gpgfrontend

LOW

maintainer yochananmarqos 10 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source uses a git checkout from GitHub and a submodule from a non-whitelisted host, but it is part of the project's own build process; the worst case of a swapped host is limited to supply-chain risk in an otherwise standard open-source build, with no execution of prebuilt binaries or obfuscated payloads.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source uses a git checkout from GitHub and a submodule from a non-whitelisted host, but it is part of the project's own build process; the worst case of a swapped host is limited to supply-chain risk in an otherwise standard open-source build, with no execution of prebuilt binaries or obfuscated payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 'git+https://git.bktus.com/gpgfrontend/vmime.git')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      2# Contributor: Konsonanz <maximilian.lehmann@protonmail.com>
    
      3pkgname=gpgfrontend
    
      4_app_id="com.bktus.$pkgname"
    
      5pkgver=2.2.2
    
      6pkgrel=1
    
      7pkgdesc="A modern OpenPGP tool with a unique dual-engine core"
    
      8arch=('x86_64')
    
      9url="https://gpgfrontend.bktus.com"
    
      10license=('GPL-3.0-or-later')
    
      11depends=(
    
      12  'gpgme'
    
      13  'gtest'
    
      14  'hicolor-icon-theme'
    
      15  'icu'
    
      16  'libarchive'
    
      17  'libsecret'
    
      18  'libsodium'
    
      19  'qt6-base'
    
      20)
    
      21makedepends=(
    
      22  'cargo'
    
      23  'cmake'
    
      24  'desktop-file-utils'
    
      25  'git'
    
      26  'ninja'
    
      27  'python'
    
      28  'qt6-tools'
    
      29)
    
      30checkdepends=('appstream')
    
      31source=("git+https://github.com/saturneric/GpgFrontend#tag=v$pkgver"
    
      32        'git+https://github.com/qt/qttranslations.git'
    
      33        'git+https://github.com/saturneric/GpgFrontend-Modules.git'
    
      34        'git+https://github.com/gpg/gpgme.git'
    
      35        'git+https://github.com/gpg/libassuan.git'
    
      36        'git+https://github.com/gpg/libgpg-error.git'
    
      37        'git+https://github.com/corrosion-rs/corrosion.git'
    
      38        'git+https://git.bktus.com/gpgfrontend/vmime.git')
    
      39sha256sums=('4791349d0b9cbbd41c3da8ebb1383ea7e7d0807d8132985386813efc60b67a5f'
    
      40            'SKIP'
    
      41            'SKIP'
    
      42            'SKIP'
    
      43            'SKIP'
    
      44            'SKIP'
    
      45            'SKIP'
    
      46            'SKIP')
    
      47
    
      48prepare() {
    
      49  cd GpgFrontend
    
      50  git submodule init
    
      51  git config submodule.third_party/qttranslations.url "$srcdir/qttranslations"
    
      52  git config submodule.modules.url "$srcdir/GpgFrontend-Modules"
    
      53  git config submodule.third_party/gpgme.url "$srcdir/gpgme"
    
      54  git config submodule.third_party/libassuan.url "$srcdir/libassuan"
    
      55  git config submodule.third_party/libgpg-error.url "$srcdir/libgpg-error"
    
      56  git config submodule.third_party/corrosion.url "$srcdir/corrosion"
    
      57  git -c protocol.file.allow=always submodule update
    
      58
    
      59  pushd modules
    
      60  git submodule init
    
      61  git config submodule.src/m_email/vmime.url "$srcdir/vmime"
    
      62  git -c protocol.file.allow=always submodule update
    
      63  popd
    
      64
    
      65  export RUSTUP_TOOLCHAIN=stable
    
      66  cargo fetch --manifest-path rust/Cargo.toml --target host-tuple
    
      67
    
      68  # Correct StartupWMClass
    
      69  desktop-file-edit --set-key=StartupWMClass --set-value="$pkgname" \
    
      70    "resource/appstream/${_app_id}.desktop"
    
      71}
    
      72
    
      73build() {
    
      74  export RUSTUP_TOOLCHAIN=stable
    
      75  local cmake_options=(
    
      76    -B build
    
      77    -S GpgFrontend
    
      78    -G Ninja
    
      79    -W no-author
    
      80    -D CMAKE_BUILD_TYPE='RelWithDebInfo'
    
      81    -D CMAKE_INSTALL_PREFIX='/usr'
    
      82    -D GPGFRONTEND_BUILD_STABLE='ON'
    
      83    -D GPGFRONTEND_BUILD_APP_FOR_PACKAGE='ON'
    
      84    -D GPGFRONTEND_BUILD_STRIP_RPATH='ON'
    
      85  )
    
      86  cmake "${cmake_options[@]}"
    
      87  cmake --build build
    
      88}
    
      89
    
      90check() {
    
      91  cd GpgFrontend
    
      92  appstreamcli validate --no-net "resource/appstream/${_app_id}.metainfo.xml"
    
      93  desktop-file-validate "resource/appstream/${_app_id}.desktop"
    
      94}
    
      95
    
      96package() {
    
      97  DESTDIR="$pkgdir" cmake --install build
    
      98
    
      99  # Remove duplicate license & stray icons
    
      100  rm -rv "$pkgdir/usr/share/licenses/"
    
      101  rm -v "$pkgdir"/usr/{"${_app_id}.png",.DirIcon}
    
      102}
    
      103

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2