cryptomator

maintainer ajgraves · 83 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code and build dependencies from official project and vendor repositories (GitHub, Adoptium, Gluon), which are legitimate sources; the non-whitelisted host is a standard release endpoint for OpenJFX, and the build process is transparent and follows standard practices for Java applications.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and build dependencies from official project and vendor repositories (GitHub, Adoptium, Gluon), which are legitimate sources; the non-whitelisted host is a standard release endpoint for OpenJFX, and the build process is transparent and follows standard practices for Java applications.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-x64_bin-jmods.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aaron Graves <linux@ajgraves.com>
    
      2# Contributor: Julian Raufelder <arch@raufelder.com>
    
      3# Contributor: Morten Linderud <morten@linderud.pw>
    
      4# Contributor: Sebastian Stenzel <sebastian.stenzel@gmail.com>
    
      5# Contributor: Armin Schrenk <armin.schrenk@skymatic.de>
    
      6
    
      7pkgname=cryptomator
    
      8pkgver=1.19.3
    
      9pkgrel=1
    
      10pkgdesc="Multiplatform transparent client-side encryption of your files in the cloud."
    
      11arch=('any')
    
      12url="https://cryptomator.org/"
    
      13license=('GPL3')
    
      14depends=('fuse3' 'alsa-lib' 'hicolor-icon-theme' 'libxtst' 'libnet' 'libxrender')
    
      15makedepends=('maven' 'unzip')
    
      16optdepends=('keepassxc-cryptomator: Use KeePassXC to store vault passwords' 'ttf-hanazono: Install this font when using Japanese system language')
    
      17_jdkver=26.0.1+8
    
      18_jfxver=25.0.3
    
      19_src_app_dir=cryptomator-${pkgver//_/-}
    
      20source=("cryptomator-${pkgver//_/-}.tar.gz::https://github.com/cryptomator/cryptomator/archive/refs/tags/${pkgver//_/-}.tar.gz"
    
      21        "cryptomator-${pkgver//_/-}.tar.gz.asc::https://github.com/cryptomator/cryptomator/releases/download/${pkgver//_/-}/cryptomator-${pkgver//_/-}.tar.gz.asc");
    
      22source_x86_64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_x64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
    
      23               "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-x64_bin-jmods.zip")
    
      24source_aarch64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_aarch64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
    
      25                "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-aarch64_bin-jmods.zip")
    
      26noextract=("jdk-${_jdkver}.tar.gz" "openjfx-${_jfxver}.zip")
    
      27sha256sums=('88475df07a49a321863d8753fdb99ad77d0afae7d26628dfbbb21ec9a4717204'
    
      28            'SKIP')
    
      29sha256sums_x86_64=('8e512f13e575a43655fc92319436c94890c137b9035cc6bd6f9cf24239704d3a'
    
      30                   '47035c653863a8e4be3dc6f142b8dbd84b4bb1efc9a8cbc68413e6a5ff5e9f50')
    
      31sha256sums_aarch64=('613f9b2861dea937b24d5eca745ef8567733b377d0bb612195acaad0e3f61360'
    
      32                    'e3fd682354346845d2944a2da2b1ff2b6cb9259d92027f2f9c121b9b93c5e42f')
    
      33options=('!strip')
    
      34
    
      35validpgpkeys=('58117AFA1F85B3EEC154677D615D449FE6E6A235')
    
      36
    
      37build() {
    
      38  export JAVA_HOME="${srcdir}/jdk-${_jdkver}"
    
      39  JMODS_PATH="${srcdir}/openjfx-${_jfxver}-jmods"
    
      40  #JEP 493
    
      41  if ! $(${JAVA_HOME}/bin/jlink --help | grep -q "Linking from run-time image enabled"); then
    
      42      JMODS_PATH="${JMODS_PATH}:${JAVA_HOME}/jmods:"
    
      43  fi
    
      44
    
      45  tar xfz "jdk-${_jdkver}.tar.gz"
    
      46
    
      47  mkdir "openjfx-${_jfxver}-jmods"
    
      48  unzip -j "openjfx-${_jfxver}.zip" \*/javafx.base.jmod \*/javafx.controls.jmod \*/javafx.fxml.jmod \*/javafx.graphics.jmod -d "openjfx-${_jfxver}-jmods"
    
      49
    
      50  cd "${srcdir}/${_src_app_dir}"
    
      51
    
      52  mvn -B clean package -DskipTests
    
      53
    
      54  cp LICENSE.txt target
    
      55  cp target/cryptomator-*.jar target/mods
    
      56
    
      57  cd target
    
      58
    
      59  "$JAVA_HOME/bin/jlink" \
    
      60    --output runtime \
    
      61    --module-path "$JMODS_PATH" \
    
      62    --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.security.auth,jdk.accessibility,jdk.management.jfr,jdk.net,java.compiler \
    
      63    --strip-native-commands \
    
      64    --no-header-files \
    
      65    --no-man-pages \
    
      66    --strip-debug \
    
      67    --compress=zip-0
    
      68
    
      69  ##Note: jpackage does not allow -beta suffixes, have to strip those
    
      70  "$JAVA_HOME/bin/jpackage" \
    
      71    --type app-image \
    
      72    --runtime-image runtime \
    
      73    --input libs \
    
      74    --module-path mods \
    
      75    --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator \
    
      76    --dest . \
    
      77    --name cryptomator \
    
      78    --vendor "Skymatic GmbH" \
    
      79    --copyright "(C) 2016 - 2026 Skymatic GmbH" \
    
      80    --java-options "--enable-preview" \
    
      81    --java-options '--enable-native-access=javafx.graphics,org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator' \
    
      82    --java-options "-Xss5m" \
    
      83    --java-options "-Xmx256m" \
    
      84    --java-options "-Dfile.encoding=\"utf-8\"" \
    
      85    --java-options "-Djava.net.useSystemProxies=true" \
    
      86    --java-options "-Dcryptomator.adminConfigPath=\"/etc/cryptomator/config.properties\"" \
    
      87    --java-options "-Dcryptomator.appVersion=\"${pkgver//_/-}\"" \
    
      88    --java-options "-Dcryptomator.buildNumber=\"aur-${pkgrel}\"" \
    
      89    --java-options "-Dcryptomator.disableUpdateCheck=true" \
    
      90    --java-options "-Dcryptomator.integrationsLinux.autoStartCmd=\"cryptomator\"" \
    
      91    --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/.config/Cryptomator/ipc.socket\"" \
    
      92    --java-options "-Dcryptomator.logDir=\"@{userhome}/.local/share/Cryptomator/logs\"" \
    
      93    --java-options "-Dcryptomator.mountPointsDir=\"@{userhome}/.local/share/Cryptomator/mnt\"" \
    
      94    --java-options "-Dcryptomator.networking.truststore.p12Path=\"/etc/cryptomator/certs.p12\"" \
    
      95    --java-options "-Dcryptomator.pluginDir=\"@{userhome}/.local/share/Cryptomator/plugins\"" \
    
      96    --java-options "-Dcryptomator.p12Path=\"@{userhome}/.config/Cryptomator/key.p12\"" \
    
      97    --java-options "-Dcryptomator.settingsPath=\"@{userhome}/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json\"" \
    
      98    --java-options "-Dcryptomator.showTrayIcon=true" \
    
      99    --java-options "-Dcryptomator.hub.enableTrustOnFirstUse=true" \
    
      100    --app-version "${pkgver//_*/}" \
    
      101    --verbose
    
      102}
    
      103
    
      104package() {
    
      105  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/application-vnd.cryptomator.vault.xml" "${pkgdir}/usr/share/mime/packages/cryptomator-vault.xml"
    
      106  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.desktop" "${pkgdir}/usr/share/applications/org.cryptomator.Cryptomator.desktop"
    
      107  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/org.cryptomator.Cryptomator.png"
    
      108  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator512.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/org.cryptomator.Cryptomator.png"
    
      109  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg"
    
      110  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.tray.svg"
    
      111  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray-unlocked.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.tray-unlocked.svg"
    
      112  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray.svg" "${pkgdir}/usr/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-symbolic.svg"
    
      113  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray-unlocked.svg" "${pkgdir}/usr/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-unlocked-symbolic.svg"
    
      114
    
      115  mkdir -p "${pkgdir}/opt/cryptomator/"
    
      116  cp -R "${srcdir}/${_src_app_dir}/target/cryptomator" "${pkgdir}/opt/"
    
      117  install -Dm644 "${srcdir}/${_src_app_dir}/target/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      118
    
      119  mkdir -p "${pkgdir}/usr/bin"
    
      120  ln -s "/opt/cryptomator/bin/cryptomator" "${pkgdir}/usr/bin/cryptomator"
    
      121}
    
      122

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2