'
199 'webkit2gtk-4.1'
200 )
201 optdepends+=(
202 'libjavascriptcoregtk-4.1.so: for fancy webkit html viewer plugin.'
203 'libwebkit2gtk-4.1.so: for fancy webkit html viewer plugin.'
204 'libsoup3: for fancy webkit html viewer plugin.'
205 )
206 _fancy_config_opts=('--enable-fancy-plugin')
207fi
208if "${_WITH_NETWORKMANAGER}"; then
209 makedepends+=('networkmanager')
210 optdepends+=('networkmanager: for NetworkManager network connection query.')
211 _networkmanager_config_opts=('--enable-networkmanager')
212else
213 _networkmanager_config_opts=('--disable-networkmanager')
214fi
215if "${_WITH_VALGRIND}"; then
216 makedepends+=('valgrind')
217 _valgrind_config_opts=('--enable-valgrind')
218else
219 _valgrind_config_opts=('--disable-valgrind')
220fi
221
222
223prepare() {
224 cd "${srcdir}/${_pkgname}"
225
226 #for _patch in "${srcdir}/....patch"; do
227 # printf '%s\n' " > Applying patch '$(basename "${_patch}")' ..."
228 # patch -Np1 --follow-symlinks -i "${_patch}"
229 #done
230 rm -fv po/Makefile.in.in
231
232 for _patch in "${srcdir}/0000_encoding.diff"; do
233 printf '%s\n' " > Applying patch '${_patch}' ..."
234 patch -N -p1 --follow-symlinks -i "${_patch}"
235 done
236
237 case "${_PROTECTEDHEADERSPATCHVARIANT}" in
238 'nopicturesplease')
239 cp "${srcdir}/protected-headers.nopicturesplease.2026-02-06.450a0ac32ea2c7f621ee21a86d8d53d3766efc14.patch" "${srcdir}/0002_protectedheaders.patch"
240 if [ "${_TOOLKIT}" == "gtk2" ]; then
241 printf '%s\n' " > Patching '0002_protectedheaders.patch' for GTK2 ..."
242 patch -N --follow-symlinks -i "${srcdir}/protectedheaders.patch.for-gtk2.patch" -o "${srcdir}/0002_protectedheaders-${_TOOLKIT}.patch" "${srcdir}/0002_protectedheaders.patch"
243 else
244 cp "${srcdir}/0002_protectedheaders.patch" "${srcdir}/0002_protectedheaders-${_TOOLKIT}.patch"
245 fi
246 for _patch in "${srcdir}/0002_protectedheaders-${_TOOLKIT}.patch"; do
247 printf '%s\n' " > Applying patch '${_patch}' ..."
248 patch -N -p1 --follow-symlinks -i "${_patch}"
249 done
250 ;;
251 'filippo')
252 for _patch in "${srcdir}"/{0001-PGP-MIME-fix-leak-of-MimeInfo-if-parsing-fails,0002-Substitute-Subject-header-when-decrypting,0003-TextView-move-header-extraction-to-textview_process_,0004-PGPMime-return-full-decrypted-message-instead-of-fir}.patch; do
253 printf '%s\n' " > Applying patch '${_patch}' ..."
254 patch -N -p1 --follow-symlinks -i "${_patch}"
255 done
256 ;;
257 'none')
258 printf '%s\n' " > Not applying any protectedheaders patch, since in the 'PKGBUILD' variable '_PROTECTEDHEADERSPATCHVARIANT' is set to '${_PROTECTEDHEADERSPATCHVARIANT}'."
259 ;;
260 *)
261 error "Please edit the 'PKGBUILD' to specify a valid provider of the protected headers patch (variable '_PROTECTEDHEADERSPATCHVARIANT' at the beginning of the 'PKGBUILD')."
262 return 1
263 ;;
264 esac
265
266 printf '%s\n' " > Generating git log ..."
267 git log > "${srcdir}/git.log"
268
269 # Generate ./configure
270 # if [ ! -e configure ]; then
271 printf '%s\n' " > Generating './configure' ..."
272 NOCONFIGURE=1 ./autogen.sh
273 # fi
274}
275
276pkgver() {
277 cd "${srcdir}/${_pkgname}"
278
279 _ver="$(git describe --tags | sed -E -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
280 _rev="$(git rev-list --count HEAD)"
281 _date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
282 _hash="$(git rev-parse --short HEAD)"
283
284 if [ -z "${_ver}" ]; then
285 error "Could not determine version."
286 return 1
287 else
288 printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
289 fi
290}
291
292build() {
293 cd "${srcdir}/${_pkgname}"
294
295 ## Silence some compiler warnings (and, just to be sure, do not treat them as errors as well):
296 local _NOWARNINGS _NOWARNINGS_CConly _NOWARNINGS_CXXonly _warning _CFLAGSADDITIONS _CFLAGSADDITIONS_CConly _CFLAGSADDITIONS_CXXonly
297 _NOWARNINGS=('deprecated-declarations' 'unused-result' 'lto-type-mismatch' 'discarded-qualifiers' 'attribute-warning')
298 _NOWARNINGS_CConly=('implicit-function-declaration')
299 _NOWARNINGS_CXXonly=()
300 _CFLAGSADDITIONS=''
301 _CFLAGSADDITIONS_CConly=''
302 _CFLAGSADDITIONS_CXXonly=''
303 for _warning in "${_NOWARNINGS_CConly[@]}"; do
304 _CFLAGSADDITIONS_CConly+=" -Wno-${_warning} -Wno-error=${_warning}"
305 done
306 for _warning in "${_NOWARNINGS_CXXonly[@]}"; do
307 _CFLAGSADDITIONS_CXXonly+=" -Wno-${_warning} -Wno-error=${_warning}"
308 done
309 for _warning in "${_NOWARNINGS[@]}"; do
310 _CFLAGSADDITIONS+=" -Wno-${_warning} -Wno-error=${_warning}"
311 done
312 CFLAGS+="${_CFLAGSADDITIONS} ${_CFLAGSADDITIONS_CConly}"
313 CXXFLAGS+="${_CFLAGSADDITIONS} ${_CFLAGSADDITIONS_CXXonly}"
314 export CFLAGS
315 export CXXFLAGS
316
317 #MAKEFLAGS+=' -j1'
318 #export MAKEFLAGS
319
320 local _configure_opts
321 _configure_opts=(
322 --prefix=/usr
323 --disable-static
324 --enable-shared
325 --enable-nls
326 --enable-manual
327 --enable-libsm
328 --enable-ipv6
329 --enable-gnutls
330 --enable-enchant
331 --enable-crash-dialog
332 --disable-generic-umpc
333 --enable-compface
334 --enable-pthread
335 --enable-startup-notification
336 --enable-dbus
337 --enable-ldap
338 --enable-jpilot
339 "${_networkmanager_config_opts[@]}"
340 --enable-libetpan
341 "${_valgrind_config_opts[@]}"
342 --disable-alternate-addressbook # add --enable-alternate-addressbook to the options to use the new/alternate address book (which could break things!). Do not forget to add claws-contacts to the dependencies then
343 --enable-svg
344 --enable-deprecated
345 --enable-acpi_notifier-plugin
346 --enable-address_keeper-plugin
347 --enable-archive-plugin
348 --enable-att_remover-plugin
349 --enable-attachwarner-plugin
350 --enable-bogofilter-plugin
351 --enable-bsfilter-plugin
352 --enable-clamd-plugin
353 --enable-dillo-plugin
354 "${_fancy_config_opts[@]}"
355 --enable-fetchinfo-plugin
356 --enable-gdata-plugin
357 --enable-libravatar-plugin
358 --enable-litehtml_viewer-plugin
359 --enable-mailmbox-plugin
360 --enable-managesieve-plugin
361 --enable-newmail-plugin
362 --enable-notification-plugin
363 --enable-pdf_viewer-plugin
364 --enable-perl-plugin
365 --enable-python-plugin
366 --enable-pgpcore-plugin
367 --enable-pgpmime-plugin
368 --enable-pgpinline-plugin
369 --enable-rssyl-plugin
370 --enable-smime-plugin
371 --enable-spamassassin-plugin
372 --enable-spam_report-plugin
373 --enable-tnef_parse-plugin
374 --enable-vcalendar-plugin
375 --enable-demo-plugin
376 )
377
378 printf '%s\n' " > Running './configure <options>' ..."
379 ./configure "${_configure_opts[@]}"
380 printf '%s\n' " > Running 'make' ..."
381 make
382
383 # build extra tools
384 pushd tools 2>/dev/null
385 printf '%s\n' " > Running 'make' in './tools/' ..."
386 make
387 popd 2>/dev/null
388}
389
390package() {
391 cd "${srcdir}/${_pkgname}"
392
393 printf '%s\n' " > Runnung 'make install' ..."
394 make DESTDIR="${pkgdir}" install
395
396 # install extra tools
397 printf '%s\n' " > Installing extra tools ..."
