mingw-w64-paraview-qt6

MEDIUM

maintainer xantares 0 votes scanned 2026-09-09 00:04:09.106193

View on AUR

Why flagged

The PKGBUILD downloads and applies patches from untrusted, non-whitelisted GitLab URLs not listed in source=(), creating a supply-chain risk if those patches were maliciously altered.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:23 curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/13393.patch -p1 -d VTK
PKGBUILD:24 curl -L https://gitlab.kitware.com/paraview/paraview/-/merge_requests/7854.patch -p1

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The PKGBUILD downloads and applies patches from untrusted, non-whitelisted GitLab URLs not listed in source=(), creating a supply-chain risk if those patches were maliciously altered.

PKGBUILD

2 offending line(s) highlighted

      1pkgname=mingw-w64-paraview-qt6
    
      2pkgver=6.1.1
    
      3pkgrel=1
    
      4pkgdesc='Parallel Visualization Application using VTK (mingw-w64)'
    
      5arch=('any')
    
      6url='https://www.paraview.org'
    
      7license=('custom')
    
      8depends=('mingw-w64-vtk-qt6' 'mingw-w64-qt6-base' 'mingw-w64-qt6-tools' 'mingw-w64-qt6-svg' 'mingw-w64-qt6-5compat' 'mingw-w64-cgns' 'mingw-w64-protobuf')
    
      9makedepends=('mingw-w64-cmake' 'mingw-w64-wine' 'mingw-w64-boost' 'protobuf')
    
      10options=('!buildflags' '!strip' 'staticlibs')
    
      11source=("${url}/files/v${pkgver:0:3}/ParaView-v${pkgver}.tar.xz")
    
      12md5sums=('8dd6919a9afbb5859367f84900d360a3')
    
      13
    
      14_architectures="x86_64-w64-mingw32"
    
      15
    
      16prepare() {
    
      17  cd "${srcdir}/ParaView-v${pkgver}"
    
      18
    
      19  # undefined reference to absl::lts_20250814::log_internal::LogMessageFatal::LogMessageFatal(char const*, int, char const*)
    
      20  echo "target_link_libraries(RemotingServerManager PRIVATE absl_log_internal_message)" >> Remoting/ServerManager/CMakeLists.txt
    
      21
    
      22  # flag to skip hw backends
    
      23  curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/13393.patch -p1 -d VTK
    
      24  curl -L https://gitlab.kitware.com/paraview/paraview/-/merge_requests/7854.patch -p1
    
      25}
    
      26
    
      27build() {
    
      28  cd "${srcdir}/ParaView-v${pkgver}"
    
      29  for _arch in ${_architectures}; do
    
      30    ${_arch}-cmake \
    
      31      -DCMAKE_BUILD_TYPE=Release \
    
      32      -DPARAVIEW_USE_PYTHON=OFF \
    
      33      -DPARAVIEW_ENABLE_EMBEDDED_DOCUMENTATION=OFF \
    
      34      -DPARAVIEW_PLUGIN_DISABLE_XML_DOCUMENTATION=ON \
    
      35      -DPARAVIEW_USE_VISKORES=OFF \
    
      36      -DPARAVIEW_BUILD_WITH_EXTERNAL=ON \
    
      37      -DPARAVIEW_QT_VERSION=6 \
    
      38      -DPARAVIEW_USE_EXTERNAL_VTK=ON \
    
      39      -B build-${_arch} .
    
      40    WINEPATH="/usr/${_arch}/bin;${PWD}/bin" make -C build-${_arch}
    
      41  done
    
      42}
    
      43
    
      44package() {
    
      45  for _arch in ${_architectures}; do
    
      46    cd "$srcdir"/ParaView-v${pkgver}/build-${_arch}
    
      47    make install/fast DESTDIR="$pkgdir"
    
      48    rm -r "$pkgdir"/usr/${_arch}/share
    
      49    ${_arch}-strip --strip-unneeded "$pkgdir"/usr/${_arch}/bin/*.dll
    
      50    ${_arch}-strip -g "$pkgdir"/usr/${_arch}/lib/*.a
    
      51  done
    
      52}
    
      53

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:37
+++ PKGBUILD @ 2026-09-09 00:04
@@ -5,7 +5,7 @@
 arch=('any')
 url='https://www.paraview.org'
 license=('custom')
-depends=('mingw-w64-vtk-qt6' 'mingw-w64-qt6-base' 'mingw-w64-qt6-tools' 'mingw-w64-qt6-svg' 'mingw-w64-cgns' 'mingw-w64-protobuf')
+depends=('mingw-w64-vtk-qt6' 'mingw-w64-qt6-base' 'mingw-w64-qt6-tools' 'mingw-w64-qt6-svg' 'mingw-w64-qt6-5compat' 'mingw-w64-cgns' 'mingw-w64-protobuf')
 makedepends=('mingw-w64-cmake' 'mingw-w64-wine' 'mingw-w64-boost' 'protobuf')
 options=('!buildflags' '!strip' 'staticlibs')
 source=("${url}/files/v${pkgver:0:3}/ParaView-v${pkgver}.tar.xz")
@@ -18,6 +18,10 @@
 
   # undefined reference to absl::lts_20250814::log_internal::LogMessageFatal::LogMessageFatal(char const*, int, char const*)
   echo "target_link_libraries(RemotingServerManager PRIVATE absl_log_internal_message)" >> Remoting/ServerManager/CMakeLists.txt
+
+  # flag to skip hw backends
+  curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/13393.patch -p1 -d VTK
+  curl -L https://gitlab.kitware.com/paraview/paraview/-/merge_requests/7854.patch -p1
 }
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-09 00:04:09	Medium	2
2026-09-08 19:18:21	Medium	2
2026-06-20 16:37:17	Clean	0
2026-06-20 10:36:43	Clean	0
2026-06-20 08:36:24	Clean	0
2026-06-18 16:11:54	Clean	0