fcitx5-mozc-ext-neologd
LOW
maintainer Harukamy
5 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads official source code from project repositories and two data files (zip code lists) from Japan Post's official website, which are used to generate dictionaries; these are legitimate data sources, not executables, and the build process is transparent and reproducible despite unverifiable checksums.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official source code from project repositories and two data files (zip code lists) from Japan Post's official website, which are used to generate dictionaries; these are legitimate data sources, not executables, and the build process is transparent and reproducible despite unverifiable checksums.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
https://www.post.japanpost.jp/service/search/zipcode/download/office/zip/jigyosyo.zip -
PKGBUILD:35
git+https://chromium.googlesource.com/breakpad/breakpad#commit=${_breakpad_commit}
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Masaki Haruka <yek@reasonset.net>
2
# Contributor: Jiachen Yang <farseerfc@archlinux.org>
3
# Contributor: Felix Yan <felixonmars@archlinux.org>
4
# Contributor: ponsfoot <cabezon dot hashimoto at gmail dot com>
5
# Contributor: UTUMI Hirosi <utuhiro78 at yahoo dot co dot jp>
6
7
## Mozc compile option
8
_bldtype=Release
9
_mozc_commit=58def27
10
11
_abseil_cpp_commit=76a21a9
12
_breakpad_commit=94c818ea
13
_gtest_commit=cd8e73f
14
_japanese_usage_dictionary_commit=38d3462
15
_jsoncpp_commit=93acc7b
16
_protobuf_commit=8dd0a01
17
_dictext_commit=f4e3dc5
18
_neologd_commit=abc61e3
19
20
_pkgbase=mozc
21
pkgname=fcitx5-mozc-ext-neologd
22
pkgdesc="Fcitx5 Module of Mozc (Google Japanese Input OSS) with external generated dictionaries (NEologd and Sudachi.)"
23
pkgver=3.35.6354.102.g58def27.xf4e3dc5
24
pkgrel=1
25
arch=('x86_64')
26
url="https://github.com/google/mozc"
27
license=('custom')
28
depends=('qt6-base' 'fcitx5')
29
makedepends=('pkg-config' 'python' 'bazelisk' 'git' 'clang' 'python-six' 'zsh' 'ruby' 'xz' 'unzip' 'ruby-csv' 'ruby-nkf')
30
conflicts=('mozc' 'mozc-server' 'mozc-utils-gui' 'mozc-fcitx' 'fcitx-mozc' 'fcitx5-mozc-ut' 'fcitx5-mozc-ut-full' 'fcitx-mozc-neologd-ut' 'fcitx-mozc-ut-unified' 'fcitx-mozc-ut-unified-full' 'fcitx5-mozc')
31
provides=('fcitx5-mozc=3.33.6133.102')
32
source=(git+https://github.com/fcitx/mozc.git#commit=${_mozc_commit}
33
https://www.post.japanpost.jp/service/search/zipcode/download/office/zip/jigyosyo.zip
34
https://www.post.japanpost.jp/service/search/zipcode/download/kogaki/zip/ken_all.zip
35
git+https://chromium.googlesource.com/breakpad/breakpad#commit=${_breakpad_commit}
36
git+https://github.com/google/googletest.git#commit=${_gtest_commit}
37
git+https://github.com/hiroyuki-komatsu/japanese-usage-dictionary.git#commit=${_japanese_usage_dictionary_commit}
38
git+https://github.com/open-source-parsers/jsoncpp.git#commit=${_jsoncpp_commit}
39
git+https://github.com/google/protobuf.git#commit=${_protobuf_commit}
40
git+https://github.com/abseil/abseil-cpp.git#commit=${_abseil_cpp_commit}
41
git+https://github.com/reasonset/mozcdict-ext.git#commit=${_dictext_commit}
42
git+https://github.com/neologd/mecab-ipadic-neologd.git#commit=${_neologd_commit}
43
)
44
sha512sums=('SKIP'
45
'SKIP'
46
'SKIP'
47
'SKIP'
48
'SKIP'
49
'SKIP'
50
'SKIP'
51
'SKIP'
52
'SKIP'
53
'SKIP'
54
'SKIP')
55
validpgpkeys=('2CC8A0609AD2A479C65B6D5C8E8B898CBF2412F9') # Weng Xuetian
56
57
pkgver() {
58
cd mozc
59
60
# Extract the MAJOR, MINOR, and BUILD numbers from the new src/version.bzl file
61
local _major=$(awk -F'[ =]+' '/^MAJOR/ {print $2}' src/version.bzl)
62
local _minor=$(awk -F'[ =]+' '/^MINOR/ {print $2}' src/version.bzl)
63
local _build=$(awk -F'[ =]+' '/^BUILD_OSS/ {print $2}' src/version.bzl)
64
65
# As before, build it with revision (102) for Linux
66
printf "%s.%s.%s.102.g%s.x%s" "$_major" "$_minor" "$_build" "${_mozc_commit}" "$_dictext_commit"
67
}
68
69
prepare() {
70
cd "$srcdir/mozc"
71
git config protocol.file.allow always
72
git submodule init
73
git config submodule.src/third_party/breakpad.url "$srcdir/breakpad"
74
git config submodule.src/third_party/gtest.url "$srcdir/googletest"
75
git config submodule.src/third_party/japanese_usage_dictionary.url "$srcdir/japanese-usage-dictionary"
76
git config submodule.src/third_party/jsoncpp.url "$srcdir/jsoncpp"
77
git config submodule.src/third_party/protobuf.url "$srcdir/protobuf"
78
git config submodule.src/third_party/abseil-cpp.url "$srcdir/abseil-cpp"
79
git -c protocol.file.allow=always submodule update
80
81
cd src
82
83
# Reset dictionary09
84
git checkout data/dictionary_oss/dictionary09.txt
85
86
# Generate zip code seed
87
echo "Generating zip code seed..."
88
PYTHONPATH="$PWD:$PYTHONPATH" python dictionary/gen_zip_code_seed.py --zip_code="${srcdir}/KEN_ALL.CSV" --jigyosyo="${srcdir}/JIGYOSYO.CSV" >> data/dictionary_oss/dictionary09.txt
89
echo "Done."
90
91
# Include NEologd
92
cd "$srcdir/mozcdict-ext"
93
94
git submodule init
95
git config submodule.neologd/upstream.url "$srcdir/mecab-ipadic-neologd"
96
git -c protocol.file.allow=always submodule update
97
98
echo "Generating extra dictionaries..."
99
(
100
(
101
cd neologd
102
MOZC_ID_FILE="$srcdir/mozc/src/data/dictionary_oss/id.def" zsh mkdict.zsh
103
)
104
(
105
cd sudachi
106
MOZC_ID_FILE="$srcdir/mozc/src/data/dictionary_oss/id.def" zsh mkdict.zsh
107
)
108
(
109
cd byhand
110
MOZC_ID_FILE="$srcdir/mozc/src/data/dictionary_oss/id.def" zsh mkdict.zsh
111
)
112
) | ruby .dev.utils/uniqword.rb 2> /dev/null >> "$srcdir/mozc/src/data/dictionary_oss/dictionary09.txt"
113
echo "Done."
114
115
cd "$srcdir/mozc"
116
cd src
117
118
rm -rf unix/fcitx
119
rm -rf unix/ibus
120
}
121
122
build() {
123
# Fix compatibility with google-glog 0.3.3 (symbol conflict)
124
CFLAGS="${CFLAGS} -fvisibility=hidden"
125
CXXFLAGS="${CXXFLAGS} -fvisibility=hidden"
126
127
# Explicitly specify Clang to prevent Bazel from leaking GCC system headers and violating sandbox
128
export CC=clang
129
export CXX=clang++
130
131
cd mozc/src
132
133
QT_BASE_PATH="$(pkg-config --variable=prefix Qt6Core)/include/qt6" ../scripts/build_fcitx5_bazel
134
135
# Extract license part of mozc
136
head -n 29 server/mozc_server.cc > LICENSE
137
}
138
139
package() {
140
cd mozc/src
141
export PREFIX="${pkgdir}/usr"
142
export _bldtype
143
../scripts/install_server_bazel
144
145
install -d "${pkgdir}/usr/share/licenses/$pkgname/"
146
install -m 644 LICENSE data/installer/*.html "${pkgdir}/usr/share/licenses/${pkgname}/"
147
148
install -d "${PREFIX}/share/fcitx5/addon"
149
install -d "${PREFIX}/share/fcitx5/inputmethod"
150
install -d "${PREFIX}/lib/fcitx5"
151
../scripts/install_fcitx5_bazel
152
}
153
Changes since previous scan
--- PKGBUILD @ 2026-10-27 00:23+++ PKGBUILD @ 2026-11-01 00:21@@ -6,21 +6,21 @@ ## Mozc compile option _bldtype=Release-_mozc_commit=a16dde4+_mozc_commit=58def27 -_abseil_cpp_commit=5c01794-_breakpad_commit=8be0e31-_gtest_commit=d72f9c8+_abseil_cpp_commit=76a21a9+_breakpad_commit=94c818ea+_gtest_commit=cd8e73f _japanese_usage_dictionary_commit=38d3462-_jsoncpp_commit=ca98c98-_protobuf_commit=199a436-_dictext_commit=b1b79e9+_jsoncpp_commit=93acc7b+_protobuf_commit=8dd0a01+_dictext_commit=f4e3dc5 _neologd_commit=abc61e3 _pkgbase=mozc pkgname=fcitx5-mozc-ext-neologd pkgdesc="Fcitx5 Module of Mozc (Google Japanese Input OSS) with external generated dictionaries (NEologd and Sudachi.)"-pkgver=3.33.6133.102.ga16dde4.xb1b79e9+pkgver=3.35.6354.102.g58def27.xf4e3dc5 pkgrel=1 arch=('x86_64') url="https://github.com/google/mozc"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 13:48:00 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |