cryptomator

LOW

maintainer ajgraves 83 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads source code and build dependencies from official project and vendor domains (github.com, download2.gluonhq.com), which are plausibly legitimate; the non-whitelisted host is a standard release endpoint for OpenJFX, and all downloaded components are used to build the application locally, not executed directly.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and build dependencies from official project and vendor domains (github.com, download2.gluonhq.com), which are plausibly legitimate; the non-whitelisted host is a standard release endpoint for OpenJFX, and all downloaded components are used to build the application locally, not executed directly.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-x64_bin-jmods.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aaron Graves <linux@ajgraves.com>
    
      2# Contributor: Julian Raufelder <arch@raufelder.com>
    
      3# Contributor: Morten Linderud <morten@linderud.pw>
    
      4# Contributor: Sebastian Stenzel <sebastian.stenzel@gmail.com>
    
      5# Contributor: Armin Schrenk <armin.schrenk@skymatic.de>
    
      6
    
      7pkgname=cryptomator
    
      8pkgver=1.19.5
    
      9pkgrel=1
    
      10pkgdesc="Multiplatform transparent client-side encryption of your files in the cloud."
    
      11arch=('any')
    
      12url="https://cryptomator.org/"
    
      13license=('GPL3')
    
      14depends=('fuse3' 'alsa-lib' 'hicolor-icon-theme' 'libxtst' 'libnet' 'libxrender')
    
      15makedepends=('maven' 'unzip')
    
      16optdepends=('keepassxc-cryptomator: Use KeePassXC to store vault passwords' 'ttf-hanazono: Install this font when using Japanese system language')
    
      17_jdkver=26.0.1+8
    
      18_jfxver=25.0.5
    
      19_src_app_dir=cryptomator-${pkgver//_/-}
    
      20source=("cryptomator-${pkgver//_/-}.tar.gz::https://github.com/cryptomator/cryptomator/archive/refs/tags/${pkgver//_/-}.tar.gz"
    
      21        "cryptomator-${pkgver//_/-}.tar.gz.asc::https://github.com/cryptomator/cryptomator/releases/download/${pkgver//_/-}/cryptomator-${pkgver//_/-}.tar.gz.asc");
    
      22source_x86_64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_x64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
    
      23               "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-x64_bin-jmods.zip")
    
      24source_aarch64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_aarch64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
    
      25                "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-aarch64_bin-jmods.zip")
    
      26noextract=("jdk-${_jdkver}.tar.gz" "openjfx-${_jfxver}.zip")
    
      27sha256sums=('7c82afc1ed4710195245d0db50bde7952e64fa9250fa4a0ccbfd6d9727e9c5b4'
    
      28            'SKIP')
    
      29sha256sums_x86_64=('8e512f13e575a43655fc92319436c94890c137b9035cc6bd6f9cf24239704d3a'
    
      30                   'fbb768a16c23a453c420ba55bbc2a689c708bc6456ef77c1e4f69823b95f9e9f')
    
      31sha256sums_aarch64=('613f9b2861dea937b24d5eca745ef8567733b377d0bb612195acaad0e3f61360'
    
      32                    'c85722f3f26059e1bbe689bb8ada4434dfaf68fa9fc8e64bac6a95da1828de01')
    
      33options=('!strip')
    
      34
    
      35validpgpkeys=('58117AFA1F85B3EEC154677D615D449FE6E6A235')
    
      36
    
      37build() {
    
      38  export JAVA_HOME="${srcdir}/jdk-${_jdkver}"
    
      39  JMODS_PATH="${srcdir}/openjfx-${_jfxver}-jmods"
    
      40  #JEP 493
    
      41  if ! $(${JAVA_HOME}/bin/jlink --help | grep -q "Linking from run-time image enabled"); then
    
      42      JMODS_PATH="${JMODS_PATH}:${JAVA_HOME}/jmods:"
    
      43  fi
    
      44
    
      45  tar xfz "jdk-${_jdkver}.tar.gz"
    
      46
    
      47  mkdir "openjfx-${_jfxver}-jmods"
    
      48  unzip -j "openjfx-${_jfxver}.zip" \*/javafx.base.jmod \*/javafx.controls.jmod \*/javafx.fxml.jmod \*/javafx.graphics.jmod -d "openjfx-${_jfxver}-jmods"
    
      49
    
      50  cd "${srcdir}/${_src_app_dir}"
    
      51
    
      52  mvn -B clean package -DskipTests
    
      53
    
      54  cp LICENSE.txt target
    
      55  cp target/cryptomator-*.jar target/mods
    
      56
    
      57  cd target
    
      58
    
      59  "$JAVA_HOME/bin/jlink" \
    
      60    --output runtime \
    
      61    --module-path "$JMODS_PATH" \
    
      62    --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.security.auth,jdk.accessibility,jdk.management.jfr,jdk.net,java.compiler \
    
      63    --strip-native-commands \
    
      64    --no-header-files \
    
      65    --no-man-pages \
    
      66    --strip-debug \
    
      67    --compress=zip-0
    
      68
    
      69  "$JAVA_HOME/bin/java" ../dist/common/RemoveDistrustedCaCerts.java runtime/lib/security/cacerts
    
      70
    
      71  ##Note: jpackage does not allow -beta suffixes, have to strip those
    
      72  "$JAVA_HOME/bin/jpackage" \
    
      73    --type app-image \
    
      74    --runtime-image runtime \
    
      75    --input libs \
    
      76    --module-path mods \
    
      77    --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator \
    
      78    --dest . \
    
      79    --name cryptomator \
    
      80    --vendor "Skymatic GmbH" \
    
      81    --copyright "(C) 2016 - 2026 Skymatic GmbH" \
    
      82    --java-options "--enable-preview" \
    
      83    --java-options '--enable-native-access=javafx.graphics,org.cryptomator.frontend.fuse,org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator' \
    
      84    --java-options "-Xss5m" \
    
      85    --java-options "-Xmx256m" \
    
      86    --java-options "-Dfile.encoding=\"utf-8\"" \
    
      87    --java-options "-Djava.net.useSystemProxies=true" \
    
      88    --java-options "-Dcryptomator.adminConfigPath=\"/etc/cryptomator/config.properties\"" \
    
      89    --java-options "-Dcryptomator.appVersion=\"${pkgver//_/-}\"" \
    
      90    --java-options "-Dcryptomator.buildNumber=\"aur-${pkgrel}\"" \
    
      91    --java-options "-Dcryptomator.disableUpdateCheck=true" \
    
      92    --java-options "-Dcryptomator.integrationsLinux.autoStartCmd=\"cryptomator\"" \
    
      93    --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/.config/Cryptomator/ipc.socket\"" \
    
      94    --java-options "-Dcryptomator.logDir=\"@{userhome}/.local/share/Cryptomator/logs\"" \
    
      95    --java-options "-Dcryptomator.mountPointsDir=\"@{userhome}/.local/share/Cryptomator/mnt\"" \
    
      96    --java-options "-Dcryptomator.networking.truststore.p12Path=\"/etc/cryptomator/certs.p12\"" \
    
      97    --java-options "-Dcryptomator.pluginDir=\"@{userhome}/.local/share/Cryptomator/plugins\"" \
    
      98    --java-options "-Dcryptomator.p12Path=\"@{userhome}/.config/Cryptomator/key.p12\"" \
    
      99    --java-options "-Dcryptomator.settingsPath=\"@{userhome}/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json\"" \
    
      100    --java-options "-Dcryptomator.showTrayIcon=true" \
    
      101    --java-options "-Dcryptomator.hub.enableTrustOnFirstUse=true" \
    
      102    --app-version "${pkgver//_*/}" \
    
      103    --verbose
    
      104}
    
      105
    
      106package() {
    
      107  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/application-vnd.cryptomator.vault.xml" "${pkgdir}/usr/share/mime/packages/cryptomator-vault.xml"
    
      108  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.desktop" "${pkgdir}/usr/share/applications/org.cryptomator.Cryptomator.desktop"
    
      109  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/org.cryptomator.Cryptomator.png"
    
      110  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator512.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/org.cryptomator.Cryptomator.png"
    
      111  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg"
    
