libgourou-utils

LOW

maintainer raxod502 17 votes base libgourou scanned 2026-10-20 00:10:31.152894

View on AUR

Why flagged

The package builds from source hosted on the project's own forge, which is plausibly legitimate despite not being on a standard platform; the external cookie fetch is part of accessing a legitimately required resource from the same domain and does not introduce untrusted code execution; the orphaned/re-adopted status does not affect package safety.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from source hosted on the project's own forge, which is plausibly legitimate despite not being on a standard platform; the external cookie fetch is part of accessing a legitimately required resource from the same domain and does not introduce untrusted code execution; the orphaned/re-adopted status does not affect package safety.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 _cookie=$(curl -s https://forge.soutade.fr/402.html | sed -nE 's/.*document\.cookie = "([^;"]*).*/\1/p')

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("libgourou-$pkgver.tar.gz::https://forge.soutade.fr/soutade/libgourou/archive/v$pkgver.tar.gz")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Radon Rosborough <radon@radian.codes>
    
      2# Maintainer: Ketchup901 <ketchup901@riseup.net>
    
      3
    
      4pkgbase="libgourou"
    
      5pkgname=("libgourou" "libgourou-utils")
    
      6pkgver=0.8.10
    
      7pkgrel=4
    
      8pkgdesc="Free implementation of Adobe's ADEPT protocol used to add DRM on EPUB/PDF files"
    
      9arch=('any')
    
      10license=('LGPL-3.0-or-later' 'BSD-3-Clause')
    
      11url="https://forge.soutade.fr/soutade/libgourou"
    
      12depends=(
    
      13    'updfparser'
    
      14    'glibc'
    
      15    'libgcc'
    
      16    'libstdc++'
    
      17    'pugixml'
    
      18    'zlib'
    
      19    'libzip'
    
      20    'openssl'
    
      21    'curl'
    
      22)
    
      23conflicts=('gourou-git' 'gourou-bin' 'gourou-appimage')
    
      24source=("libgourou-$pkgver.tar.gz::https://forge.soutade.fr/soutade/libgourou/archive/v$pkgver.tar.gz")
    
      25sha512sums=('bf9c4341f45b1fe77a9c95b5844da7ac5cc96b0edf7ef39caf11b980e82765f6a7c5932aaee998df002b965215cd7fbae2606dbbb86da12f88eafa830e7c5c14')
    
      26# For dealing with the humanity check
    
      27_cookie=$(curl -s https://forge.soutade.fr/402.html | sed -nE 's/.*document\.cookie = "([^;"]*).*/\1/p')
    
      28DLAGENTS=("https::/usr/bin/curl -b $_cookie -o %o %u")
    
      29
    
      30build() {
    
      31    cd libgourou
    
      32    # We want to link dynamically, but UPDFPARSERLIB needs to point to a valid file so we point it to /dev/null
    
      33    make \
    
      34        BUILD_STATIC=0 \
    
      35        BUILD_SHARED=1 \
    
      36        UPDFPARSERLIB="/dev/null" \
    
      37        LDFLAGS="-lpugixml -lupdfparser -Wl,-z,relro,-z,now" \
    
      38        obj libgourou
    
      39
    
      40    cd utils
    
      41    make ROOT=.. DEBUG=1
    
      42}
    
      43
    
      44package_libgourou() {
    
      45    license=('LGPL-3.0-or-later')
    
      46    depends=(
    
      47        'updfparser'
    
      48        'glibc'
    
      49        'libgcc'
    
      50        'libstdc++'
    
      51        'pugixml'
    
      52    )
    
      53
    
      54    cd libgourou
    
      55    install -Dm755 "libgourou.so.$pkgver" -t "$pkgdir/usr/lib"
    
      56    ln -s "libgourou.so.$pkgver" "$pkgdir/usr/lib/libgourou.so"
    
      57    make DESTDIR="$pkgdir" PREFIX="/usr" install_headers
    
      58}
    
      59
    
      60package_libgourou-utils() {
    
      61    pkgdesc="Downloading and decrypting tools for Adobe encrypted (ACSM) EPUB/PDF files"
    
      62    license=('BSD-3-Clause')
    
      63    depends=(
    
      64        'libgourou'
    
      65        'glibc'
    
      66        'libgcc'
    
      67        'libstdc++'
    
      68        'pugixml'
    
      69        'zlib'
    
      70        'libzip'
    
      71        'openssl'
    
      72        'curl'
    
      73    )
    
      74    provides=("gourou=${pkgver}")
    
      75    replaces=('gourou')
    
      76
    
      77    cd libgourou/utils
    
      78    make DESTDIR="$pkgdir" PREFIX="/usr" install
    
      79    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/utils-LICENSE"
    
      80}
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 00:10:31	Low	3
2026-10-19 00:03:55	Low	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	4
2026-10-14 00:06:47	Low	4
2026-10-13 00:23:45	Low	4
2026-10-12 00:18:51	Low	4
2026-10-11 00:26:05	Low	4
2026-10-10 00:11:52	Low	4
2026-10-09 00:05:33	Low	4
2026-10-08 00:28:03	Low	4
2026-10-07 00:21:34	Low	4
2026-10-06 00:13:36	Low	4
2026-10-05 00:08:03	Low	4
2026-10-04 00:18:08	Low	4
2026-10-03 00:23:04	Low	4
2026-10-02 00:00:32	Low	4
2026-10-01 00:02:06	Low	4