libreswan

maintainer cedricroijakkers · 44 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The source URL is from download.libreswan.org, which is the official project domain; despite being flagged as non-standard, it hosts the legitimate source tarball for a widely-used open-source project, and the checksums are provided and valid.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URL is from download.libreswan.org, which is the official project domain; despite being flagged as non-standard, it hosts the legitimate source tarball for a widely-used open-source project, and the checksums are provided and valid.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "https://download.libreswan.org/${pkgname}-${pkgver%%.r*}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Cedric Roijakkers <cedric [the at sign goes here] roijakkers [the dot sign goes here] be>.
    
      2# Based on previous work from the following people:
    
      3# Contributor: Chris Severance aur.severach aATt spamgourmet dott com
    
      4# Contributor: Gomasy <nyan@gomasy.jp>
    
      5# Contributor: Alexandre BIQUE <bique.alexandre@gmail.com>
    
      6# Contributor: Patrick Burroughs (Celti) <celti@celti.name>
    
      7
    
      8set -u
    
      9pkgname='libreswan'
    
      10#pkgname+='-git'
    
      11pkgver='5.4'
    
      12pkgrel='0'
    
      13pkgdesc='IPsec implementation with IKEv1 and IKEv2 keying protocols'
    
      14arch=('i686' 'x86_64')
    
      15arch+=('aarch64') # yjun naumovitch
    
      16url='https://libreswan.org/'
    
      17license=('GPL' 'MPL')
    
      18depends=('systemd' 'unbound' 'nss' 'libcap-ng' 'curl' 'inetutils')
    
      19depends+=('python3')
    
      20optdepends=(
    
      21  'networkmanager-libreswan: NetworkManager support'
    
      22  'networkmanager-l2tp: L2TP support for NetworkManager using libreswan for IPSec'
    
      23)
    
      24makedepends=('docbook-xsl' 'xmlto' 'flex' 'bison')
    
      25conflicts=('freeswan' 'openswan' 'strongswan' 'ipsec-tools')
    
      26backup=('etc/ipsec.conf' 'etc/ipsec.secrets' 'etc/pam.d/pluto')
    
      27install="${pkgname}.install"
    
      28_srcdir="${pkgname}-${pkgver}"
    
      29source=(
    
      30  "https://download.libreswan.org/${pkgname}-${pkgver%%.r*}.tar.gz"
    
      31  'tmpfiles.conf'
    
      32)
    
      33md5sums=('7033ecec82837a5e97ec55da2ef58164'
    
      34         '77399a739ee99f8bc54837684d7c39d5')
    
      35sha256sums=('d26340cf625316cc9127e05b392214a24a10889f4f1d9940c2ea64bab710a855'
    
      36            '78265c690d58228c3bcc1a8793456172c39d493d268e9d9b1816288d0a47f573')
    
      37
    
      38if [ "${pkgname%-git}" != "${pkgname}" ]; then
    
      39  _srcdir="${pkgname}"
    
      40  source[0]="${_srcdir}::git://github.com/libreswan/libreswan.git"
    
      41  #source[0]+="#branch=release-${pkgver%%.r*}"
    
      42  makedepends+=('git')
    
      43  md5sums[0]='SKIP'
    
      44  sha256sums[0]='SKIP'
    
      45  provides=("${pkgname%-*}=${pkgver%%.r*}")
    
      46  conflicts=("${pkgname%-*}")
    
      47pkgver() {
    
      48  set -u
    
      49  cd "${_srcdir}"
    
      50  git describe --long | sed -e 's/\([^-]*-g\)/r\1/' -e 's/-/./g' -e 's:^v::g'
    
      51  set +u
    
      52}
    
      53elif [ "${pkgver%%.r*}" != "${pkgver}" ]; then
    
      54pkgver() {
    
      55  printf '%s' "${pkgver%.r*}"
    
      56}
    
      57fi
    
      58
    
      59# https://git.centos.org/rpms/libreswan/blob/c8s/f/SPECS/libreswan.spec
    
      60_bargs=(
    
      61  LIBEXECDIR='/usr/lib/ipsec'
    
      62  #INC_MANDIR='/usr/share/man'
    
      63  MANDIR='/usr/share/man'
    
      64  SBINDIR='/usr/bin'
    
      65  #INC_USRLOCAL='/usr' # required by 3.32 for /usr/share/doc
    
      66  PREFIX='/usr'
    
      67  USE_DNSSEC=false
    
      68  USE_LABELED_IPSEC=false
    
      69  USE_LIBCAP_NG=true
    
      70  USE_DH2=false # insecure modp1024; broken in 5.4, see https://github.com/libreswan/libreswan/issues/2980
    
      71
    
      72  USE_LEAK_DETECTIVE=false
    
      73  USE_XAUTH=true
    
      74)
    
      75
    
      76prepare() {
    
      77  set -u
    
      78  bash -n "${startdir}/${install}"
    
      79  set +u
    
      80}
    
      81
    
      82build() {
    
      83  set -u
    
      84  cd "${_srcdir}"
    
      85
    
      86  # Disable preprocessor warnings, because the build failed with GCC 13.2
    
      87  local _cf=(
    
      88    -Wp,-w
    
      89  )
    
      90
    
      91  CFLAGS="${CFLAGS} ${_cf[*]}" \
    
      92  nice make -s "${_bargs[@]}" programs
    
      93  set +u
    
      94}
    
      95
    
      96package() {
    
      97  set -u
    
      98  cd "${_srcdir}"
    
      99
    
      100  make -j1 DESTDIR="${pkgdir}/" "${_bargs[@]}" install
    
      101
    
      102  #sed -e '1s|python\b|python2|' -i "${pkgdir}/usr/lib/ipsec"/{verify,show}
    
      103  install -Dpm644 "${srcdir}/tmpfiles.conf" "${pkgdir}/usr/lib/tmpfiles.d/libreswan.conf"
    
      104  rm -rf "${pkgdir}/var"
    
      105
    
      106  install -Dpm644 <(cat << EOF
    
      107# Automatically generated by ${pkgname}-${pkgver} PKGBUILD from Arch Linux AUR
    
      108# https://aur.archlinux.org/
    
      109
    
      110# Disable redirects for ipsec tunnels
    
      111
    
      112net.ipv4.conf.default.accept_redirects = 0
    
      113net.ipv4.conf.default.send_redirects = 0
    
      114EOF
    
      115  ) "${pkgdir}/usr/lib/sysctl.d/${pkgname}-icmp-redirects.conf"
    
      116  sed -e 's: = 0: = 1:g' "${pkgdir}/usr/lib/sysctl.d/${pkgname}-icmp-redirects.conf" > "${pkgdir}/usr/lib/sysctl.d/${pkgname}-icmp-redirects.conf.revert"
    
      117
    
      118  if [ "$(vercmp "${pkgver}" '4.0')" -ge 0 ]; then
    
      119    install -dm700 "${pkgdir}/var/lib/ipsec/nss"
    
      120  fi
    
      121  set +u
    
      122}
    
      123set +u
    
      124# vim:set ts=2 sw=2 et:
    
      125

Changes since previous scan

--- PKGBUILD @ 2026-08-14 00:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -8,8 +8,8 @@
 set -u
 pkgname='libreswan'
 #pkgname+='-git'
-pkgver='5.3.2'
-pkgrel='1'
+pkgver='5.4'
+pkgrel='0'
 pkgdesc='IPsec implementation with IKEv1 and IKEv2 keying protocols'
 arch=('i686' 'x86_64')
 arch+=('aarch64') # yjun naumovitch
@@ -30,9 +30,9 @@
   "https://download.libreswan.org/${pkgname}-${pkgver%%.r*}.tar.gz"
   'tmpfiles.conf'
 )
-md5sums=('4edbdfdd387126a90f606c210fb8d60b'
+md5sums=('7033ecec82837a5e97ec55da2ef58164'
          '77399a739ee99f8bc54837684d7c39d5')
-sha256sums=('fb918afa0bb92bd0430c1da861ef8068864d25d72130df0c6307a1f9da761088'
+sha256sums=('d26340cf625316cc9127e05b392214a24a10889f4f1d9940c2ea64bab710a855'
             '78265c690d58228c3bcc1a8793456172c39d493d268e9d9b1816288d0a47f573')
 
 if [ "${pkgname%-git}" != "${pkgname}" ]; then
@@ -67,7 +67,7 @@
   USE_DNSSEC=false
   USE_LABELED_IPSEC=false
   USE_LIBCAP_NG=true
-  USE_DH2=true # insecure modp1024
+  USE_DH2=false # insecure modp1024; broken in 5.4, see https://github.com/libreswan/libreswan/issues/2980
 
   USE_LEAK_DETECTIVE=false
   USE_XAUTH=true

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 09:28:24	MEDIUM	1
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 07:23:13	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1