      112  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.tray.svg"
    
      113  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray-unlocked.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.tray-unlocked.svg"
    
      114  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray.svg" "${pkgdir}/usr/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-symbolic.svg"
    
      115  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray-unlocked.svg" "${pkgdir}/usr/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-unlocked-symbolic.svg"
    
      116
    
      117  mkdir -p "${pkgdir}/opt/cryptomator/"
    
      118  cp -R "${srcdir}/${_src_app_dir}/target/cryptomator" "${pkgdir}/opt/"
    
      119  install -Dm644 "${srcdir}/${_src_app_dir}/target/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      120
    
      121  mkdir -p "${pkgdir}/usr/bin"
    
      122  ln -s "/opt/cryptomator/bin/cryptomator" "${pkgdir}/usr/bin/cryptomator"
    
      123}
    
      124

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -5,7 +5,7 @@
 # Contributor: Armin Schrenk <armin.schrenk@skymatic.de>
 
 pkgname=cryptomator
-pkgver=1.19.4
+pkgver=1.19.5
 pkgrel=1
 pkgdesc="Multiplatform transparent client-side encryption of your files in the cloud."
 arch=('any')
@@ -15,7 +15,7 @@
 makedepends=('maven' 'unzip')
 optdepends=('keepassxc-cryptomator: Use KeePassXC to store vault passwords' 'ttf-hanazono: Install this font when using Japanese system language')
 _jdkver=26.0.1+8
-_jfxver=25.0.3
+_jfxver=25.0.5
 _src_app_dir=cryptomator-${pkgver//_/-}
 source=("cryptomator-${pkgver//_/-}.tar.gz::https://github.com/cryptomator/cryptomator/archive/refs/tags/${pkgver//_/-}.tar.gz"
         "cryptomator-${pkgver//_/-}.tar.gz.asc::https://github.com/cryptomator/cryptomator/releases/download/${pkgver//_/-}/cryptomator-${pkgver//_/-}.tar.gz.asc");
@@ -24,12 +24,12 @@
 source_aarch64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_aarch64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
                 "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-aarch64_bin-jmods.zip")
 noextract=("jdk-${_jdkver}.tar.gz" "openjfx-${_jfxver}.zip")
-sha256sums=('57cc7424023b27382b4d9cd169111ee27cbc82bb796ac7ef442c3bbbe5f87d63'
+sha256sums=('7c82afc1ed4710195245d0db50bde7952e64fa9250fa4a0ccbfd6d9727e9c5b4'
             'SKIP')
 sha256sums_x86_64=('8e512f13e575a43655fc92319436c94890c137b9035cc6bd6f9cf24239704d3a'
-                   '47035c653863a8e4be3dc6f142b8dbd84b4bb1efc9a8cbc68413e6a5ff5e9f50')
+                   'fbb768a16c23a453c420ba55bbc2a689c708bc6456ef77c1e4f69823b95f9e9f')
 sha256sums_aarch64=('613f9b2861dea937b24d5eca745ef8567733b377d0bb612195acaad0e3f61360'
-                    'e3fd682354346845d2944a2da2b1ff2b6cb9259d92027f2f9c121b9b93c5e42f')
+                    'c85722f3f26059e1bbe689bb8ada4434dfaf68fa9fc8e64bac6a95da1828de01')
 options=('!strip')
 
 validpgpkeys=('58117AFA1F85B3EEC154677D615D449FE6E6A235')
@@ -80,7 +80,7 @@
     --vendor "Skymatic GmbH" \
     --copyright "(C) 2016 - 2026 Skymatic GmbH" \
     --java-options "--enable-preview" \
-    --java-options '--enable-native-access=javafx.graphics,org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator' \
+    --java-options '--enable-native-access=javafx.graphics,org.cryptomator.frontend.fuse,org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator' \
     --java-options "-Xss5m" \
     --java-options "-Xmx256m" \
     --java-options "-Dfile.encoding=\"utf-8\"" \

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 11:55:28	Medium	1
2026-10-30 00:29:30	Low	2
2026-10-29 11:52:15	Medium	1
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 09:31:11	Medium	1
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2