qgpgme1-qt5

maintainer andreas_baumann · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is downloaded from the official GnuPG project's own domain (gnupg.org), which is a trusted and project-appropriate host despite not being on a generic whitelist; the package builds from official source code and poses no executable or supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from the official GnuPG project's own domain (gnupg.org), which is a trusted and project-appropriate host despite not being on a generic whitelist; the package builds from official source code and poses no executable or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=("https://www.gnupg.org/ftp/gcrypt/${_pkgbase}/${_pkgbase}-${pkgver}.tar.bz2"{,.sig})

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andreas Baumann <mail@andreasbaumann.cc>
    
      2# Contributor: Tobias Powalowski <tpowa@archlinux.org>
    
      3# Contributor: Antonio Rojas <arojas@archlinux.org>
    
      4# Contributor: Roman Kyrylych <roman@archlinux.org>
    
      5# Contributor: Sarah Hay <sarah@archlinux.org>
    
      6
    
      7pkgname=qgpgme1-qt5
    
      8_pkgbase=gpgme
    
      9pkgver=1.24.3
    
      10pkgrel=2
    
      11pkgdesc="Qt5 bindings for GPGme"
    
      12arch=('x86_64')
    
      13url='https://gnupg.org/software/gpgme/index.html'
    
      14license=(LGPL)
    
      15makedepends=(
    
      16  'gnupg'
    
      17  'libgpg-error'
    
      18  'swig'
    
      19)
    
      20depends=(
    
      21  'gpgme-1'
    
      22  'qt5-base'
    
      23)
    
      24conflicts=('qgpgme-qt5')
    
      25validpgpkeys=('6DAA6E64A76D2840571B4902528897B826403ADA'  # Werner Koch (dist signing 2020)
    
      26              'AC8E115BF73E2D8D47FA9908E98E9B2D19C6C8BD') # Niibe Yutaka (GnuPG Release Key)
    
      27source=("https://www.gnupg.org/ftp/gcrypt/${_pkgbase}/${_pkgbase}-${pkgver}.tar.bz2"{,.sig})
    
      28sha256sums=('bfc17f5bd1b178c8649fdd918956d277080f33df006a2dc40acdecdce68c50dd'
    
      29            'SKIP')
    
      30
    
      31prepare() {
    
      32  cd ${_pkgbase}-${pkgver}/
    
      33
    
      34  sed -i 's/-unknown//' autogen.sh
    
      35  autoreconf -fi
    
      36}
    
      37
    
      38build() {
    
      39  cd ${_pkgbase}-${pkgver}
    
      40
    
      41  ./configure \
    
      42    --prefix=/usr \
    
      43    --disable-fd-passing \
    
      44    --disable-static \
    
      45    --disable-gpgsm-test \
    
      46    --enable-languages=cpp,qt5
    
      47  make
    
      48}
    
      49
    
      50package() {
    
      51  cd ${_pkgbase}-${pkgver}
    
      52
    
      53  # lang/qt's install-time libtool relink of libqgpgme.so needs -lgpgmepp
    
      54  # resolvable under $pkgdir/usr/lib. gpgme-1 (a depends= here) ships the
    
      55  # runtime libgpgmepp.so.6 but deliberately no unversioned dev symlink
    
      56  # (it's a headers-elsewhere runtime-only package), so install lang/cpp
    
      57  # into $pkgdir first just to satisfy that relink, then strip it back out
    
      58  # below -- gpgme-1 already provides the actual runtime library.
    
      59  make -C lang/cpp DESTDIR="${pkgdir}" install
    
      60
    
      61  cd lang/qt
    
      62  make DESTDIR="${pkgdir}" install
    
      63  cd ..
    
      64
    
      65  rm -rf "${pkgdir}"/usr/include/gpgme++ \
    
      66         "${pkgdir}"/usr/lib/libgpgmepp* \
    
      67         "${pkgdir}"/usr/lib/cmake/Gpgmepp \
    
      68         "${pkgdir}"/usr/lib/pkgconfig/gpgmepp.pc
    
      69
    
      70  mv "${pkgdir}"/usr/lib/cmake/QGpgme "${pkgdir}"/usr/lib/cmake/QGpgmeQt5
    
      71  mv "${pkgdir}"/usr/lib/cmake/QGpgmeQt5/QGpgmeConfig.cmake "${pkgdir}"/usr/lib/cmake/QGpgmeQt5/QGpgmeQt5Config.cmake
    
      72  mv "${pkgdir}"/usr/lib/cmake/QGpgmeQt5/QGpgmeConfigVersion.cmake "${pkgdir}"/usr/lib/cmake/QGpgmeQt5/QGpgmeQt5ConfigVersion.cmake
    
      73}
    
      74

Changes since previous scan

--- PKGBUILD @ 2026-06-20 00:18
+++ PKGBUILD @ 2026-08-03 00:08
@@ -7,7 +7,7 @@
 pkgname=qgpgme1-qt5
 _pkgbase=gpgme
 pkgver=1.24.3
-pkgrel=1
+pkgrel=2
 pkgdesc="Qt5 bindings for GPGme"
 arch=('x86_64')
 url='https://gnupg.org/software/gpgme/index.html'
@@ -48,9 +48,24 @@
 }
 
 package() {
-  cd ${_pkgbase}-${pkgver}/lang/qt
+  cd ${_pkgbase}-${pkgver}
 
+  # lang/qt's install-time libtool relink of libqgpgme.so needs -lgpgmepp
+  # resolvable under $pkgdir/usr/lib. gpgme-1 (a depends= here) ships the
+  # runtime libgpgmepp.so.6 but deliberately no unversioned dev symlink
+  # (it's a headers-elsewhere runtime-only package), so install lang/cpp
+  # into $pkgdir first just to satisfy that relink, then strip it back out
+  # below -- gpgme-1 already provides the actual runtime library.
+  make -C lang/cpp DESTDIR="${pkgdir}" install
+
+  cd lang/qt
   make DESTDIR="${pkgdir}" install
+  cd ..
+
+  rm -rf "${pkgdir}"/usr/include/gpgme++ \
+         "${pkgdir}"/usr/lib/libgpgmepp* \
+         "${pkgdir}"/usr/lib/cmake/Gpgmepp \
+         "${pkgdir}"/usr/lib/pkgconfig/gpgmepp.pc
 
   mv "${pkgdir}"/usr/lib/cmake/QGpgme "${pkgdir}"/usr/lib/cmake/QGpgmeQt5
   mv "${pkgdir}"/usr/lib/cmake/QGpgmeQt5/QGpgmeConfig.cmake "${pkgdir}"/usr/lib/cmake/QGpgmeQt5/QGpgmeQt5Config.cmake

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 09:17:30	MEDIUM	1
2026-06-20 00:18:46	CLEAN	2
2026-06-19 23:51:18	CLEAN	2
2026-06-19 19:07:35	LOW	2
2026-06-18 16:11:54	MEDIUM	1