mingw-w64-vtk-qt6

maintainer xantares · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD fetches four patches at build time via `curl | patch -p1` from gitlab.kitware.com (the official VTK upstream GitLab instance), bypassing the source=() integrity verification mechanism entirely. While gitlab.kitware.com is the legitimate upstream host for VTK, the patches are not pinned to a specific commit hash or verified against a checksum — a merge request URL can be force-pushed or its content changed server-side. This is a genuine supply-chain concern: any of those four patches could be silently altered and would be applied to compiled C++ code without any integrity check. The local MR13293.patch is included in source=() but with SKIP for its checksum, which is also sloppy. The host is official/trusted (not a personal or third-party mirror), which reduces severity compared to a truly untrusted host, but the pattern of executing unverified downloaded code during build is a real medium-severity concern per AUR packaging standards.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:18 curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12856.patch | patch -p1
PKGBUILD:19 curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12937.patch | patch -p1
PKGBUILD:20 curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12939.patch | patch -p1
PKGBUILD:21 curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12940.patch | patch -p1

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://www.vtk.org/files/release/${pkgver:0:3}/VTK-${pkgver}.tar.gz" MR13293.patch)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD fetches four patches at build time via `curl | patch -p1` from gitlab.kitware.com (the official VTK upstream GitLab instance), bypassing the source=() integrity verification mechanism entirely. While gitlab.kitware.com is the legitimate upstream host for VTK, the patches are not pinned to a specific commit hash or verified against a checksum — a merge request URL can be force-pushed or its content changed server-side. This is a genuine supply-chain concern: any of those four patches could be silently altered and would be applied to compiled C++ code without any integrity check. The local MR13293.patch is included in source=() but with SKIP for its checksum, which is also sloppy. The host is official/trusted (not a personal or third-party mirror), which reduces severity compared to a truly untrusted host, but the pattern of executing unverified downloaded code during build is a real medium-severity concern per AUR packaging standards.

PKGBUILD

5 offending line(s) highlighted

      1pkgname=mingw-w64-vtk-qt6
    
      2pkgver=9.6.2
    
      3pkgrel=1
    
      4pkgdesc='Software system for 3D computer graphics, image processing, and visualization (mingw-w64)'
    
      5arch=('any')
    
      6url='https://www.vtk.org/'
    
      7license=('BSD')
    
      8depends=('mingw-w64-crt' 'mingw-w64-qt6-base' 'mingw-w64-jsoncpp' 'mingw-w64-expat' 'mingw-w64-netcdf' 'mingw-w64-libtiff' 'mingw-w64-libjpeg-turbo' 'mingw-w64-freetype2' 'mingw-w64-libpng' 'mingw-w64-libxml2' 'mingw-w64-hdf5' 'mingw-w64-freeglut' 'mingw-w64-lz4' 'mingw-w64-proj' 'mingw-w64-double-conversion' 'mingw-w64-pugixml' 'mingw-w64-libtheora' 'mingw-w64-gl2ps' 'mingw-w64-cgns' 'mingw-w64-libharu' 'mingw-w64-verdict' 'mingw-w64-scnlib')
    
      9makedepends=('mingw-w64-cmake' 'mingw-w64-wine' 'qt6-base')
    
      10options=('!buildflags' 'staticlibs' '!strip')
    
      11source=("https://www.vtk.org/files/release/${pkgver:0:3}/VTK-${pkgver}.tar.gz" MR13293.patch)
    
      12sha256sums=('aed12cec12a9609179bf66329070266627ca64244a10856a452b2a17ffb04a1d' SKIP)
    
      13
    
      14_architectures="x86_64-w64-mingw32"
    
      15
    
      16prepare() {
    
      17  cd "${srcdir}/VTK-${pkgver}"
    
      18  curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12856.patch | patch -p1
    
      19  curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12937.patch | patch -p1
    
      20  curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12939.patch | patch -p1
    
      21  curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12940.patch | patch -p1
    
