mqvpn

maintainer mp0rta · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package builds from source using pinned git repositories, including forks maintained by the same author; skipped checksums are common for git sources and do not imply remote code execution, as all code is locally checked out and built without downloading prebuilt binaries or executing unreviewed remote scripts.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source using pinned git repositories, including forks maintained by the same author; skipped checksums are common for git sources and do not imply remote code execution, as all code is locally checked out and built without downloading prebuilt binaries or executing unreviewed remote scripts.

PKGBUILD

1# Maintainer: mp0rta <3p0rta26@gmail.com>
2pkgname=mqvpn
3pkgver=0.14.1
4pkgrel=1
5pkgdesc="Multipath VPN using MASQUE CONNECT-IP (RFC 9484) and Multipath QUIC"
6arch=(x86_64 aarch64)
7url="https://github.com/mp0rta/mqvpn"
8license=(Apache-2.0)
9depends=(libevent)
10makedepends=(cmake git go)
11# BoringSSL is a submodule of the vendored xquic fork; its exact commit comes
12# from that gitlink, so no separate pin is kept here.
13source=("git+https://github.com/mp0rta/mqvpn.git#tag=v${pkgver}"
14 "mqvpn-xquic::git+https://github.com/mp0rta/xquic.git"
15 "mqvpn-lwip::git+https://github.com/mp0rta/heiher-lwip.git"
16 "boringssl::git+https://github.com/google/boringssl.git")
17sha256sums=('SKIP'
18 'SKIP'
19 'SKIP'
20 'SKIP')
21
22prepare() {
23 cd mqvpn
24 git submodule init
25 git config submodule.third_party/xquic.url "${srcdir}/mqvpn-xquic"
26 git config submodule.third_party/lwip.url "${srcdir}/mqvpn-lwip"
27 git -c protocol.file.allow=always submodule update third_party/xquic third_party/lwip
28 git -C third_party/xquic submodule init
29 git -C third_party/xquic config submodule.third_party/boringssl.url "${srcdir}/boringssl"
30 git -C third_party/xquic -c protocol.file.allow=always submodule update third_party/boringssl
31}
32
33build() {
34 cd mqvpn
35
36 cmake -S third_party/xquic/third_party/boringssl \
37 -B third_party/xquic/third_party/boringssl/build \
38 -DCMAKE_BUILD_TYPE=Release \
39 -DBUILD_SHARED_LIBS=0 \
40 -DCMAKE_C_FLAGS="${CFLAGS} -fPIC" \
41 -DCMAKE_CXX_FLAGS="${CXXFLAGS} -fPIC"
42 make -C third_party/xquic/third_party/boringssl/build -j"$(nproc)" ssl crypto
43
44 cmake -S third_party/xquic -B third_party/xquic/build \
45 -DCMAKE_BUILD_TYPE=Release \
46 -DSSL_TYPE=boringssl \
47 -DXQC_ENABLE_BBR2=ON \
48 -DXQC_ENABLE_UNLIMITED=ON \
49 -DXQC_ENABLE_FEC=ON \
50 -DXQC_ENABLE_XOR=ON \
51 -DCMAKE_C_FLAGS="${CFLAGS} -Wno-dangling-pointer"
52 make -C third_party/xquic/build -j"$(nproc)"
53
54 cmake -S . -B build \
55 -DCMAKE_BUILD_TYPE=Release \
56 -DCMAKE_INSTALL_PREFIX=/usr \
57 -DMQVPN_ENABLE_HYBRID_TCP_LANE=ON \
58 -DXQUIC_BUILD_DIR="${PWD}/third_party/xquic/build"
59 make -C build -j"$(nproc)"
60}
61
62package() {
63 cd mqvpn
64 make -C build DESTDIR="${pkgdir}" install
65}
66

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
# Maintainer: mp0rta <3p0rta26@gmail.com>
pkgname=mqvpn
-pkgver=0.14.0
+pkgver=0.14.1
pkgrel=1
pkgdesc="Multipath VPN using MASQUE CONNECT-IP (RFC 9484) and Multipath QUIC"
arch=(x86_64 aarch64)

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 17:12:22 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 15:29:50 LOW 2
2026-07-24 00:02:28 CLEAN 2
2026-07-23 15:24:42 LOW 1
2026-07-23 00:14:47 LOW 2
2026-07-22 17:21:24 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 15:14:11 LOW 2
2026-07-20 13:14:10 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion