mingw-w64-libsodium
LOW
maintainer radioflash
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source is a tarball from the project's official domain (download.libsodium.org), which is not on the whitelist but is plausibly legitimate; building from official source is normal AUR practice and poses low risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official domain (download.libsodium.org), which is not on the whitelist but is plausibly legitimate; building from official source is normal AUR practice and poses low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
source=(https://download.libsodium.org/libsodium/releases/${_realname}-${pkgver}.tar.gz{,.sig})
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Wolfgang Pupp <wolfgang.pupp@gmail.com>
2
# Maintainer: Martchus <martchus@gmx.net>
3
# Contributor: Felix Yan <felixonmars@archlinux.org>
4
# Contributor: namelessjon <jonathan.stott@gmail.com>
5
# Contributor: Alessio Sergi <asergi at archlinux dot us>
6
# Contributor: Alexey Pavlov <alexpux@gmail.com>
7
8
_realname=libsodium
9
pkgname="mingw-w64-${_realname}"
10
pkgver=1.0.20
11
pkgrel=2
12
pkgdesc="A modern, portable, easy to use crypto library (mingw-w64)"
13
arch=(any)
14
url="https://github.com/jedisct1/libsodium"
15
license=('custom:ISC')
16
depends=('mingw-w64-crt')
17
options=(!strip !buildflags staticlibs)
18
makedepends=('mingw-w64-configure')
19
source=(https://download.libsodium.org/libsodium/releases/${_realname}-${pkgver}.tar.gz{,.sig})
20
b2sums=('2f1d8b2dc8a65f95433132b12bdccb7e0e4750326b05c4f42ddd3a74bf568faa2515384bfe94bba2ef420aff35c515d3d44945ea5a68f72e6a73b3a9b5bb234c'
21
'SKIP')
22
23
validpgpkeys=("54A2B8892CC3D6A597B92B6C210627AABA709FE1") # Frank Denis
24
_architectures="i686-w64-mingw32 x86_64-w64-mingw32"
25
26
build() {
27
for _arch in ${_architectures}; do
28
mkdir -p "${srcdir}"/build-${_arch} && cd "${srcdir}"/build-${_arch}
29
30
${_arch}-configure ../${_realname}-${pkgver}
31
32
make
33
done
34
}
35
36
package() {
37
for _arch in ${_architectures}; do
38
cd "${srcdir}"/build-${_arch}
39
make DESTDIR="$pkgdir" install
40
41
${_arch}-strip --strip-unneeded "${pkgdir}"/usr/${_arch}/bin/*.dll
42
${_arch}-strip -g "${pkgdir}"/usr/${_arch}/lib/*.a
43
44
rm "${pkgdir}/usr/${_arch}/bin/"*.def
45
rm -rf "${pkgdir}/usr/${_arch}/share"
46
done
47
48
install -Dm644 ${srcdir}/${_realname}-${pkgver}/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
49
}
50
51
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |