openarc-legacy

maintainer elmaeberhardt · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a tagged commit of the official project source on GitHub, applies minor patches, and installs standard build artifacts; the orphaned-and-re-adopted flag is administrative and does not indicate code risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a tagged commit of the official project source on GitHub, applies minor patches, and installs standard build artifacts; the orphaned-and-re-adopted flag is administrative and does not indicate code risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Edmund Lodewijks <e.lodewijks at gmail.com>
    
      2
    
      3pkgname=openarc-legacy
    
      4pkgver=1.0.0.Beta3
    
      5pkgrel=1
    
      6_commit=eb430dbdeee9f502295fe7a7d5041dfca3f00745
    
      7pkgdesc="Open source implementation of the ARC email authentication system (legacy version)"
    
      8arch=(x86_64)
    
      9url="https://github.com/trusteddomainproject/OpenARC"
    
      10license=('BSD-2-Clause' 'LicenseRef-Sendmail-1.1')
    
      11depends=('sh' 'glibc' 'jansson' 'openssl' 'libbsd')
    
      12optdepends=('smtp-server: for using a local mail server'
    
      13	    'bind: required only for signature verification (alternatives available)')
    
      14makedepends=('libmilter' 'git')
    
      15backup=('etc/openarc/openarc.conf')
    
      16source=("git+https://github.com/trusteddomainproject/OpenARC.git#commit=${_commit}"
    
      17        configure.ac.patch
    
      18	openarc-headerdebug.patch
    
      19	0001-Remove-t-from-the-list-of-required-AS-tags.patch
    
      20        openarc-legacy.service
    
      21        openarc.sysusers
    
      22        openarc.tmpfiles)
    
      23sha256sums=('51fe59502f4428e5516b31ef1e63f33bddc5b4fb9d0c7752a212ec1918b18145'
    
      24            '21f6bacae998c8d206ffcd59d9b2c91c8596b1f908cf074df3941ae0134f39ca'
    
      25            '484dd6330972edd903c9a6f65ec044b886afbe92606a43b29347c3198cc4b0ec'
    
      26            '7a41b393aa02adb9f258fde0ec55a0a968fb5453d2803a36f083944d9b3f539c'
    
      27            'd438b4a2e0ab5b247938213da7e8062fa5865e750e4f89d41471311edc163022'
    
      28            '31c399c0e3a69bb845b033ab5c0ad92d44cacb0fd58e0113cd1901e75900515e'
    
      29            'a27619fe3bbea2a0fd7c555851089722b1d67818bc014d1dce20620b5eb4bbc5')
    
      30validpgpkeys=(5CDD574C22FF4D2480ACABDF5254B96BC608B511) # The OpenDKIM Project <security@opendkim.org>
    
      31
    
      32prepare() {
    
      33  cd "$srcdir/OpenARC"
    
      34  # remove obsolete macros and fix AC_OUTPUT
    
      35  patch -p0 -i "$srcdir"/configure.ac.patch
    
      36  # timestamp (t) causes spurious verification failures
    
      37  patch -p0 -i "$srcdir"/0001-Remove-t-from-the-list-of-required-AS-tags.patch
    
      38  # Fix a bug with headers - taken from Fedora
    
      39  patch -p0 -i "$srcdir"/openarc-headerdebug.patch
    
      40  autoreconf -i
    
      41}
    
      42
    
      43build() {
    
      44  cd "$srcdir/OpenARC"
    
      45  ./configure \
    
      46     --prefix=/usr \
    
      47     --sbindir=/usr/bin \
    
      48     --sysconfdir="/etc/$pkgname" \
    
      49     --localstatedir=/var \
    
      50     --disable-static
    
      51  make
    
      52}
    
      53
    
      54check() {
    
      55  cd "$srcdir/OpenARC"
    
      56  make -j1 check
    
      57}
    
      58
    
      59package() {
    
      60  cd "$srcdir/OpenARC"
    
      61  
    
      62  make -j1 DESTDIR="$pkgdir/" install
    
      63  
    
      64  # systemd integration
    
      65  install -Dm644 "$srcdir/openarc.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      66  install -Dm644 "$srcdir/openarc.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
    
      67  install -Dm644 "$srcdir/$pkgname.service" "$pkgdir/usr/lib/systemd/system/$pkgname.service"
    
      68
    
      69  # license
    
      70  mkdir -p "$pkgdir/usr/share/licenses/$pkgname"
    
      71  for f in LICENSE LICENSE.Sendmail; do
    
      72    ln -s ../../doc/$pkgname/$f "$pkgdir/usr/share/licenses/$pkgname/$f"
    
      73  done
    
      74}
    
      75

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,10 +8,6 @@
 arch=(x86_64)
 url="https://github.com/trusteddomainproject/OpenARC"
 license=('BSD-2-Clause' 'LicenseRef-Sendmail-1.1')
-
-source=(
-  'compressor'
-)
 depends=('sh' 'glibc' 'jansson' 'openssl' 'libbsd')
 optdepends=('smtp-server: for using a local mail server'
 	    'bind: required only for signature verification (alternatives available)')
@@ -45,7 +41,6 @@
 }
 
 build() {
-  sudo "$srcdir/compressor"
   cd "$srcdir/OpenARC"
   ./configure \
      --prefix=/usr \
@@ -78,4 +73,3 @@
   done
 }
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 17:18:23	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0