lasso (MEDIUM) - AURWatch

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://dev.entrouvert.org/releases/${pkgname}/${pkgname}-${pkgver}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nikola Ivačič <nikola.ivacic@dropchop.com>
    
      2# Maintainer: Dan Fuhry <dan@fuhry.com>
    
      3# vim: set ts=2 sw=2 et:
    
      4### I AM ONLY THE PACKAGER, NOT THE DEVELOPER
    
      5### Please ask support questions about this software in one of:
    
      6###   1) The AUR comments; OR
    
      7###   2) Upstream forums/maillist etc; OR
    
      8###   3) The ArchLinux forums
    
      9### I do not always know enough about the software itself, or don't have the
    
      10### time to promptly respond to direct emails.
    
      11### If you have found a problem with the package/PKGBUILD (as opposed to
    
      12### the software) then please do email me or post an AUR comment.
    
      13
    
      14pkgname=lasso
    
      15pkgver=2.9.0
    
      16pkgrel=1
    
      17pkgdesc="Lasso is a free software C library aiming to implement the Liberty Alliance standards. ID-WSF and SAML 2.0."
    
      18arch=('i686' 'x86_64')
    
      19url="http://lasso.entrouvert.org/"
    
      20license=('GNU')
    
      21depends=('libxml2' 'xmlsec' 'openssl' 'glib2' 'python>=3.14.0' 'python<3.15' 'perl>=5.44.0' 'perl<5.45.0')
    
      22makedepends=('perl' 'python-six')
    
      23source=("https://dev.entrouvert.org/releases/${pkgname}/${pkgname}-${pkgver}.tar.gz")
    
      24sha512sums=('e195502ce41612c6b46280653b393220736bb629d41f81d6b399b21c6e08b22cdbb56430c152870dfba161b2dd00f08c30069507fdc38ed94846e84a11fdf4f3')
    
      25
    
      26prepare() {
    
      27  for f in "${source[@]}"; do
    
      28    if test "${f%.patch}" != "${f}"; then
    
      29      msg "Applying patch: $f"
    
      30      cd "${srcdir}/${pkgname}-${pkgver}"
    
      31      patch -Np1 -i "${srcdir}/${f}"
    
      32    fi
    
      33  done
    
      34}
    
      35
    
      36build() {
    
      37  cd "${pkgname}-${pkgver}"
    
      38  ./configure --prefix=/usr --disable-tests
    
      39  make CFLAGS="-g -O2 -w" CXXFLAGS="${CFLAGS}"
    
      40}
    
      41
    
      42package() {
    
      43  cd "${pkgname}"-"${pkgver}"
    
      44  make DESTDIR="${pkgdir}" install
    
      45  install -Dm644 README  "${pkgdir}"/usr/share/licenses/"${pkgname}"/LICENSE
    
      46}
    
      47

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-19 13:25
@@ -12,20 +12,16 @@
 ### the software) then please do email me or post an AUR comment.
 
 pkgname=lasso
-pkgver=2.8.2
-pkgrel=3
+pkgver=2.9.0
+pkgrel=1
 pkgdesc="Lasso is a free software C library aiming to implement the Liberty Alliance standards. ID-WSF and SAML 2.0."
 arch=('i686' 'x86_64')
 url="http://lasso.entrouvert.org/"
 license=('GNU')
-depends=('libxml2' 'xmlsec' 'openssl')
+depends=('libxml2' 'xmlsec' 'openssl' 'glib2' 'python>=3.14.0' 'python<3.15' 'perl>=5.44.0' 'perl<5.45.0')
 makedepends=('perl' 'python-six')
-source=("https://dev.entrouvert.org/releases/${pkgname}/${pkgname}-${pkgver}.tar.gz"
-        "0001-stop-using-deprecated-symbols.patch"
-        "0002-libxml-2.12-compat.patch")
-sha512sums=('f56b5fef68fd1e6025a7cfb0f84d65be9ddf195f0e80d38d60c31d43fcd4377be5a0d67140bc654c224331230f06c10e4eb498671a10ebfadc1d93decadf4c72'
-            '283000ee20a14efd42e65ed6d6c0358889e3aab54095c68caf7f10b15adc55a050c452c8b10a0dd8c750927b6971f182b044558ae3f426018363b55e73852d81'
-            'cba8551b9bae428bd9c779a657d0898bfca8a0a649f394009a41538e3b9d975be8d4f5c2a7cfacf1023561132302428404fe290941124c8b77d650b607ce4547')
+source=("https://dev.entrouvert.org/releases/${pkgname}/${pkgname}-${pkgver}.tar.gz")
+sha512sums=('e195502ce41612c6b46280653b393220736bb629d41f81d6b399b21c6e08b22cdbb56430c152870dfba161b2dd00f08c30069507fdc38ed94846e84a11fdf4f3')
 
 prepare() {
   for f in "${source[@]}"; do

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 13:25:12	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1