cryptomator
LOW
maintainer ajgraves
83 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source code and build dependencies from official project and vendor repositories (GitHub, Adoptium, Gluon), which are legitimate sources; the non-whitelisted host is a standard release endpoint for OpenJFX, and the build process is transparent and follows standard practices for Java applications.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and build dependencies from official project and vendor repositories (GitHub, Adoptium, Gluon), which are legitimate sources; the non-whitelisted host is a standard release endpoint for OpenJFX, and the build process is transparent and follows standard practices for Java applications.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
"openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-x64_bin-jmods.zip")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Aaron Graves <linux@ajgraves.com>
2
# Contributor: Julian Raufelder <arch@raufelder.com>
3
# Contributor: Morten Linderud <morten@linderud.pw>
4
# Contributor: Sebastian Stenzel <sebastian.stenzel@gmail.com>
5
# Contributor: Armin Schrenk <armin.schrenk@skymatic.de>
6
7
pkgname=cryptomator
8
pkgver=1.19.3
9
pkgrel=1
10
pkgdesc="Multiplatform transparent client-side encryption of your files in the cloud."
11
arch=('any')
12
url="https://cryptomator.org/"
13
license=('GPL3')
14
depends=('fuse3' 'alsa-lib' 'hicolor-icon-theme' 'libxtst' 'libnet' 'libxrender')
15
makedepends=('maven' 'unzip')
16
optdepends=('keepassxc-cryptomator: Use KeePassXC to store vault passwords' 'ttf-hanazono: Install this font when using Japanese system language')
17
_jdkver=26.0.1+8
18
_jfxver=25.0.3
19
_src_app_dir=cryptomator-${pkgver//_/-}
20
source=("cryptomator-${pkgver//_/-}.tar.gz::https://github.com/cryptomator/cryptomator/archive/refs/tags/${pkgver//_/-}.tar.gz"
21
"cryptomator-${pkgver//_/-}.tar.gz.asc::https://github.com/cryptomator/cryptomator/releases/download/${pkgver//_/-}/cryptomator-${pkgver//_/-}.tar.gz.asc");
22
source_x86_64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_x64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
23
"openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-x64_bin-jmods.zip")
24
source_aarch64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_aarch64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
25
"openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-aarch64_bin-jmods.zip")
26
noextract=("jdk-${_jdkver}.tar.gz" "openjfx-${_jfxver}.zip")
27
sha256sums=('88475df07a49a321863d8753fdb99ad77d0afae7d26628dfbbb21ec9a4717204'
28
'SKIP')
29
sha256sums_x86_64=('8e512f13e575a43655fc92319436c94890c137b9035cc6bd6f9cf24239704d3a'
30
'47035c653863a8e4be3dc6f142b8dbd84b4bb1efc9a8cbc68413e6a5ff5e9f50')
31
sha256sums_aarch64=('613f9b2861dea937b24d5eca745ef8567733b377d0bb612195acaad0e3f61360'
32
'e3fd682354346845d2944a2da2b1ff2b6cb9259d92027f2f9c121b9b93c5e42f')
33
options=('!strip')
34
35
validpgpkeys=('58117AFA1F85B3EEC154677D615D449FE6E6A235')
36
37
build() {
38
export JAVA_HOME="${srcdir}/jdk-${_jdkver}"
39
JMODS_PATH="${srcdir}/openjfx-${_jfxver}-jmods"
40
#JEP 493
41
if ! $(${JAVA_HOME}/bin/jlink --help | grep -q "Linking from run-time image enabled"); then
42
JMODS_PATH="${JMODS_PATH}:${JAVA_HOME}/jmods:"
43
fi
44
45
tar xfz "jdk-${_jdkver}.tar.gz"
46
47
mkdir "openjfx-${_jfxver}-jmods"
48
unzip -j "openjfx-${_jfxver}.zip" \*/javafx.base.jmod \*/javafx.controls.jmod \*/javafx.fxml.jmod \*/javafx.graphics.jmod -d "openjfx-${_jfxver}-jmods"
49
50
cd "${srcdir}/${_src_app_dir}"
51
52
mvn -B clean package -DskipTests
53
54
cp LICENSE.txt target
55
cp target/cryptomator-*.jar target/mods
56
57
cd target
58
59
"$JAVA_HOME/bin/jlink" \
60
--output runtime \
61
--module-path "$JMODS_PATH" \
62
--add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.security.auth,jdk.accessibility,jdk.management.jfr,jdk.net,java.compiler \
63
--strip-native-commands \
64
--no-header-files \
65
--no-man-pages \
66
--strip-debug \
67
--compress=zip-0
68
69
##Note: jpackage does not allow -beta suffixes, have to strip those
70
"$JAVA_HOME/bin/jpackage" \
71
--type app-image \
72
--runtime-image runtime \
73
--input libs \
74
--module-path mods \
75
--module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator \
76
--dest . \
77
--name cryptomator \
78
--vendor "Skymatic GmbH" \
79
--copyright "(C) 2016 - 2026 Skymatic GmbH" \
80
--java-options "--enable-preview" \
81
--java-options '--enable-native-access=javafx.graphics,org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator' \
82
--java-options "-Xss5m" \
83
--java-options "-Xmx256m" \
84
--java-options "-Dfile.encoding=\"utf-8\"" \
85
--java-options "-Djava.net.useSystemProxies=true" \
86
--java-options "-Dcryptomator.adminConfigPath=\"/etc/cryptomator/config.properties\"" \
87
--java-options "-Dcryptomator.appVersion=\"${pkgver//_/-}\"" \
88
--java-options "-Dcryptomator.buildNumber=\"aur-${pkgrel}\"" \
89
--java-options "-Dcryptomator.disableUpdateCheck=true" \
90
--java-options "-Dcryptomator.integrationsLinux.autoStartCmd=\"cryptomator\"" \
91
--java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/.config/Cryptomator/ipc.socket\"" \
92
--java-options "-Dcryptomator.logDir=\"@{userhome}/.local/share/Cryptomator/logs\"" \
93
--java-options "-Dcryptomator.mountPointsDir=\"@{userhome}/.local/share/Cryptomator/mnt\"" \
94
--java-options "-Dcryptomator.networking.truststore.p12Path=\"/etc/cryptomator/certs.p12\"" \
95
--java-options "-Dcryptomator.pluginDir=\"@{userhome}/.local/share/Cryptomator/plugins\"" \
96
--java-options "-Dcryptomator.p12Path=\"@{userhome}/.config/Cryptomator/key.p12\"" \
97
--java-options "-Dcryptomator.settingsPath=\"@{userhome}/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json\"" \
98
--java-options "-Dcryptomator.showTrayIcon=true" \
99
--java-options "-Dcryptomator.hub.enableTrustOnFirstUse=true" \
100
--app-version "${pkgver//_*/}" \
101
--verbose
102
}
103
104
package() {
105
install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/application-vnd.cryptomator.vault.xml" "${pkgdir}/usr/share/mime/packages/cryptomator-vault.xml"
106
install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.desktop" "${pkgdir}/usr/share/applications/org.cryptomator.Cryptomator.desktop"
107
install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/org.cryptomator.Cryptomator.png"
108
install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator512.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/org.cryptomator.Cryptomator.png"
109
install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg"
110
install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.tray.svg"
111
install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray-unlocked.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.tray-unlocked.svg"
112
install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray.svg" "${pkgdir}/usr/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-symbolic.svg"
113
install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray-unlocked.svg" "${pkgdir}/usr/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-unlocked-symbolic.svg"
114
115
mkdir -p "${pkgdir}/opt/cryptomator/"
116
cp -R "${srcdir}/${_src_app_dir}/target/cryptomator" "${pkgdir}/opt/"
117
install -Dm644 "${srcdir}/${_src_app_dir}/target/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
118
119
mkdir -p "${pkgdir}/usr/bin"
120
ln -s "/opt/cryptomator/bin/cryptomator" "${pkgdir}/usr/bin/cryptomator"
121
}
122
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |