gpgfrontend

maintainer yochananmarqos · 10 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a git repository from a project-owned but non-standard domain; building from source is normal for AUR, and no unverifiable prebuilt binaries or malicious payloads are involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from a project-owned but non-standard domain; building from source is normal for AUR, and no unverifiable prebuilt binaries or malicious payloads are involved.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 'git+https://git.bktus.com/GpgFrontend/vmime.git')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      2# Contributor: Konsonanz <maximilian.lehmann@protonmail.com>
    
      3pkgname=gpgfrontend
    
      4_app_id="com.bktus.$pkgname"
    
      5pkgver=2.2.1
    
      6pkgrel=1
    
      7pkgdesc="A modern OpenPGP tool with a unique dual-engine core"
    
      8arch=('x86_64')
    
      9url="https://gpgfrontend.bktus.com"
    
      10license=('GPL-3.0-or-later')
    
      11depends=(
    
      12  'gpgme'
    
      13  'gtest'
    
      14  'hicolor-icon-theme'
    
      15  'icu'
    
      16  'libarchive'
    
      17  'libsodium'
    
      18  'qt6-base'
    
      19)
    
      20makedepends=(
    
      21  'cargo'
    
      22  'cmake'
    
      23  'desktop-file-utils'
    
      24  'git'
    
      25  'ninja'
    
      26  'python'
    
      27  'qt6-tools'
    
      28)
    
      29checkdepends=('appstream')
    
      30source=("git+https://github.com/saturneric/GpgFrontend#tag=v$pkgver"
    
      31        'git+https://github.com/qt/qttranslations.git'
    
      32        'git+https://github.com/saturneric/GpgFrontend-Modules.git'
    
      33        'git+https://github.com/gpg/gpgme.git'
    
      34        'git+https://github.com/gpg/libassuan.git'
    
      35        'git+https://github.com/gpg/libgpg-error.git'
    
      36        'git+https://github.com/corrosion-rs/corrosion.git'
    
      37        'git+https://git.bktus.com/GpgFrontend/vmime.git')
    
      38sha256sums=('ea33871fb7adf546402299e698e128ca807477a1f24207052d43ca6c2d0cf7f6'
    
      39            'SKIP'
    
      40            'SKIP'
    
      41            'SKIP'
    
      42            'SKIP'
    
      43            'SKIP'
    
      44            'SKIP'
    
      45            'SKIP')
    
      46
    
      47prepare() {
    
      48  cd GpgFrontend
    
      49  git submodule init
    
      50  git config submodule.third_party/qttranslations.url "$srcdir/qttranslations"
    
      51  git config submodule.modules.url "$srcdir/GpgFrontend-Modules"
    
      52  git config submodule.third_party/gpgme.url "$srcdir/gpgme"
    
      53  git config submodule.third_party/libassuan.url "$srcdir/libassuan"
    
      54  git config submodule.third_party/libgpg-error.url "$srcdir/libgpg-error"
    
      55  git config submodule.third_party/corrosion.url "$srcdir/corrosion"
    
      56  git -c protocol.file.allow=always submodule update
    
      57
    
      58  pushd modules
    
      59  git submodule init
    
      60  git config submodule.src/m_email/vmime.url "$srcdir/vmime"
    
      61  git -c protocol.file.allow=always submodule update
    
      62  popd
    
      63
    
      64  pushd rust
    
      65  export RUSTUP_TOOLCHAIN=stable
    
      66  cargo fetch --target host-tuple
    
      67  popd
    
      68
    
      69  # Correct StartupWMClass
    
      70  desktop-file-edit --set-key=StartupWMClass --set-value="$pkgname" \
    
      71    "resource/appstream/${_app_id}.desktop"
    
      72}
    
      73
    
      74build() {
    
      75  export RUSTUP_TOOLCHAIN=stable
    
      76  local cmake_options=(
    
      77    -B build
    
      78    -S GpgFrontend
    
      79    -G Ninja
    
      80    -W no-author
    
      81    -D CMAKE_BUILD_TYPE='RelWithDebInfo'
    
      82    -D CMAKE_INSTALL_PREFIX='/usr'
    
      83    -D GPGFRONTEND_BUILD_APP_FOR_PACKAGE='ON'
    
      84    -D GPGFRONTEND_BUILD_STRIP_RPATH='ON'
    
      85  )
    
      86  cmake "${cmake_options[@]}"
    
      87  cmake --build build
    
      88}
    
      89
    
      90check() {
    
      91  cd GpgFrontend
    
      92  appstreamcli validate --no-net "resource/appstream/${_app_id}.metainfo.xml"
    
      93  desktop-file-validate "resource/appstream/${_app_id}.desktop"
    
      94}
    
      95
    
      96package() {
    
      97  DESTDIR="$pkgdir" cmake --install build
    
      98
    
      99  # Remove duplicate license & stray icons
    
      100  rm -rv "$pkgdir/usr/share/licenses/"
    
      101  rm -v "$pkgdir"/usr/{"${_app_id}.png",.DirIcon}
    
      102}
    
      103

Changes since previous scan

--- PKGBUILD @ 2026-07-23 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,23 +2,23 @@
 # Contributor: Konsonanz <maximilian.lehmann@protonmail.com>
 pkgname=gpgfrontend
 _app_id="com.bktus.$pkgname"
-pkgver=2.1.12
+pkgver=2.2.1
 pkgrel=1
-pkgdesc="An exceptional GUI frontend for the modern GnuPG (gpg)"
+pkgdesc="A modern OpenPGP tool with a unique dual-engine core"
 arch=('x86_64')
 url="https://gpgfrontend.bktus.com"
 license=('GPL-3.0-or-later')
 depends=(
-  'argon2'
   'gpgme'
   'gtest'
   'hicolor-icon-theme'
   'icu'
   'libarchive'
-  'openssl'
+  'libsodium'
   'qt6-base'
 )
 makedepends=(
+  'cargo'
   'cmake'
   'desktop-file-utils'
   'git'
@@ -29,12 +29,14 @@
 checkdepends=('appstream')
 source=("git+https://github.com/saturneric/GpgFrontend#tag=v$pkgver"
         'git+https://github.com/qt/qttranslations.git'
-        'git+https://git.bktus.com/gpgfrontend/modules.git'
-        'git+https://git.bktus.com/gpgfrontend/gpgme.git'
-        'git+https://git.bktus.com/gpgfrontend/libassuan.git'
-        'git+https://git.bktus.com/gpgfrontend/libgpg-error.git'
-        'git+https://git.bktus.com/gpgfrontend/vmime.git')
-sha256sums=('21852208c66aa993b05cbe303f29b7797cd6447e4f8ec999a26f392a2bff11ee'
+        'git+https://github.com/saturneric/GpgFrontend-Modules.git'
+        'git+https://github.com/gpg/gpgme.git'
+        'git+https://github.com/gpg/libassuan.git'
+        'git+https://github.com/gpg/libgpg-error.git'
+        'git+https://github.com/corrosion-rs/corrosion.git'
+        'git+https://git.bktus.com/GpgFrontend/vmime.git')
+sha256sums=('ea33871fb7adf546402299e698e128ca807477a1f24207052d43ca6c2d0cf7f6'
+            'SKIP'
             'SKIP'
             'SKIP'
             'SKIP'
@@ -46,10 +48,11 @@
   cd GpgFrontend
   git submodule init
   git config submodule.third_party/qttranslations.url "$srcdir/qttranslations"
-  git config submodule.modules.url "$srcdir/modules"
+  git config submodule.modules.url "$srcdir/GpgFrontend-Modules"
   git config submodule.third_party/gpgme.url "$srcdir/gpgme"
   git config submodule.third_party/libassuan.url "$srcdir/libassuan"
   git config submodule.third_party/libgpg-error.url "$srcdir/libgpg-error"
+  git config submodule.third_party/corrosion.url "$srcdir/corrosion"
   git -c protocol.file.allow=always submodule update
 
   pushd modules
@@ -58,17 +61,23 @@
   git -c protocol.file.allow=always submodule update
   popd
 
+  pushd rust
+  export RUSTUP_TOOLCHAIN=stable
+  cargo fetch --target host-tuple
+  popd
+
   # Correct StartupWMClass
   desktop-file-edit --set-key=StartupWMClass --set-value="$pkgname" \
     "resource/appstream/${_app_id}.desktop"
 }
 
 build() {
+  export RUSTUP_TOOLCHAIN=stable
   local cmake_options=(
     -B build
     -S GpgFrontend
     -G Ninja
-    -W no-dev
+    -W no-author
     -D CMAKE_BUILD_TYPE='RelWithDebInfo'
     -D CMAKE_INSTALL_PREFIX='/usr'
     -D GPGFRONTEND_BUILD_APP_FOR_PACKAGE='ON'
@@ -87,7 +96,8 @@
 package() {
   DESTDIR="$pkgdir" cmake --install build
 
-  # Remove duplicate license
-  rm -r "$pkgdir/usr/share/licenses/"
+  # Remove duplicate license & stray icons
+  rm -rv "$pkgdir/usr/share/licenses/"
+  rm -v "$pkgdir"/usr/{"${_app_id}.png",.DirIcon}
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 21:26:05	MEDIUM	1
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2