398 # all executables and .conf files; only top directory
399 pushd tools 2>/dev/null
400 for _file in *.pl *.sh *.py tb2claws-mail update-po uudec uuooffice; do
401 install -D -v -m755 "${_file}" "${pkgdir}/usr/lib/${_pkgname}/tools/${_file}"
402 done
403 for _file in *.txt *.conf README; do
404 install -D -v -m644 "${_file}" "${pkgdir}/usr/lib/${_pkgname}/tools/${_file}"
405 done
406 for _dir in kdeservicemenu; do
407 cp -arv "${_file}" "${pkgdir}/usr/lib/${_pkgname}"/tools/
408 done
409 popd 2>/dev/null
410
411 # Install more information
412 printf '%s\n' " > Installing extra documentation and license ..."
413 for _docfile in ABOUT-NLS AUTHORS ChangeLog* INSTALL NEWS README RELEASE_NOTES version; do
414 install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/${_docfile}"
415 done
416 install -D -v -m644 "${srcdir}/git.log" "${pkgdir}/usr/share/doc/${_pkgname}/git.log"
417 ln -svr "${pkgdir}/usr/lib/${_pkgname}/tools/README" "${pkgdir}/usr/share/doc/${_pkgname}/README-tools"
418 ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/COPYING" "${pkgdir}/usr/share/doc/${_pkgname}/COPYING"
419 install -D -v -m644 'COPYING' "${pkgdir}/usr/share/licenses/${pkgname}/COPYING"
420
421 # Install bash completion
422 printf '%s\n' " > Installing bash completion ..."
423 install -D -v -m644 "tools/bash_completion/claws-mail" "${pkgdir}/usr/share/bash-completion/completions/${_pkgname}"
424}
425

Changes since previous scan

--- PKGBUILD @ 2026-09-05 00:16
+++ PKGBUILD @ 2026-09-17 00:27
@@ -11,8 +11,9 @@
_WITH_VALGRIND=true
# _TOOLKIT='gtk2'
_TOOLKIT='gtk3'
-_PROTECTEDHEADERSPATCHVARIANT=nopicturesplease # Use the patch from https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4426#c39, or a newer one sent e.g. manually via email.
+# _PROTECTEDHEADERSPATCHVARIANT=nopicturesplease # Use the patch from https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4426#c39, or a newer one sent e.g. manually via email.
# _PROTECTEDHEADERSPATCHVARIANT=filippo # Use the patch from https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4007#c4.
+_PROTECTEDHEADERSPATCHVARIANT=none # Do not patch any protectedheaders patch. Used for debugging and workaround.
_pkgname='claws-mail'
case "${_TOOLKIT}" in
@@ -32,7 +33,7 @@
pkgname="${_pkgname}-${_pkgvariant}-git"
epoch=0
-pkgver=4.3.1+206.r13691.20260203.450a0ac32
+pkgver=4.4.0+57.r13774.20260905.63a4906dd
pkgrel=1
pkgdesc="A GTK based e-mail client. Latest git checkout, built against '${_TOOLKIT}'. Patched to use charset supersets to decode titles and to display protected headers."
arch=(
@@ -176,6 +177,9 @@
source+=("read_enc_subject.tar.gz::http://web.archive.org/web/20240721164805/https://www.thewildbeast.co.uk/claws-mail/bugzilla/attachment.cgi?id=2350")
sha256sums+=('70b2595830dce73d85600190258389216b4aa613f88ebbedc6088a806c7b01f1')
;;
+ 'none')
+ true
+ ;;
*)
error "Please edit the 'PKGBUILD' to specify a valid provider of the protected headers patch (variable '_PROTECTEDHEADERSPATCHVARIANT' at the beginning of the 'PKGBUILD')."
exit 1
@@ -249,6 +253,9 @@
printf '%s\n' " > Applying patch '${_patch}' ..."
patch -N -p1 --follow-symlinks -i "${_patch}"
done
+ ;;
+ 'none')
+ printf '%s\n' " > Not applying any protectedheaders patch, since in the 'PKGBUILD' variable '_PROTECTEDHEADERSPATCHVARIANT' is set to '${_PROTECTEDHEADERSPATCHVARIANT}'."
;;
*)
error "Please edit the 'PKGBUILD' to specify a valid provider of the protected headers patch (variable '_PROTECTEDHEADERSPATCHVARIANT' at the beginning of the 'PKGBUILD')."

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 16:00:23 Medium 1
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion