fcitx5-mozc-ext-neologd
LOW
maintainer Harukamy
5 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads official project source code from git repositories and two non-whitelisted but official Japanese postal service data files (ken_all.zip, jigyosyo.zip) used as dictionary input; these are non-executable data files, and the build process is transparent and self-contained, posing no remote code execution or supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official project source code from git repositories and two non-whitelisted but official Japanese postal service data files (ken_all.zip, jigyosyo.zip) used as dictionary input; these are non-executable data files, and the build process is transparent and self-contained, posing no remote code execution or supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
https://www.post.japanpost.jp/service/search/zipcode/download/office/zip/jigyosyo.zip -
PKGBUILD:35
git+https://chromium.googlesource.com/breakpad/breakpad#commit=${_breakpad_commit}
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Masaki Haruka <yek@reasonset.net>
2
# Contributor: Jiachen Yang <farseerfc@archlinux.org>
3
# Contributor: Felix Yan <felixonmars@archlinux.org>
4
# Contributor: ponsfoot <cabezon dot hashimoto at gmail dot com>
5
# Contributor: UTUMI Hirosi <utuhiro78 at yahoo dot co dot jp>
6
7
## Mozc compile option
8
_bldtype=Release
9
_mozc_commit=a16dde4
10
11
_abseil_cpp_commit=5c01794
12
_breakpad_commit=8be0e31
13
_gtest_commit=d72f9c8
14
_japanese_usage_dictionary_commit=38d3462
15
_jsoncpp_commit=ca98c98
16
_protobuf_commit=199a436
17
_dictext_commit=b1b79e9
18
_neologd_commit=abc61e3
19
20
_pkgbase=mozc
21
pkgname=fcitx5-mozc-ext-neologd
22
pkgdesc="Fcitx5 Module of Mozc (Google Japanese Input OSS) with external generated dictionaries (NEologd and Sudachi.)"
23
pkgver=3.33.6133.102.ga16dde4.xb1b79e9
24
pkgrel=1
25
arch=('x86_64')
26
url="https://github.com/google/mozc"
27
license=('custom')
28
depends=('qt6-base' 'fcitx5')
29
makedepends=('pkg-config' 'python' 'bazelisk' 'git' 'clang' 'python-six' 'zsh' 'ruby' 'xz' 'unzip' 'ruby-csv' 'ruby-nkf')
30
conflicts=('mozc' 'mozc-server' 'mozc-utils-gui' 'mozc-fcitx' 'fcitx-mozc' 'fcitx5-mozc-ut' 'fcitx5-mozc-ut-full' 'fcitx-mozc-neologd-ut' 'fcitx-mozc-ut-unified' 'fcitx-mozc-ut-unified-full' 'fcitx5-mozc')
31
provides=('fcitx5-mozc=3.33.6133.102')
32
source=(git+https://github.com/fcitx/mozc.git#commit=${_mozc_commit}
33
https://www.post.japanpost.jp/service/search/zipcode/download/office/zip/jigyosyo.zip
34
https://www.post.japanpost.jp/service/search/zipcode/download/kogaki/zip/ken_all.zip
35
git+https://chromium.googlesource.com/breakpad/breakpad#commit=${_breakpad_commit}
36
git+https://github.com/google/googletest.git#commit=${_gtest_commit}
37
git+https://github.com/hiroyuki-komatsu/japanese-usage-dictionary.git#commit=${_japanese_usage_dictionary_commit}
38
git+https://github.com/open-source-parsers/jsoncpp.git#commit=${_jsoncpp_commit}
39
git+https://github.com/google/protobuf.git#commit=${_protobuf_commit}
40
git+https://github.com/abseil/abseil-cpp.git#commit=${_abseil_cpp_commit}
41
git+https://github.com/reasonset/mozcdict-ext.git#commit=${_dictext_commit}
42
git+https://github.com/neologd/mecab-ipadic-neologd.git#commit=${_neologd_commit}
43
)
44
sha512sums=('SKIP'
45
'SKIP'
46
'SKIP'
47
'SKIP'
48
'SKIP'
49
'SKIP'
50
'SKIP'
51
'SKIP'
52
'SKIP'
53
'SKIP'
54
'SKIP')
55
validpgpkeys=('2CC8A0609AD2A479C65B6D5C8E8B898CBF2412F9') # Weng Xuetian
56
57
pkgver() {
58
cd mozc
59
60
# Extract the MAJOR, MINOR, and BUILD numbers from the new src/version.bzl file
61
local _major=$(awk -F'[ =]+' '/^MAJOR/ {print $2}' src/version.bzl)
62
local _minor=$(awk -F'[ =]+' '/^MINOR/ {print $2}' src/version.bzl)
63
local _build=$(awk -F'[ =]+' '/^BUILD_OSS/ {print $2}' src/version.bzl)
64
65
# As before, build it with revision (102) for Linux
66
printf "%s.%s.%s.102.g%s.x%s" "$_major" "$_minor" "$_build" "${_mozc_commit}" "$_dictext_commit"
67
}
68
69
prepare() {
70
cd "$srcdir/mozc"
71
git config protocol.file.allow always
72
git submodule init
73
git config submodule.src/third_party/breakpad.url "$srcdir/breakpad"
74
git config submodule.src/third_party/gtest.url "$srcdir/googletest"
75
git config submodule.src/third_party/japanese_usage_dictionary.url "$srcdir/japanese-usage-dictionary"
76
git config submodule.src/third_party/jsoncpp.url "$srcdir/jsoncpp"
77
git config submodule.src/third_party/protobuf.url "$srcdir/protobuf"
78
git config submodule.src/third_party/abseil-cpp.url "$srcdir/abseil-cpp"
79
git -c protocol.file.allow=always submodule update
80
81
cd src
82
83
# Reset dictionary09
84
git checkout data/dictionary_oss/dictionary09.txt
85
86
# Generate zip code seed
87
echo "Generating zip code seed..."
88
PYTHONPATH="$PWD:$PYTHONPATH" python dictionary/gen_zip_code_seed.py --zip_code="${srcdir}/KEN_ALL.CSV" --jigyosyo="${srcdir}/JIGYOSYO.CSV" >> data/dictionary_oss/dictionary09.txt
89
echo "Done."
90
91
# Include NEologd
92
cd "$srcdir/mozcdict-ext"
93
94
git submodule init
95
git config submodule.neologd/upstream.url "$srcdir/mecab-ipadic-neologd"
96
git -c protocol.file.allow=always submodule update
97
98
echo "Generating extra dictionaries..."
99
(
100
(
101
cd neologd
102
MOZC_ID_FILE="$srcdir/mozc/src/data/dictionary_oss/id.def" zsh mkdict.zsh
103
)
104
(
105
cd sudachi
106
MOZC_ID_FILE="$srcdir/mozc/src/data/dictionary_oss/id.def" zsh mkdict.zsh
107
)
108
(
109
cd byhand
110
MOZC_ID_FILE="$srcdir/mozc/src/data/dictionary_oss/id.def" zsh mkdict.zsh
111
)
112
) | ruby .dev.utils/uniqword.rb 2> /dev/null >> "$srcdir/mozc/src/data/dictionary_oss/dictionary09.txt"
113
echo "Done."
114
115
cd "$srcdir/mozc"
116
cd src
117
118
rm -rf unix/fcitx
119
rm -rf unix/ibus
120
}
121
122
build() {
123
# Fix compatibility with google-glog 0.3.3 (symbol conflict)
124
CFLAGS="${CFLAGS} -fvisibility=hidden"
125
CXXFLAGS="${CXXFLAGS} -fvisibility=hidden"
126
127
# Explicitly specify Clang to prevent Bazel from leaking GCC system headers and violating sandbox
128
export CC=clang
129
export CXX=clang++
130
131
cd mozc/src
132
133
QT_BASE_PATH="$(pkg-config --variable=prefix Qt6Core)/include/qt6" ../scripts/build_fcitx5_bazel
134
135
# Extract license part of mozc
136
head -n 29 server/mozc_server.cc > LICENSE
137
}
138
139
package() {
140
cd mozc/src
141
export PREFIX="${pkgdir}/usr"
142
export _bldtype
143
../scripts/install_server_bazel
144
145
install -d "${pkgdir}/usr/share/licenses/$pkgname/"
146
install -m 644 LICENSE data/installer/*.html "${pkgdir}/usr/share/licenses/${pkgname}/"
147
148
install -d "${PREFIX}/share/fcitx5/addon"
149
install -d "${PREFIX}/share/fcitx5/inputmethod"
150
install -d "${PREFIX}/lib/fcitx5"
151
../scripts/install_fcitx5_bazel
152
}
153
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |