litecoin-daemon

maintainer a821 · 6 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The source is a tarball from the project's official download domain, building the project's own code, which is normal for AUR packages; the non-whitelisted host is the project's own release infrastructure, so the risk is low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official download domain, building the project's own code, which is normal for AUR packages; the non-whitelisted host is the project's own release infrastructure, so the risk is low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://download.litecoin.org/litecoin-${pkgver}/src/litecoin-${pkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: a821
    
      2
    
      3pkgname=litecoin-daemon
    
      4pkgver=0.21.5.6
    
      5pkgrel=1
    
      6arch=('x86_64')
    
      7url="https://www.litecoin.org/"
    
      8license=('MIT')
    
      9pkgdesc="Peer-to-peer digital currency (includes litecoind and litecoin-cli)"
    
      10depends=('boost-libs' 'db4.8' 'fmt' 'libevent' 'miniupnpc' 'openssl' 'sqlite' 'zeromq')
    
      11makedepends=('boost')
    
      12conflicts=('litecoin-qt' 'litecoin-bin')
    
      13source=("https://download.litecoin.org/litecoin-${pkgver}/src/litecoin-${pkgver}.tar.gz"
    
      14    0001-fix-boost-1.84-filesystem-deprecations.patch
    
      15    0001-upnp-add-compatibility-for-miniupnpc-2.2.8.patch
    
      16    0003-Fix-_FORTIFY_SOURCE-flag.patch
    
      17    0004-remove-boost-system.patch
    
      18)
    
      19sha256sums=('cebee52747bdd827d4716e6528a5ef76a57d4d73c4df78ecfb6a45eaf819972f'
    
      20            'f9de747281f6003739d9ac736684771b061e9d63f2ea90404c08187595e57619'
    
      21            '8f4354356b66f92b52a85d91c19d576e7cb637957380c052404794a70d9f8383'
    
      22            '0ca550e3967ee880f8e24b77fc58ff22451f2966d056b4554184104c3ca5dbb5'
    
      23            '7d427d1ae3f0f8d848e7baf4210448bdede90b83c3ca6948f48eb4eb115b4db5')
    
      24validpgpkeys=(
    
      25  'D35621D53A1CC6A3456758D03620E9D387E55666'  # David Burkett
    
      26)
    
      27
    
      28prepare() {
    
      29    patch -d litecoin-${pkgver} -p1 < 0001-upnp-add-compatibility-for-miniupnpc-2.2.8.patch
    
      30    patch -d litecoin-${pkgver} -p1 < 0001-fix-boost-1.84-filesystem-deprecations.patch
    
      31    patch -d litecoin-${pkgver} -p1 < 0003-Fix-_FORTIFY_SOURCE-flag.patch
    
      32    patch -d litecoin-${pkgver} -p1 < 0004-remove-boost-system.patch
    
      33}
    
      34
    
      35build() {
    
      36    cd litecoin-${pkgver}
    
      37    ./autogen.sh
    
      38    ./configure --prefix=/usr --without-gui
    
      39    make
    
      40}
    
      41
    
      42package() {
    
      43    cd litecoin-${pkgver}
    
      44    # make DESTDIR="${pkgdir}" install # for standard install
    
      45    install -Dm755 -t "$pkgdir/usr/bin" src/litecoin{d,-cli}
    
      46    install -Dm644 -t "$pkgdir/usr/share/man/man1" doc/man/litecoin{d,-cli}.1
    
      47    install -Dm644 COPYING "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      48}
    
      49
    
      50# vim: set ts=4 sw=4 et:
    
      51

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,7 +1,7 @@
 # Maintainer: a821
 
 pkgname=litecoin-daemon
-pkgver=0.21.5.5
+pkgver=0.21.5.6
 pkgrel=1
 arch=('x86_64')
 url="https://www.litecoin.org/"
@@ -16,7 +16,7 @@
     0003-Fix-_FORTIFY_SOURCE-flag.patch
     0004-remove-boost-system.patch
 )
-sha256sums=('7d0754bc595a872644771c919ed65bc735a1c879b6830b842bb87eee4eaeb88e'
+sha256sums=('cebee52747bdd827d4716e6528a5ef76a57d4d73c4df78ecfb6a45eaf819972f'
             'f9de747281f6003739d9ac736684771b061e9d63f2ea90404c08187595e57619'
             '8f4354356b66f92b52a85d91c19d576e7cb637957380c052404794a70d9f8383'
             '0ca550e3967ee880f8e24b77fc58ff22451f2966d056b4554184104c3ca5dbb5'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 13:21:13	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1