      22
    
      23  # gcc16: vtkNativePartitioningStrategy.cxx:(.text+0x6865): undefined reference to `vtkAOSDataArrayTemplate<long long>::IsTypeOf(char const*)'
    
      24  patch -p1 -i "${srcdir}"/MR13293.patch
    
      25}
    
      26
    
      27build() {
    
      28  cd "${srcdir}/VTK-${pkgver}"
    
      29  for _arch in ${_architectures}; do
    
      30    ${_arch}-cmake \
    
      31      -DCMAKE_BUILD_TYPE=Release \
    
      32      -DVTK_USE_EXTERNAL=ON \
    
      33      -DVTK_BUILD_TESTING=OFF \
    
      34      -DVTK_QT_VERSION=6 \
    
      35      -DVTK_MODULE_USE_EXTERNAL_VTK_cli11=OFF \
    
      36      -DVTK_MODULE_USE_EXTERNAL_VTK_ioss=OFF \
    
      37      -DVTK_MODULE_USE_EXTERNAL_VTK_eigen=OFF \
    
      38      -DVTK_MODULE_USE_EXTERNAL_VTK_exprtk=OFF \
    
      39      -DVTK_MODULE_USE_EXTERNAL_VTK_fmt=OFF \
    
      40      -DVTK_MODULE_USE_EXTERNAL_VTK_fast_float=OFF \
    
      41      -DVTK_MODULE_USE_EXTERNAL_VTK_nlohmannjson=OFF \
    
      42      -DVTK_MODULE_USE_EXTERNAL_VTK_pegtl=OFF \
    
      43      -DVTK_MODULE_USE_EXTERNAL_VTK_token=OFF \
    
      44      -DVTK_MODULE_USE_EXTERNAL_VTK_utf8=OFF \
    
      45      -DVTK_MODULE_ENABLE_VTK_GUISupportQt=YES \
    
      46      -DVTK_MODULE_ENABLE_VTK_cli11=YES \
    
      47      -DVTK_MODULE_ENABLE_VTK_FiltersParallelStatistics=YES \
    
      48      -DVTK_MODULE_ENABLE_VTK_FiltersParallelVerdict=YES \
    
      49      -DVTK_MODULE_ENABLE_VTK_FiltersParallelDIY2=YES \
    
      50      -DVTK_MODULE_ENABLE_VTK_IOAvmesh=YES \
    
      51      -DVTK_MODULE_ENABLE_VTK_IOH5part=YES \
    
      52      -DVTK_MODULE_ENABLE_VTK_IOH5Rage=YES \
    
      53      -DVTK_MODULE_ENABLE_VTK_IOOMF=YES \
    
      54      -DVTK_MODULE_ENABLE_VTK_IOParallelExodus=YES \
    
      55      -DVTK_MODULE_ENABLE_VTK_IOParallelLSDyna=YES \
    
      56      -DVTK_MODULE_ENABLE_VTK_IOPIO=YES \
    
      57      -DVTK_MODULE_ENABLE_VTK_IOTRUCHAS=YES \
    
      58      -DVTK_MODULE_ENABLE_VTK_IOVPIC=YES \
    
      59      -DVTK_MODULE_ENABLE_VTK_IOXdmf2=YES \
    
      60      -DVTK_MODULE_ENABLE_VTK_RenderingParallel=YES \
    
      61      -DVTK_MODULE_ENABLE_VTK_RenderingVolumeAMR=YES \
    
      62      -B build-${_arch} .
    
      63    make -C build-${_arch}
    
      64  done
    
      65}
    
      66
    
      67package() {
    
      68  for _arch in ${_architectures}; do
    
      69    cd "$srcdir/VTK-${pkgver}/build-${_arch}"
    
      70    make install/fast DESTDIR="$pkgdir"
    
      71    rm -r "$pkgdir"/usr/${_arch}/share
    
      72    ${_arch}-strip --strip-unneeded "$pkgdir"/usr/${_arch}/bin/*.dll
    
      73    ${_arch}-strip -g "$pkgdir"/usr/${_arch}/lib/*.a
    
      74  done
    
      75}
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3