gpgfrontend

LOW

maintainer yochananmarqos 9 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The source uses git repositories, including one from a non-standard host (git.bktus.com), but all sources are version-controlled code repositories used to build the software from source, not prebuilt executables; the worst case of a swapped source would be building malicious code, but this is mitigated by the tag-based checkout and the project's own infrastructure, making it a normal AUR build pattern with low risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source uses git repositories, including one from a non-standard host (git.bktus.com), but all sources are version-controlled code repositories used to build the software from source, not prebuilt executables; the worst case of a swapped source would be building malicious code, but this is mitigated by the tag-based checkout and the project's own infrastructure, making it a normal AUR build pattern with low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:43 'git+https://git.bktus.com/gpgfrontend/vmime.git')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      2# Contributor: Konsonanz <maximilian.lehmann@protonmail.com>
    
      3pkgname=gpgfrontend
    
      4_app_id="com.bktus.$pkgname"
    
      5pkgver=2.2.4
    
      6pkgrel=1
    
      7pkgdesc="A modern OpenPGP tool with a unique dual-engine core"
    
      8arch=('x86_64')
    
      9url="https://gpgfrontend.bktus.com"
    
      10license=('GPL-3.0-or-later')
    
      11depends=(
    
      12  'gpgme'
    
      13  'gtest'
    
      14  'hicolor-icon-theme'
    
      15  'icu'
    
      16  'libarchive'
    
      17  'libgcc'
    
      18  'libgpg-error'
    
      19  'libsecret'
    
      20  'libsodium'
    
      21  'libstdc++'
    
      22  'openssl'
    
      23  'qt6-base'
    
      24)
    
      25makedepends=(
    
      26  'cargo'
    
      27  'cmake'
    
      28  'desktop-file-utils'
    
      29  'git'
    
      30  'ninja'
    
      31  'python'
    
      32  'qt6-tools'
    
      33)
    
      34checkdepends=('appstream')
    
      35source=("git+https://github.com/saturneric/GpgFrontend#tag=v$pkgver"
    
      36        'git+https://github.com/qt/qttranslations.git'
    
      37        'git+https://github.com/saturneric/GpgFrontend-Modules.git'
    
      38        'git+https://github.com/gpg/gpgme.git'
    
      39        'git+https://github.com/gpg/libassuan.git'
    
      40        'git+https://github.com/gpg/libgpg-error.git'
    
      41        'git+https://github.com/corrosion-rs/corrosion.git'
    
      42        'git+https://github.com/lua/lua.git'
    
      43        'git+https://git.bktus.com/gpgfrontend/vmime.git')
    
      44sha256sums=('eb30b8a7e497d717daeca9550f2accc257496f2824b139415a8cec22fe97f16c'
    
      45            'SKIP'
    
      46            'SKIP'
    
      47            'SKIP'
    
      48            'SKIP'
    
      49            'SKIP'
    
      50            'SKIP'
    
      51            'SKIP'
    
      52            'SKIP')
    
      53
    
      54prepare() {
    
      55  cd GpgFrontend
    
      56  git submodule init
    
      57  git config submodule.third_party/qttranslations.url "$srcdir/qttranslations"
    
      58  git config submodule.modules.url "$srcdir/GpgFrontend-Modules"
    
      59  git config submodule.third_party/gpgme.url "$srcdir/gpgme"
    
      60  git config submodule.third_party/libassuan.url "$srcdir/libassuan"
    
      61  git config submodule.third_party/libgpg-error.url "$srcdir/libgpg-error"
    
      62  git config submodule.third_party/corrosion.url "$srcdir/corrosion"
    
      63  git config submodule.third_party/lua.url "$srcdir/lua"
    
      64  git -c protocol.file.allow=always submodule update
    
      65
    
      66  pushd modules
    
      67  git submodule init
    
      68  git config submodule.src/m_email/vmime.url "$srcdir/vmime"
    
      69  git -c protocol.file.allow=always submodule update
    
      70  popd
    
      71
    
      72  export RUSTUP_TOOLCHAIN=stable
    
      73  cargo fetch --manifest-path rust/Cargo.toml --target host-tuple
    
      74
    
      75  # Correct StartupWMClass
    
      76  desktop-file-edit --set-key=StartupWMClass --set-value="$pkgname" \
    
      77    "resource/appstream/${_app_id}.desktop"
    
      78}
    
      79
    
      80build() {
    
      81  export RUSTUP_TOOLCHAIN=stable
    
      82  export CARGO_PROFILE_RELEASE_LTO=true
    
      83  export CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1
    
      84  local cmake_options=(
    
      85    -B build
    
      86    -S GpgFrontend
    
      87    -G Ninja
    
      88    -W no-author
    
      89    -D CMAKE_BUILD_TYPE='RelWithDebInfo'
    
      90    -D CMAKE_INSTALL_PREFIX='/usr'
    
      91    -D GPGFRONTEND_BUILD_MODE='release'
    
      92    -D GPGFRONTEND_BUILD_STABLE='ON'
    
      93    -D GPGFRONTEND_BUILD_APP_FOR_PACKAGE='ON'
    
      94    -D GPGFRONTEND_BUILD_STRIP_RPATH='ON'
    
      95    -D GPGFRONTEND_LINK_GPGME_INTO_CORE='OFF'
    
      96  )
    
      97  cmake "${cmake_options[@]}"
    
      98  cmake --build build
    
      99}
    
      100
    
      101check() {
    
      102  cd GpgFrontend
    
      103  appstreamcli validate --no-net "resource/appstream/${_app_id}.metainfo.xml"
    
      104  desktop-file-validate "resource/appstream/${_app_id}.desktop"
    
      105}
    
      106
    
      107package() {
    
      108  DESTDIR="$pkgdir" cmake --install build
    
      109
    
      110  # Remove duplicate license
    
      111  rm -vf "$pkgdir/usr/share/licenses/$pkgname/COPYING"
    
      112}
    
      113

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
 # Contributor: Konsonanz <maximilian.lehmann@protonmail.com>
 pkgname=gpgfrontend
 _app_id="com.bktus.$pkgname"
-pkgver=2.2.3
+pkgver=2.2.4
 pkgrel=1
 pkgdesc="A modern OpenPGP tool with a unique dual-engine core"
 arch=('x86_64')
@@ -41,7 +41,7 @@
         'git+https://github.com/corrosion-rs/corrosion.git'
         'git+https://github.com/lua/lua.git'
         'git+https://git.bktus.com/gpgfrontend/vmime.git')
-sha256sums=('be07ff4822037940fbc608aba9225ef2c904cca27fe2300f679688585f647a6e'
+sha256sums=('eb30b8a7e497d717daeca9550f2accc257496f2824b139415a8cec22fe97f16c'
             'SKIP'
             'SKIP'
             'SKIP'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 19:53:24	Medium	1
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 17:43:03	Medium	1
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2