fcitx5-mozc-git
LOW
maintainer farseerfc
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from source using official project repositories and includes two data-only ZIP files from a non-whitelisted host (osdn.net) for zip code dictionaries; these are non-executable data files with no code execution, and the rest of the build uses verifiable upstream sources, making the overall risk low despite the non-standard host and skipped checksums.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this HIGH, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from source using official project repositories and includes two data-only ZIP files from a non-whitelisted host (osdn.net) for zip code dictionaries; these are non-executable data files with no code execution, and the rest of the build uses verifiable upstream sources, making the overall risk low despite the non-standard host and skipped checksums.
-
PKGBUILD:50
_bzr_ver=$(sed 's/ //g;$ a echo $MAJOR.$MINOR.$BUILD.102' src/data/version/mozc_version_template.bzl | source /dev/stdin)
2 higher static findings superseded - not the current verdict (shown for transparency)
High
Encoded/compressed payload decoded and executed
base64_decode_exec
A payload is decoded/decompressed (base64, hex, gzip/xz/zstd, rev, tr, openssl…) and executed — piped to a shell/interpreter, run via process substitution/eval, captured into a variable then eval'd, or decoded+exec'd in a scripting language — hiding the real command from review.
-
PKGBUILD:50
_bzr_ver=$(sed 's/ //g;$ a echo $MAJOR.$MINOR.$BUILD.102' src/data/version/mozc_version_template.bzl | source /dev/stdin)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
https://osdn.net/projects/ponsfoot-aur/storage/mozc/jigyosyo-${_zipcode_rel}.zip -
PKGBUILD:27
git+https://chromium.googlesource.com/breakpad/breakpad
PKGBUILD
3 offending line(s) highlighted
1
# $Id$
2
# Maintainer: Jiachen Yang <farseerfc@archlinux.org>
3
# Contributor: Felix Yan <felixonmars@archlinux.org>
4
# Contributor: ponsfoot <cabezon dot hashimoto at gmail dot com>
5
# Contributor: UTUMI Hirosi <utuhiro78 at yahoo dot co dot jp>
6
7
## Mozc compile option
8
_bldtype=Release
9
10
_zipcode_rel=202011
11
12
_pkgbase=mozc
13
pkgname=fcitx5-mozc-git
14
pkgdesc="Fcitx5 Module of A Japanese Input Method for Chromium OS, Windows, Mac and Linux (the Open Source Edition of Google Japanese Input)"
15
pkgver=2.26.4220.102.r1394.b862bc18
16
pkgrel=1
17
arch=('x86_64')
18
url="https://github.com/google/mozc"
19
license=('custom')
20
depends=('qt5-base' 'fcitx5-git')
21
makedepends=('pkg-config' 'python' 'curl' 'gtk2' 'mesa' 'subversion' 'ninja' 'git' 'clang' 'python-six')
22
replaces=('mozc-fcitx')
23
conflicts=('mozc' 'mozc-server' 'mozc-utils-gui' 'mozc-fcitx' 'fcitx-mozc' 'fcitx5-mozc')
24
source=(git+https://github.com/fcitx/mozc.git#branch=fcitx
25
https://osdn.net/projects/ponsfoot-aur/storage/mozc/jigyosyo-${_zipcode_rel}.zip
26
https://osdn.net/projects/ponsfoot-aur/storage/mozc/x-ken-all-${_zipcode_rel}.zip
27
git+https://chromium.googlesource.com/breakpad/breakpad
28
git+https://github.com/google/googletest.git
29
git+https://chromium.googlesource.com/external/gyp
30
git+https://github.com/hiroyuki-komatsu/japanese-usage-dictionary.git
31
git+https://github.com/open-source-parsers/jsoncpp.git
32
git+https://github.com/google/protobuf.git
33
git+https://github.com/abseil/abseil-cpp.git
34
)
35
sha512sums=('SKIP'
36
'0ef2d0abd9744900f9a50f941cf1f9b47640f3643c14a1be1761bcf0bd1053cb93560203c25280f58fccbd8ec98b9ca2e21c5d5a59844bbbffc9c988dfcf7bed'
37
'8a35672b4a525d8e4f3303bd83c6bf6075cd4f10e703bf656a4c9328f18a8783c3049b749092e6e8be57eaddce4f889e9dacae9b3b72ba7bb9240a0f5a93fd34'
38
'SKIP'
39
'SKIP'
40
'SKIP'
41
'SKIP'
42
'SKIP'
43
'SKIP'
44
'SKIP')
45
validpgpkeys=('2CC8A0609AD2A479C65B6D5C8E8B898CBF2412F9') # Weng Xuetian
46
47
pkgver() {
48
cd mozc
49
# parse major.minor.buildid from version template, revision is fixed to 102 for Linux
50
_bzr_ver=$(sed 's/ //g;$ a echo $MAJOR.$MINOR.$BUILD.102' src/data/version/mozc_version_template.bzl | source /dev/stdin)
51
printf "%s.r%s.%s" "${_bzr_ver}" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
52
}
53
54
prepare() {
55
cd "$srcdir/mozc"
56
git submodule init
57
git config submodule.src/third_party/breakpad.url "$srcdir/breakpad"
58
git config submodule.src/third_party/gtest.url "$srcdir/googletest"
59
git config submodule.src/third_party/gyp.url "$srcdir/gyp"
60
git config submodule.src/third_party/japanese_usage_dictionary.url "$srcdir/japanese-usage-dictionary"
61
git config submodule.src/third_party/jsoncpp.url "$srcdir/jsoncpp"
62
git config submodule.src/third_party/protobuf.url "$srcdir/protobuf"
63
git config submodule.src/third_party/abseil-cpp.url "$srcdir/abseil-cpp"
64
git submodule update
65
66
cd src
67
# Generate zip code seed
68
echo "Generating zip code seed..."
69
PYTHONPATH="$PWD:$PYTHONPATH" python dictionary/gen_zip_code_seed.py --zip_code="${srcdir}/x-ken-all.csv" --jigyosyo="${srcdir}/JIGYOSYO.CSV" >> data/dictionary_oss/dictionary09.txt
70
echo "Done."
71
72
# disable fcitx4 target
73
rm unix/fcitx/fcitx.gyp
74
75
## use libstdc++ instead of libc++
76
sed "/stdlib=libc++/d;/-lc++/d" -i gyp/common.gypi
77
}
78
79
build() {
80
# Fix compatibility with google-glog 0.3.3 (symbol conflict)
81
CFLAGS="${CFLAGS} -fvisibility=hidden"
82
CXXFLAGS="${CXXFLAGS} -fvisibility=hidden"
83
84
cd mozc/src
85
86
_targets="server/server.gyp:mozc_server gui/gui.gyp:mozc_tool unix/fcitx5/fcitx5.gyp:fcitx5-mozc"
87
88
QTDIR=/usr GYP_DEFINES="document_dir=/usr/share/licenses/$pkgname use_libzinnia=1" python build_mozc.py gyp
89
python build_mozc.py build -c $_bldtype $_targets
90
91
# Extract license part of mozc
92
head -n 29 server/mozc_server.cc > LICENSE
93
}
94
95
package() {
96
cd mozc/src
97
export PREFIX="${pkgdir}/usr"
98
export _bldtype
99
../scripts/install_server
100
101
install -d "${pkgdir}/usr/share/licenses/$pkgname/"
102
install -m 644 LICENSE data/installer/*.html "${pkgdir}/usr/share/licenses/${pkgname}/"
103
104
install -d "${PREFIX}/share/fcitx5/addon"
105
install -d "${PREFIX}/share/fcitx5/inputmethod"
106
install -d "${PREFIX}/lib/fcitx5"
107
../scripts/install_fcitx5
108
}
109
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 00:19:57 | Low | 3 |
| 2026-08-30 00:04:14 | Low | 3 |
| 2026-08-29 00:29:17 | Low | 3 |