jami-qt-git

maintainer a_i · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a git checkout from the project's own official domain (git.jami.net), which is a normal and trusted practice for AUR packages; the non-whitelisted host is the project's own infrastructure, and building from upstream git is expected for a -git package.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git checkout from the project's own official domain (git.jami.net), which is a normal and trusted practice for AUR packages; the non-whitelisted host is the project's own infrastructure, and building from upstream git is expected for a -git package.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:48 "${_pkgname}::git+https://git.jami.net/savoirfairelinux/jami-client-qt.git"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alex Indigo <ai at aegis dot one>
    
      2# Contributor: Alex Indigo <ai at aegis dot one>
    
      3
    
      4pkgname=jami-qt-git
    
      5_pkgname=jami-client-qt
    
      6_release_ver=20260707.0
    
      7pkgver=20260717.0.r17.g2e34c0bb
    
      8pkgrel=2
    
      9pkgdesc="Free and universal communication platform which preserves the users' privacy and freedoms (Qt client, built from upstream git)"
    
      10arch=('x86_64')
    
      11url="https://jami.net"
    
      12license=('GPL-3.0-or-later')
    
      13groups=('jami')
    
      14
    
      15depends=(
    
      16    'jami-daemon'
    
      17    'glib2'
    
      18    'gdk-pixbuf2'
    
      19    'libnm'
    
      20    'libnotify'
    
      21    'qt6-declarative'
    
      22    'qt6-multimedia'
    
      23    'qt6-svg'
    
      24    'qt6-5compat'
    
      25    'qt6-webengine'
    
      26    'qt6-httpserver'
    
      27    'qt6-webchannel'
    
      28    'qt6-shadertools'
    
      29    'hunspell'
    
      30    'tidy'
    
      31    'md4c'
    
      32    'qwindowkit'
    
      33    'zxing-cpp'
    
      34)
    
      35makedepends=(
    
      36    'cmake'
    
      37    'git'
    
      38    'python'
    
      39    'qt6-tools'
    
      40    'qt6-networkauth'
    
      41)
    
      42
    
      43provides=('jami-qt' 'jami-client-qt')
    
      44conflicts=('jami-qt' 'jami-client-qt')
    
      45replaces=('jami-qt')
    
      46
    
      47source=(
    
      48    "${_pkgname}::git+https://git.jami.net/savoirfairelinux/jami-client-qt.git"
    
      49    'zxing-cpp-3.patch'
    
      50    'fix-link.patch'
    
      51    'fix-valuefilter-invert.patch'
    
      52)
    
      53sha256sums=(
    
      54    'SKIP'
    
      55    '0b26f155c94f91a0c541879698f2d1b14544036685267e7367f6523dacd8a91f'
    
      56    'ce15c9c4ed91768cbd75bf7bd0fa904f553a12da32c17b700d85fdd8c8cbedce'
    
      57    '44ab7cfbf1c3b58a118e4852227d86f08f28d5636d3d6a0e4f966e87535a80b0'
    
      58)
    
      59
    
      60pkgver() {
    
      61    cd "${srcdir}/${_pkgname}"
    
      62    git describe --long --tags --match 'stable/*' --always 2>/dev/null \
    
      63        | sed 's/^stable\///;s/\([^-]*-g\)/r\1/;s/-/./g' \
    
      64        || echo "${_release_ver}.r0.g$(git rev-parse --short HEAD)"
    
      65}
    
      66
    
      67prepare() {
    
      68    cd "${srcdir}/${_pkgname}"
    
      69    # Init 3rdparty submodules only (skip daemon submodule — use system jami-daemon)
    
      70    git submodule update --init --recursive -- 3rdparty
    
      71
    
      72    # Fix build against system zxing-cpp 3.x — upstream uses unqualified
    
      73    # #include <BitMatrix.h> etc., zxing-cpp 3 ships headers under ZXing/.
    
      74    # (Same patch Arch's extra/jami-qt uses.)
    
      75    patch -p1 < "${srcdir}/zxing-cpp-3.patch"
    
      76
    
      77    # Add explicit avutil to the link line — with binutils --as-needed,
    
      78    # transitively-used libavutil (via libjami) isn't pulled in unless named.
    
      79    # (Same patch Arch's extra/jami-qt uses.)
    
      80    patch -p1 < "${srcdir}/fix-link.patch"
    
      81
    
      82    # Fix ValueFilter QML property typo: invert -> inverted.
    
      83    # Qt 6.10+ ships native SortFilterProxyModel / ValueFilter (QtQml.Models);
    
      84    # the invertible bool is 'inverted' on QQmlFilterBase, not 'invert'. Upstream
    
      85    # jami-client-qt uses the wrong name in 5 places (AccountComboBox.qml:101,
    
      86    # LinkedDevicesBase.qml:100, VideoSettingsPage.qml:161/198/229) → SidePanel
    
      87    # and settings dialogs fail to load on modern Qt.
    
      88    patch -p1 < "${srcdir}/fix-valuefilter-invert.patch"
    
      89}
    
      90
    
      91build() {
    
      92    cmake -B build -S "${srcdir}/${_pkgname}" \
    
      93        -DCMAKE_INSTALL_PREFIX=/usr \
    
      94        -DCMAKE_BUILD_TYPE=None \
    
      95        -DENABLE_LIBWRAP=ON \
    
      96        -DJAMICORE_AS_SUBDIR=OFF \
    
      97        -DWITH_DAEMON_SUBMODULE=OFF \
    
      98        -Wno-dev
    
      99    make -C build VERBOSE=1
    
      100}
    
      101
    
      102package() {
    
      103    make -C build DESTDIR="${pkgdir}" install
    
      104}
    
      105

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,8 +4,8 @@
 pkgname=jami-qt-git
 _pkgname=jami-client-qt
 _release_ver=20260707.0
-pkgver="${_release_ver}.r0.g0000000"
-pkgrel=1
+pkgver=20260717.0.r17.g2e34c0bb
+pkgrel=2
 pkgdesc="Free and universal communication platform which preserves the users' privacy and freedoms (Qt client, built from upstream git)"
 arch=('x86_64')
 url="https://jami.net"
@@ -59,7 +59,7 @@
 
 pkgver() {
     cd "${srcdir}/${_pkgname}"
-    git describe --long --tags --always 2>/dev/null \
+    git describe --long --tags --match 'stable/*' --always 2>/dev/null \
         | sed 's/^stable\///;s/\([^-]*-g\)/r\1/;s/-/./g' \
         || echo "${_release_ver}.r0.g$(git rev-parse --short HEAD)"
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 07:37:32	MEDIUM	1
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3