libcurl3-gnutls

MEDIUM

maintainer fredericva 2 votes scanned 2026-08-26 15:30:31.793073

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://curl.haxx.se/download/curl-${pkgver}.tar.gz"{,.asc}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Frederic Van Assche <frederic@fredericva.com>
    
      2# Adapted from package by: Maxime Gauduin <alucryd@archlinux.org>
    
      3# Patch by: Alessandro Ghedini <ghedo@debian.org>
    
      4
    
      5pkgname=libcurl3-gnutls
    
      6pkgver=8.21.0
    
      7pkgrel=0
    
      8pkgdesc='An URL retrieval library (linked against gnutls) with libcurl3 versioned symbols'
    
      9arch=('x86_64')
    
      10url='https://curl.haxx.se'
    
      11license=('MIT')
    
      12depends=('curl' 'glibc' 'gnutls' 'libpsl' 'nettle' 'zlib'
    
      13         'libssh2.so')
    
      14options=('strip')
    
      15conflicts=('libcurl-gnutls')
    
      16provides=('libcurl-gnutls')
    
      17source=("https://curl.haxx.se/download/curl-${pkgver}.tar.gz"{,.asc}
    
      18        03_keep_symbols_compat.patch)
    
      19validpgpkeys=('27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2') # Daniel Stenberg
    
      20sha512sums=('1a1c88d7e52200d0a8879f61868accd7eb7edacb730e09db8e1f741535e9906005c897c2ce39b562c20e1b3ef2c84512f5b4fda9aa50c67e2364c473d15a1f65'
    
      21            'SKIP'
    
      22            'f6c02cdfe593c07be00e783ff9dc972748079f80faee4de96a1b7ebad79e984e1c86584c8235f5553c5d53d6487552c6857b430125c8505924a2d18683b091f2')
    
      23
    
      24prepare() {
    
      25  cd curl-${pkgver}
    
      26
    
      27  patch -p1 < ${srcdir}/03_keep_symbols_compat.patch
    
      28}
    
      29
    
      30build() {
    
      31  cd curl-${pkgver}
    
      32
    
      33  ./configure \
    
      34    --prefix='/usr' \
    
      35    --disable-ldap \
    
      36    --disable-ldaps \
    
      37    --disable-manual \
    
      38    --enable-versioned-symbols \
    
      39    --enable-ipv6 \
    
      40    --enable-threaded-resolver \
    
      41    --without-gssapi \
    
      42    --with-libssh2 \
    
      43    --without-libidn \
    
      44    --with-gnutls='/usr' \
    
      45    --with-random='/dev/urandom' \
    
      46    --with-ca-bundle='/etc/ssl/certs/ca-certificates.crt'
    
      47
    
      48  make -C lib
    
      49}
    
      50
    
      51package() {
    
      52  cd curl-${pkgver}
    
      53
    
      54  make -C lib DESTDIR="${pkgdir}" install
    
      55
    
      56  mv "${pkgdir}"/usr/lib/libcurl{,-gnutls}.so.4.8.0
    
      57  rm "${pkgdir}"/usr/lib/libcurl.{a,so}*
    
      58  for version in 3 4 4.0.0 4.1.0 4.2.0 4.3.0 4.4.0 4.5.0 4.6.0 4.7.0; do
    
      59    ln -s libcurl-gnutls.so.4.8.0 "${pkgdir}"/usr/lib/libcurl-gnutls.so.${version}
    
      60  done
    
      61
    
      62  install -dm 755 "${pkgdir}"/usr/share/licenses
    
      63  ln -s curl "${pkgdir}"/usr/share/licenses/libcurl-gnutls
    
      64}
    
      65
    
      66# vim: ts=2 sw=2 et:
    
      67

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-26 15:30
@@ -3,7 +3,7 @@
 # Patch by: Alessandro Ghedini <ghedo@debian.org>
 
 pkgname=libcurl3-gnutls
-pkgver=8.4.0
+pkgver=8.21.0
 pkgrel=0
 pkgdesc='An URL retrieval library (linked against gnutls) with libcurl3 versioned symbols'
 arch=('x86_64')
@@ -17,9 +17,9 @@
 source=("https://curl.haxx.se/download/curl-${pkgver}.tar.gz"{,.asc}
         03_keep_symbols_compat.patch)
 validpgpkeys=('27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2') # Daniel Stenberg
-sha512sums=('375d241effccde852cfba32aa61be406f6c6e8ef2773b48d57bfa1ff99fdf414dc08bdb6b3a65930e53b28e31246a4bc396c81054ae9c560a3bf58cca0ae78b0'
+sha512sums=('1a1c88d7e52200d0a8879f61868accd7eb7edacb730e09db8e1f741535e9906005c897c2ce39b562c20e1b3ef2c84512f5b4fda9aa50c67e2364c473d15a1f65'
             'SKIP'
-            '596c227bb5ede8182831c5c92b3ac7b74b770f51fae99277e2aabb02d38b7a5d4d06003731042ab5403ca89e719827d7080c3a179e29ef08b41a1993a7788a33')
+            'f6c02cdfe593c07be00e783ff9dc972748079f80faee4de96a1b7ebad79e984e1c86584c8235f5553c5d53d6487552c6857b430125c8505924a2d18683b091f2')
 
 prepare() {
   cd curl-${pkgver}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 15:30:31	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1