nginx-quic-libressl

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds nginx from its official GitHub repository and LibreSSL from OpenBSD's official CDN, both legitimate sources; the non-whitelisted host is a standard mirror for OpenBSD projects, and the downloaded tarball is integrity-verified via sha512sums, making the supply chain risk low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds nginx from its official GitHub repository and LibreSSL from OpenBSD's official CDN, both legitimate sources; the non-whitelisted host is a standard mirror for OpenBSD projects, and the downloaded tarball is integrity-verified via sha512sums, making the supply chain risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 "https://cdn.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${_libressl_ver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Masato TOYOSHIMA <phoepsilonix@phoepsilonix.love>
    
      2# Contributor: DasSkelett <dasskelett@dasskelett.dev>
    
      3# Contributor: Kasei Wang <kasei@kasei.im>
    
      4# Contributor: Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
    
      5# Contributor: Sébastien Luttringer
    
      6# Contributor: Drew DeVault
    
      7
    
      8_pkgbase=nginx
    
      9_commit=481d28cb4e04c8096b9b6134856891dc52ecc68f
    
      10_libressl_ver=4.0.0
    
      11pkgbase=nginx-quic-libressl
    
      12pkgname=($pkgbase $pkgbase-src)
    
      13pkgver=1.28.0
    
      14pkgrel=1
    
      15pkgdesc='Lightweight HTTP server and IMAP/POP3 proxy server'
    
      16arch=('i686' 'x86_64')
    
      17url='https://nginx.org'
    
      18license=('BSD-2-Clause-Views AND OpenSSL')
    
      19depends=('geoip' 'libxcrypt' 'pcre2' 'zlib' 'glibc' 'mailcap')
    
      20makedepends=('cmake' 'git' 'go' 'mercurial')
    
      21backup=('etc/nginx/fastcgi.conf'
    
      22        'etc/nginx/fastcgi_params'
    
      23        'etc/nginx/koi-win'
    
      24        'etc/nginx/koi-utf'
    
      25        'etc/nginx/nginx.conf'
    
      26        'etc/nginx/scgi_params'
    
      27        'etc/nginx/uwsgi_params'
    
      28        'etc/nginx/win-utf'
    
      29        'etc/logrotate.d/nginx')
    
      30install=nginx.install
    
      31provides=('nginx' 'nginx-mainline')
    
      32conflicts=('nginx')
    
      33source=("git+https://github.com/nginx/nginx.git#commit=${_commit}"
    
      34#       "hg+https://hg.nginx.org/nginx#revision=$_commit"
    
      35        "https://cdn.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${_libressl_ver}.tar.gz"
    
      36        "service"
    
      37        "logrotate")
    
      38sha512sums=('1e1e5b029fcd2bf9af1a6d7910751b7d6a7f4e42fd1014139b4ad2bcf6be06acd999844a295357923d6936c3ad165406df172c129f668e76566585cd4db4548c'
    
      39            'b5ec6d1f4e3842ecb487f9a67d86db658d05cbe8cd3fcba61172affa8c65c5d0823aa244065a7233f06c669d04a5a36517c02a2d99d2f2da3c4df729ac243b37'
    
      40            'ca7d8666177d31b6c4924e9ab44ddf3d5b596b51da04d38da002830b03bd176d49354bbdd2a496617d57f44111ad59833296af87d03ffe3fca6b99327a7b4c3c'
    
      41            '8fc2d0d1c4d14b80b82f158adb508bdd65428862cd6197c7b443d4612d0a225b82a4cae8fc76ab49560c97f0bf56427b3f4abc0a598abfa9b25cdd30d1f15a30')
    
      42
    
      43_common_flags=(
    
      44  --with-compat
    
      45  --with-debug
    
      46  --with-file-aio
    
      47  --with-http_addition_module
    
      48  --with-http_auth_request_module
    
      49  --with-http_dav_module
    
      50  --with-http_degradation_module
    
      51  --with-http_flv_module
    
      52  --with-http_geoip_module
    
      53  --with-http_gunzip_module
    
      54  --with-http_gzip_static_module
    
      55  --with-http_mp4_module
    
      56  --with-http_realip_module
    
      57  --with-http_secure_link_module
    
      58  --with-http_slice_module
    
      59  --with-http_ssl_module
    
      60  --with-http_stub_status_module
    
      61  --with-http_sub_module
    
      62  --with-http_v2_module
    
      63  --with-mail
    
      64  --with-mail_ssl_module
    
      65  --with-pcre-jit
    
      66  --with-stream
    
      67  --with-stream_geoip_module
    
      68  --with-stream_realip_module
    
      69  --with-stream_ssl_module
    
      70  --with-stream_ssl_preread_module
    
      71  --with-threads
    
      72)
    
      73
    
      74_mainline_flags=(
    
      75)
    
      76
    
      77_quic_flags=(
    
      78  --with-http_v3_module
    
      79#  --with-stream_quic_module
    
      80)
    
      81
    
      82prepare() {
    
      83  # Backup pristine version of nginx source for -src package
    
      84  test -d ${srcdir}/${pkgname}-src && rm -r ${srcdir}/${pkgname}-src
    
      85  cp -r ${srcdir}/nginx ${srcdir}/nginx-src
    
      86}
    
      87
    
      88pkgver() {
    
      89  cd nginx
    
      90  git describe --long --tags | sed -e 's/release-\([^-]*\)-.*/\1/'
    
      91}
    
      92
    
      93build() {
    
      94  # Clear -D_FORTIFY_SOURCE from C++ build flags, it causes Boringssl tests to fail to compile
    
      95  export CPPFLAGS=${CPPFLAGS/-D_FORTIFY_SOURCE=[1-9]/-D_FORTIFY_SOURCE=0}
    
      96  export CXXFLAGS=${CXXFLAGS/-D_FORTIFY_SOURCE=[1-9]/-D_FORTIFY_SOURCE=0}
    
      97
    
      98  export CXXFLAGS="$CXXFLAGS -fPIC"
    
      99  export CFLAGS="$CFLAGS -fPIC"
    
      100  export LDFLAGS="$LDFLAGS"
    
      101
    
      102  if [[ $CC == "clang" ]];then
    
      103    _cc_opt="-flto $CPPFLAGS $CFLAGS"
    
      104    _ld_opt="-flto -fuse-ld=lld $LDFLAGS"
    
      105  else
    
      106    # Disable some warnings that make Boringssl fail to compile due to a forced -Werror in CMakeLists.txt
    
      107    # -Wno-array-bounds: 2022-05-21 for compatiblity with GCC 12.1 (https://bugs.chromium.org/p/boringssl/issues/detail?id=492&sort=-modified)
    
      108    export CFLAGS="$CFLAGS -Wno-stringop-overflow -Wno-array-parameter -Wno-array-bounds"
    
      109    _cc_opt="$CPPFLAGS $CFLAGS"
    
      110    _ld_opt="$LDFLAGS"
    
      111  fi
    
      112
    
      113#  cd ${srcdir}/boringssl
    
      114#  mkdir build && cd build && cmake -DCMAKE_BUILD_TYPE=Release ../ && make crypto ssl
    
      115#  cd ${srcdir}/boringssl
    
      116#  mkdir -p .openssl/lib && cd .openssl && ln -s ../include . && cd ../
    
      117#  cp ${srcdir}/boringssl/build/crypto/libcrypto.a ${srcdir}/boringssl/build/ssl/libssl.a .openssl/lib && cd ..
    
      118
    
      119  cd ${srcdir}/nginx
    
      120  ./auto/configure \
    
      121    --prefix=/etc/nginx \
    
      122    --conf-path=/etc/nginx/nginx.conf \
    
      123    --sbin-path=/usr/bin/nginx \
    
      124    --pid-path=/run/nginx.pid \
    
      125    --lock-path=/run/lock/nginx.lock \
    
      126    --user=http \
    
      127    --group=http \
    
      128    --http-log-path=/var/log/nginx/access.log \
    
      129    --error-log-path=stderr \
    
      130    --http-client-body-temp-path=/var/lib/nginx/client-body \
    
      131    --http-proxy-temp-path=/var/lib/nginx/proxy \
    
      132    --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
    
      133    --http-scgi-temp-path=/var/lib/nginx/scgi \
    
      134    --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
    
      135    --with-openssl=${srcdir}/libressl-${_libressl_ver} \
    
      136    --with-cc-opt="${_cc_opt}" \
    
      137    --with-ld-opt="${_ld_opt}" \
    
      138    ${_common_flags[@]} \
    
      139    ${_mainline_flags[@]} \
    
      140    ${_quic_flags[@]}
    
      141
    
      142  #touch ${srcdir}/boringssl/.openssl/include/openssl/ssl.h
    
      143  make -j$(nproc)
    
      144}
    
      145
    
      146package_nginx-quic-libressl() {
    
      147  cd nginx
    
      148  make DESTDIR="$pkgdir" install
    
      149
    
      150  sed -e 's|\<user\s\+\w\+;|user http;|g' \
    
      151    -e '44s|html|/usr/share/nginx/html|' \
    
      152    -e '54s|html|/usr/share/nginx/html|' \
    
      153    -i "$pkgdir"/etc/nginx/nginx.conf
    
      154
    
      155  rm "$pkgdir"/etc/nginx/*.default
    
      156  rm "$pkgdir"/etc/nginx/mime.types  # in mailcap
    
      157
    
      158  install -d "$pkgdir"/var/lib/nginx
    
      159  install -dm700 "$pkgdir"/var/lib/nginx/proxy
    
      160
    
      161  chmod 755 "$pkgdir"/var/log/nginx
    
      162  chown root:root "$pkgdir"/var/log/nginx
    
      163
    
      164  install -d "$pkgdir"/usr/share/nginx
    
      165  mv "$pkgdir"/etc/nginx/html/ "$pkgdir"/usr/share/nginx
    
      166
    
      167  install -Dm644 ../logrotate "$pkgdir"/etc/logrotate.d/nginx
    
      168  install -Dm644 ../service "$pkgdir"/usr/lib/systemd/system/nginx.service
    
      169  install -Dm644 LICENSE "$pkgdir"/usr/share/licenses/$provides/LICENSE
    
      170  install -d "$pkgdir"/usr/share/licenses/$pkgname
    
      171  ln -s /usr/share/licenses/$provides/LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      172
    
      173  rmdir "$pkgdir"/run
    
      174
    
      175  install -d "$pkgdir"/usr/share/man/man8/
    
      176  gzip -9c docs/man/nginx.8 > "$pkgdir"/usr/share/man/man8/nginx.8.gz
    
      177
    
      178  for i in ftdetect indent syntax; do
    
      179    install -Dm644 contrib/vim/${i}/nginx.vim \
    
      180      "${pkgdir}/usr/share/vim/vimfiles/${i}/nginx.vim"
    
      181  done
    
      182  install -Dm644 "$srcdir"/libressl-${_libressl_ver}/COPYING "$pkgdir"/usr/share/licenses/$pkgname/LICENSE-LIBRESSL
    
      183
    
      184}
    
      185
    
      186package_nginx-quic-libressl-src() {
    
      187  pkgdesc="Source code of nginx-quic, useful for building modules"
    
      188  arch=('any')
    
      189  provides=('nginx-src' 'nginx-mainline-src')
    
      190  conflicts=($_pkgbase-src)
    
      191  depends=("sh" "bash" "perl")
    
      192  backup=()
    
      193  install -d "$pkgdir/usr/src"
    
      194  test -d "$pkgdir/usr/src/nginx" && rm -r "$pkgdir/usr/src/nginx"
    
      195  cp -r ${srcdir}/nginx-src "$pkgdir/usr/src/nginx"
    
      196  # Delete the .hg directory, it is huge and not needed
    
      197  #rm -r ${pkgdir}/usr/src/nginx/{.hg,.hgtags}
    
      198  #rm -r ${pkgdir}/usr/src/nginx/.hg
    
      199  # Link the 'configure' script to its location in release tarballs,
    
      200  # as this is where modules expect it
    
      201  ln -s /usr/src/nginx/auto/configure "$pkgdir/usr/src/nginx"
    
      202  cd nginx-src
    
      203  install -Dm644 LICENSE "$pkgdir"/usr/share/licenses/$provides/LICENSE
    
      204  install -d "$pkgdir"/usr/share/licenses/$pkgname
    
      205  ln -s /usr/share/licenses/$provides/LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      206  install -Dm644 "$srcdir"/libressl-${_libressl_ver}/COPYING "$pkgdir"/usr/share/licenses/$pkgname/LICENSE-LIBRESSL
    
      207}
    
      208
    
      209# vim:set ts=2 sw=2 et:
    
      210

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2