qgpgme1-qt5
LOW
maintainer andreas_baumann
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is downloaded from the official GnuPG project's own domain (gnupg.org), which is a trusted and project-appropriate host despite not being on a generic whitelist; the package builds from official source code and poses no executable or supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from the official GnuPG project's own domain (gnupg.org), which is a trusted and project-appropriate host despite not being on a generic whitelist; the package builds from official source code and poses no executable or supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:27
source=("https://www.gnupg.org/ftp/gcrypt/${_pkgbase}/${_pkgbase}-${pkgver}.tar.bz2"{,.sig})
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Andreas Baumann <mail@andreasbaumann.cc>
2
# Contributor: Tobias Powalowski <tpowa@archlinux.org>
3
# Contributor: Antonio Rojas <arojas@archlinux.org>
4
# Contributor: Roman Kyrylych <roman@archlinux.org>
5
# Contributor: Sarah Hay <sarah@archlinux.org>
6
7
pkgname=qgpgme1-qt5
8
_pkgbase=gpgme
9
pkgver=1.24.3
10
pkgrel=2
11
pkgdesc="Qt5 bindings for GPGme"
12
arch=('x86_64')
13
url='https://gnupg.org/software/gpgme/index.html'
14
license=(LGPL)
15
makedepends=(
16
'gnupg'
17
'libgpg-error'
18
'swig'
19
)
20
depends=(
21
'gpgme-1'
22
'qt5-base'
23
)
24
conflicts=('qgpgme-qt5')
25
validpgpkeys=('6DAA6E64A76D2840571B4902528897B826403ADA' # Werner Koch (dist signing 2020)
26
'AC8E115BF73E2D8D47FA9908E98E9B2D19C6C8BD') # Niibe Yutaka (GnuPG Release Key)
27
source=("https://www.gnupg.org/ftp/gcrypt/${_pkgbase}/${_pkgbase}-${pkgver}.tar.bz2"{,.sig})
28
sha256sums=('bfc17f5bd1b178c8649fdd918956d277080f33df006a2dc40acdecdce68c50dd'
29
'SKIP')
30
31
prepare() {
32
cd ${_pkgbase}-${pkgver}/
33
34
sed -i 's/-unknown//' autogen.sh
35
autoreconf -fi
36
}
37
38
build() {
39
cd ${_pkgbase}-${pkgver}
40
41
./configure \
42
--prefix=/usr \
43
--disable-fd-passing \
44
--disable-static \
45
--disable-gpgsm-test \
46
--enable-languages=cpp,qt5
47
make
48
}
49
50
package() {
51
cd ${_pkgbase}-${pkgver}
52
53
# lang/qt's install-time libtool relink of libqgpgme.so needs -lgpgmepp
54
# resolvable under $pkgdir/usr/lib. gpgme-1 (a depends= here) ships the
55
# runtime libgpgmepp.so.6 but deliberately no unversioned dev symlink
56
# (it's a headers-elsewhere runtime-only package), so install lang/cpp
57
# into $pkgdir first just to satisfy that relink, then strip it back out
58
# below -- gpgme-1 already provides the actual runtime library.
59
make -C lang/cpp DESTDIR="${pkgdir}" install
60
61
cd lang/qt
62
make DESTDIR="${pkgdir}" install
63
cd ..
64
65
rm -rf "${pkgdir}"/usr/include/gpgme++ \
66
"${pkgdir}"/usr/lib/libgpgmepp* \
67
"${pkgdir}"/usr/lib/cmake/Gpgmepp \
68
"${pkgdir}"/usr/lib/pkgconfig/gpgmepp.pc
69
70
mv "${pkgdir}"/usr/lib/cmake/QGpgme "${pkgdir}"/usr/lib/cmake/QGpgmeQt5
71
mv "${pkgdir}"/usr/lib/cmake/QGpgmeQt5/QGpgmeConfig.cmake "${pkgdir}"/usr/lib/cmake/QGpgmeQt5/QGpgmeQt5Config.cmake
72
mv "${pkgdir}"/usr/lib/cmake/QGpgmeQt5/QGpgmeConfigVersion.cmake "${pkgdir}"/usr/lib/cmake/QGpgmeQt5/QGpgmeQt5ConfigVersion.cmake
73
}
74
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |