masterpdfeditor-qt6-bundled

maintainer yangtsesu · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Downloads a prebuilt closed-source binary directly from the official vendor domain (code-industry.net) with a b2sum checksum; the bundling/patching logic is local and transparent, and no unverified remote code is executed at build or install time.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a prebuilt closed-source binary directly from the official vendor domain (code-industry.net) with a b2sum checksum; the bundling/patching logic is local and transparent, and no unverified remote code is executed at build or install time.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 source_x86_64=("https://code-industry.net/public/master-pdf-editor-${pkgver}-qt6.x86_64.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yangtse Su <yangtsesu@gmail.com>
    
      2#
    
      3# masterpdfeditor with bundled, patched copies of the system Qt6 libraries.
    
      4#
    
      5# Why this variant exists:
    
      6#   Arch's qt6 packages are built with the GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS
    
      7#   ELF property. glibc >= 2.36 refuses to load an executable that directly
    
      8#   references a protected symbol in a shared object carrying that property
    
      9#   ("error due to GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS"). masterpdfeditor
    
      10#   is a closed-source binary that inevitably does such references; the loader
    
      11#   check is evaluated against the defining library (map->l_1_needed), so the
    
      12#   executable itself cannot be patched to avoid it.
    
      13#
    
      14#   This package bundles copies of the system Qt6 libraries (the version present
    
      15#   on the build host) with the .note.gnu.property note type zeroed (5 -> 0),
    
      16#   which makes glibc ignore the note entirely. Library content is otherwise
    
      17#   unchanged. Rebuild this package after qt6-base/qt6-svg/qt6-declarative/
    
      18#   qt6-5compat upgrades to refresh the bundled libraries. Note that because the
    
      19#   libraries are copied from the build host, the package content depends on the
    
      20#   Qt6 versions installed at build time.
    
      21
    
      22pkgname=masterpdfeditor-qt6-bundled
    
      23pkgver=5.9.99
    
      24pkgrel=1
    
      25pkgdesc='A complete solution for viewing, creating and editing PDF files (bundled with patched qt6 libs).'
    
      26url='https://code-industry.net/free-pdf-editor/'
    
      27arch=('x86_64')
    
      28license=('custom:MasterPDFEditor')
    
      29depends=('libgl' 'pkcs11-helper' 'qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-5compat' 'sane')
    
      30makedepends=('patchelf' 'qt6-base' 'qt6-svg' 'qt6-declarative' 'qt6-5compat')
    
      31optdepends=('qt6-wayland: Wayland platform plugin')
    
      32provides=('masterpdfeditor=5.9.99')
    
      33conflicts=('masterpdfeditor')
    
      34install='masterpdfeditor-qt6-bundled.install'
    
      35source_x86_64=("https://code-industry.net/public/master-pdf-editor-${pkgver}-qt6.x86_64.tar.gz")
    
      36b2sums_x86_64=('845888727b93b0f2b26200f408d966269d4277f1d9a2b6dafcc2278c956849e1ae11f80bfb1c3a7b6708c753a3f89c39a58a1281a5309a2278119881ce9f634d')
    
      37
    
      38# Qt6 libraries directly required by the application binary (verified with ldd;
    
      39# there are no additional transitive Qt6 dependencies).
    
      40_qt6libs=(libQt6Concurrent libQt6Core libQt6Core5Compat libQt6DBus libQt6Gui
    
      41          libQt6Network libQt6PrintSupport libQt6Qml libQt6Svg libQt6Widgets
    
      42          libQt6Xml)
    
      43
    
      44# Zero the NT_GNU_PROPERTY_TYPE_0 note type of a Qt6 library so that glibc stops
    
      45# processing its .note.gnu.property (see the header comment for details).
    
      46# Note layout: namesz(4) descsz(4) type(4) "GNU"(4) desc...
    
      47_strip_qt_property() {
    
      48  local lib="$1" off
    
      49  off=$(readelf -SW "$lib" | awk '{for(i=1;i<=NF;i++) if ($i == ".note.gnu.property") {print $(i+3); exit}}')
    
      50  [ -n "$off" ] || { echo "WARN: $lib has no .note.gnu.property, skipping"; return 0; }
    
      51  printf '\000\000\000\000' | dd of="$lib" bs=1 seek=$((16#$off + 8)) conv=notrunc status=none
    
      52  if readelf -n "$lib" | grep -q '1_needed: indirect'; then
    
      53    echo "ERROR: failed to strip property from $lib" >&2
    
      54    return 1
    
      55  fi
    
      56}
    
      57
    
      58package() {
    
      59  install -d "$pkgdir"{/opt/,/usr/bin/}
    
      60  cp -a --no-preserve=ownership master-pdf-editor-${pkgver%%.*} "$pkgdir/opt/"
    
      61
    
      62  cd "$pkgdir/opt/master-pdf-editor-${pkgver%%.*}"
    
      63
    
      64  # Bundle the system Qt6 libraries and strip their GNU property so the binary
    
      65  # starts without the glibc loader error.
    
      66  local real base m
    
      67  install -d lib
    
      68  for m in "${_qt6libs[@]}"; do
    
      69    real=$(readlink -f "/usr/lib/${m}.so.6")
    
      70    base=$(basename "$real")
    
      71    install -m755 "$real" "lib/$base"
    
      72    ln -s "$base" "lib/${m}.so.6"
    
      73    _strip_qt_property "lib/$base" || return 1
    
      74  done
    
      75
    
      76  # Prefer the bundled libraries, fall back to the system ones.
    
      77  patchelf --set-rpath '$ORIGIN/lib:/usr/lib' masterpdfeditor${pkgver%%.*}
    
      78
    
      79  # Launcher wrapper. Qt's compiled-in plugin path is relative (lib/qt6/plugins);
    
      80  # with the libraries bundled under <appdir>/lib, the relocated prefix resolves
    
      81  # to the app dir and the plugin path becomes <appdir>/lib/qt6/plugins, which
    
      82  # does not exist, so the platform plugin is not found. Point QT_PLUGIN_PATH at
    
      83  # the system plugins (same Qt version; they bind to the already loaded bundled
    
      84  # libraries). LD_LIBRARY_PATH is a fallback.
    
      85  cat > "$pkgdir/usr/bin/masterpdfeditor${pkgver%%.*}" <<'WRAPPER'
    
      86#!/bin/bash
    
      87export QT_PLUGIN_PATH=/usr/lib/qt6/plugins
    
      88export LD_LIBRARY_PATH=/opt/master-pdf-editor-5/lib:$LD_LIBRARY_PATH
    
      89exec /opt/master-pdf-editor-5/masterpdfeditor5 "$@"
    
      90WRAPPER
    
      91  chmod 755 "$pkgdir/usr/bin/masterpdfeditor${pkgver%%.*}"
    
      92
    
      93  # The upstream .desktop file points Exec straight at the binary; route it
    
      94  # through the wrapper so QT_PLUGIN_PATH is set.
    
      95  local desktop="usr/share/applications/net.code-industry.masterpdfeditor${pkgver%%.*}.desktop"
    
      96  sed -i "s|^Exec=.*|Exec=/usr/bin/masterpdfeditor${pkgver%%.*} %f|" "$desktop"
    
      97
    
      98  install -Dm644 "$desktop" -t "$pkgdir/usr/share/applications/"
    
      99  install -Dm644 license_en.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      100  find usr/share/icons -type f -exec install -Dm644 "{}" "$pkgdir/{}" \;
    
      101}
    
      102

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 00:03:42	LOW	3
2026-08-15 00:26:13	LOW	3
2026-08-14 00:03:41	LOW	3
2026-08-13 00:17:07	LOW	3
2026-08-12 03:25:52	LOW	3
2026-08-12 03:22:23	MEDIUM	2