minizip-git

LOW

maintainer Chocobo1 3 votes base zlib-git scanned 2026-10-27 00:23:28.674093

View on AUR

Why flagged

The package builds from the official zlib GitHub repository, which is a legitimate source; the recent orphaning and re-adoption is a metadata concern but does not imply malicious intent or supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official zlib GitHub repository, which is a legitimate source; the recent orphaning and re-adoption is a metadata concern but does not imply malicious intent or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Chocobo1 <chocobo1 AT archlinux DOT net>
    
      2
    
      3pkgbase=zlib-git
    
      4pkgname=('minizip-git' 'zlib-git')
    
      5pkgver=1.3.2.r138.ge4904270
    
      6pkgrel=1
    
      7pkgdesc="A massively spiffy yet delicately unobtrusive compression library (git develop branch)"
    
      8arch=('i686' 'x86_64')
    
      9url="https://www.zlib.net/"
    
      10license=('Zlib')
    
      11depends=('glibc')
    
      12makedepends=('git')
    
      13options=('staticlibs')
    
      14source=("git+https://github.com/madler/zlib.git#branch=develop")
    
      15sha256sums=('SKIP')
    
      16
    
      17
    
      18pkgver() {
    
      19  cd "zlib"
    
      20
    
      21  _tag=$(git tag -l --sort -v:refname | grep -E '^v?[0-9\.]+$' | head -n1)
    
      22  _rev=$(git rev-list --count "$_tag"..HEAD)
    
      23  _hash=$(git rev-parse --short HEAD)
    
      24  printf "%s.r%s.g%s" "$_tag" "$_rev" "$_hash" | sed 's/^v//'
    
      25}
    
      26
    
      27build() {
    
      28  cd "zlib"
    
      29
    
      30  CFLAGS="$CFLAGS -ffat-lto-objects" \
    
      31  ./configure \
    
      32    --prefix="/usr"
    
      33  make
    
      34
    
      35  cd "contrib/minizip"
    
      36
    
      37  autoreconf -fi
    
      38  ./configure \
    
      39    --prefix="/usr"
    
      40  make
    
      41}
    
      42
    
      43check() {
    
      44  cd "zlib"
    
      45
    
      46  #make test
    
      47  #make -C "contrib/minizip" test
    
      48}
    
      49
    
      50package_zlib-git() {
    
      51  pkgdesc="A massively spiffy yet delicately unobtrusive compression library (git develop branch)"
    
      52  provides=("zlib=$pkgver" "zlib-static=$pkgver" 'libz.so')
    
      53  conflicts=('zlib' 'zlib-static')
    
      54
    
      55  cd "zlib"
    
      56
    
      57  make DESTDIR="$pkgdir" install
    
      58
    
      59  install -Dm644 "LICENSE" -t "$pkgdir/usr/share/licenses/zlib"
    
      60}
    
      61
    
      62package_minizip-git() {
    
      63  pkgdesc="Mini zip and unzip based on zlib"
    
      64  depends+=('zlib')
    
      65  provides=("minizip=$pkgver" 'libminizip.so')
    
      66  conflicts=('minizip')
    
      67
    
      68  cd "zlib/contrib/minizip"
    
      69
    
      70  make DESTDIR="$pkgdir" install
    
      71
    
      72  install -Dm644 "../../LICENSE" -t "$pkgdir/usr/share/licenses/minizip"
    
      73}
    
      74

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-27 00:23
@@ -1,68 +1,74 @@
-# Maintainer: Imperator Storm <ImperatorStorm11@protonmail.com>
-# Contributor: Guillaume Horel <guillaume.horel@gmail.com>
+# Maintainer: Chocobo1 <chocobo1 AT archlinux DOT net>
 
-pkgbase=minizip-git
-pkgname=minizip-git
-pkgdesc="Fork of the popular zip manipulation library found in the zlib distribution."
-pkgver=4.0.10.r27.gf890d80
-pkgrel=2
-arch=('x86_64' 'aarch64' 'i686')
+pkgbase=zlib-git
+pkgname=('minizip-git' 'zlib-git')
+pkgver=1.3.2.r138.ge4904270
+pkgrel=1
+pkgdesc="A massively spiffy yet delicately unobtrusive compression library (git develop branch)"
+arch=('i686' 'x86_64')
+url="https://www.zlib.net/"
 license=('Zlib')
-url="https://github.com/zlib-ng/minizip-ng"
-depends=('zstd' 'bzip2' 'openssl>=3.0.7' 'libbsd')
-makedepends=('git' 'cmake')
-source=("${pkgname}::git+https://github.com/zlib-ng/minizip-ng#branch=develop")
+depends=('glibc')
+makedepends=('git')
+options=('staticlibs')
+source=("git+https://github.com/madler/zlib.git#branch=develop")
 sha256sums=('SKIP')
 
+
 pkgver() {
-  cd ${srcdir}/${pkgbase}
-    git describe --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
-}
+  cd "zlib"
 
-prepare() {
-    cd ${srcdir}/${pkgbase}
-    if [[ -d build ]]; then
-      rm -rf build
-    fi
-    if [[ -d build-static ]]; then
-      rm -rf build-static
-    fi
-    mkdir build
-    mkdir build-static
-    if [[ -d build-ng ]]; then
-      rm -rf build-ng
-    fi
-    if [[ -d build-ng-static ]]; then
-      rm -rf build-ng-static
-    fi
-    mkdir build-ng
-    mkdir build-ng-static
+  _tag=$(git tag -l --sort -v:refname | grep -E '^v?[0-9\.]+$' | head -n1)
+  _rev=$(git rev-list --count "$_tag"..HEAD)
+  _hash=$(git rev-parse --short HEAD)
+  printf "%s.r%s.g%s" "$_tag" "$_rev" "$_hash" | sed 's/^v//'
 }
 
 build() {
-    cd ${srcdir}/${pkgbase}/build
-    cmake -DCMAKE_INSTALL_PREFIX=/usr \
-        -DBUILD_SHARED_LIBS=ON \
-        -DMZ_COMPAT=ON \
-        -DCMAKE_INSTALL_INCLUDEDIR=/usr/include/minizip \
-        -DCMAKE_BUILD_TYPE=None \
-        ..
-    make
-    cd ../build-ng
-    cmake -DCMAKE_INSTALL_PREFIX=/usr \
-        -DMZ_PROJECT_SUFFIX="-ng" \
-        -DBUILD_SHARED_LIBS=ON \
-        ..
-    make
+  cd "zlib"
+
+  CFLAGS="$CFLAGS -ffat-lto-objects" \
+  ./configure \
+    --prefix="/usr"
+  make
+
+  cd "contrib/minizip"
+
+  autoreconf -fi
+  ./configure \
+    --prefix="/usr"
+  make
+}
+
+check() {
+  cd "zlib"
+
+  #make test
+  #make -C "contrib/minizip" test
+}
+
+package_zlib-git() {
+  pkgdesc="A massively spiffy yet delicately unobtrusive compression library (git develop branch)"
+  provides=("zlib=$pkgver" "zlib-static=$pkgver" 'libz.so')
+  conflicts=('zlib' 'zlib-static')
+
+  cd "zlib"
+
+  make DESTDIR="$pkgdir" install
+
+  install -Dm644 "LICENSE" -t "$pkgdir/usr/share/licenses/zlib"
 }
 
 package_minizip-git() {
-    conflicts=('minizip' 'minizip-ng')
-    provides=('minizip' 'minizip-ng' 'libminizip.so=4')
-    cd ${srcdir}/${pkgbase}/build
-    make DESTDIR="${pkgdir}" install
-    cd ${srcdir}/${pkgbase}/build-ng
-    make DESTDIR="${pkgdir}" install
-    rm -rf "${pkgdir}/usr/include/"{,un}"zip.h" # conflict with libzip
+  pkgdesc="Mini zip and unzip based on zlib"
+  depends+=('zlib')
+  provides=("minizip=$pkgver" 'libminizip.so')
+  conflicts=('minizip')
+
+  cd "zlib/contrib/minizip"
+
+  make DESTDIR="$pkgdir" install
+
+  install -Dm644 "../../LICENSE" -t "$pkgdir/usr/share/licenses/minizip"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 00:23:28	Low	2
2026-10-26 17:46:00	Medium	1
2026-06-18 16:11:54	Clean	0