pidgin-privacy
LOW
maintainer miaoyucookies
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source includes a patch from a non-standard host (git.hyperbola.info), but it is applied as a clear, reviewable diff to enhance privacy; the main sources are from trusted project hosts (sourceforge.net, deb.debian.org), and the patch does not introduce unverifiable or executable content.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source includes a patch from a non-standard host (git.hyperbola.info), but it is applied as a clear, reviewable diff to enhance privacy; the main sources are from trusted project hosts (sourceforge.net, deb.debian.org), and the patch does not introduce unverifiable or executable content.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:26
https://git.hyperbola.info:50100/packages/extra.git/plain/pidgin/privacy.patch)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer (Arch): Evangelos Foutras <evangelos@foutrelis.com>
2
# Contributor (Arch): Ionut Biru <ibiru@archlinux.org>
3
# Contributor (Arch): Andrea Scarpino <andrea@archlinux.org>
4
# Contributor (Arch): Alexander Fehr <pizzapunk gmail com>
5
# Contributor (Arch): Lucien Immink <l.immink@student.fnt.hvu.nl>
6
# Maintainer (Hyperbola): Tobias Dausend <throgh@hyperbola.info>
7
# Maintainer: Miaoyu Cookies <zoe963988@mailtion.xyz>
8
9
pkgbase=pidgin-privacy
10
_pkgbase=pidgin
11
pkgname=('pidgin-privacy' 'libpurple-privacy')
12
_pkgname=pidgin
13
_pkglibname=libpurple
14
pkgver=2.14.14
15
_debver=$pkgver
16
_debrel=1
17
pkgrel=4
18
arch=('i686' 'x86_64')
19
url='https://pidgin.im/'
20
license=('GPL-2.0-or-later')
21
makedepends=('startup-notification' 'libxss' 'nss' 'libsasl' 'libsm'
22
'libidn' 'python' 'hicolor-icon-theme' 'arc-icon-theme' 'tk' 'libnsl' 'ca-certificates'
23
'intltool' 'libxcrypt' 'perl' 'quilt' 'gtk2')
24
source=(https://downloads.sourceforge.net/project/pidgin/Pidgin/$pkgver/${_pkgbase}-${pkgver}.tar.bz2
25
https://deb.debian.org/debian/pool/main/p/pidgin/pidgin_${_debver}-${_debrel}.debian.tar.xz
26
https://git.hyperbola.info:50100/packages/extra.git/plain/pidgin/privacy.patch)
27
sha512sums=('2d1ee55e701983871762b5307a2c13fa4431b388229aee7c27522ba593a4c79df729be04cda91f44b3cc9663ca0579bf66b722cdcbd71cae3b8c2dbe75c1f24d'
28
'0077f59f1f0586b227d5dcfdc361f36876707d0e4371c3af2c380c26858139e0612c1f5be7562d1b48912a96c03199ad1d70c7a2fce0234b0d2d345ab03291b1'
29
'36ffb6ca6e5feb86583af0679cb47a4a36cfdcf2e30dfa8b02fd316c4fc6daf7d5c008109a3af426f62f18d9af58122b9d61c32ee324d52309dbaef14247f453')
30
31
prepare() {
32
cd $_pkgbase-$pkgver
33
34
if [[ ${pkgver%.*} = ${_debver%.*} ]]; then
35
# Debian patches
36
export QUILT_PATCHES=debian/patches
37
export QUILT_REFRESH_ARGS='-p ab --no-timestamps --no-index'
38
export QUILT_DIFF_ARGS='--no-timestamps'
39
40
mv "$srcdir"/debian .
41
42
quilt push -av
43
fi
44
45
# additional fixes
46
patch -Np1 -i $srcdir/privacy.patch
47
}
48
49
build() {
50
cd $_pkgbase-$pkgver
51
52
./configure \
53
--prefix=/usr \
54
--sysconfdir=/etc \
55
--enable-cyrus-sasl \
56
--disable-gtkspell \
57
--disable-schemas-install \
58
--disable-meanwhile \
59
--disable-gnutls \
60
--disable-doxygen \
61
--disable-nm \
62
--disable-avahi \
63
--disable-dbus \
64
--disable-farstream \
65
--disable-vv \
66
--disable-gstreamer \
67
--disable-gstreamer-video \
68
--disable-gstreamer-interfaces \
69
--with-system-ssl-certs=/etc/ssl/certs \
70
--with-dynamic-prpls=irc,jabber,silc,simple,zephyr \
71
--disable-gevolution
72
make
73
}
74
75
package_pidgin-privacy(){
76
pkgdesc="Multi-protocol instant messaging client with enhanced privacy"
77
depends=('libpurple-privacy' 'startup-notification' 'libxss' 'libsm' 'hicolor-icon-theme' 'gtk2')
78
optdepends=('aspell: for spelling correction'
79
'pidgin-otr: for Off-the-Record Messaging support'
80
'arc-icon-theme: for better icon')
81
provides=('pidgin')
82
conflicts=('pidgin')
83
84
cd $_pkgbase-$pkgver
85
86
# For linking
87
make -C libpurple DESTDIR="$pkgdir" install-libLTLIBRARIES
88
89
make -C pidgin DESTDIR="$pkgdir" install
90
make -C doc DESTDIR="$pkgdir" install
91
92
# Remove files that are packaged in libpurle
93
make -C libpurple DESTDIR="$pkgdir" uninstall-libLTLIBRARIES
94
95
install -Dm 644 COPYING -t "${pkgdir}/usr/share/licenses/${_pkgname}"
96
}
97
98
package_libpurple-privacy(){
99
pkgdesc="IM library extracted from Pidgin with enhanced privacy"
100
depends=('libsasl' 'libidn' 'libnsl' 'nss' 'libxcrypt')
101
optdepends=('ca-certificates: SSL CA certificates'
102
'tk: Tcl/Tk scripting support')
103
provides=('libpurple')
104
conflicts=('libpurple')
105
106
cd $_pkgbase-$pkgver
107
108
for _dir in libpurple share/sounds share/ca-certs m4macros po; do
109
make -C "$_dir" DESTDIR="$pkgdir" install
110
done
111
112
install -Dm 644 COPYING -t "${pkgdir}/usr/share/licenses/${_pkglibname}"
113
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |