qv2ray

LOW

maintainer EEEntity 20 votes scanned 2026-10-19 00:03:55.276608

View on AUR

Why flagged

Package builds from the project's own GitHub repository, uses SKIP'd checksum for a git source which is common and expected, and performs standard build steps without executing untrusted remote code or installing prebuilt binaries.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): Package builds from the project's own GitHub repository, uses SKIP'd checksum for a git source which is common and expected, and performs standard build steps without executing untrusted remote code or installing prebuilt binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Neboer <rubinposter at gmail dot com>
    
      2# Contributor: DuckSoft <realducksoft at gmail dot com>
    
      3# Contributor: ArielAxionL <i at axionl dot me>
    
      4# Contributor: Leroy.H.Y <me at lhy0403 dot top>
    
      5pkgname=qv2ray
    
      6pkgver=2.7.0
    
      7pkgrel=1
    
      8pkgdesc="Cross-platform V2ray Client written in Qt (Stable Release)"
    
      9arch=('x86_64')
    
      10url='https://github.com/Qv2ray/Qv2ray'
    
      11license=('GPL3')
    
      12depends=('hicolor-icon-theme' 'qt5-base>5.11.0' 'grpc>=1.27.0' 'qt5-svg')
    
      13optdepends=('v2ray: use system v2ray core.')
    
      14makedepends=('git' 'make' 'qt5-tools' 'which' 'gcc' 'qt5-declarative'
    
      15             'grpc-cli>=1.27.0' 'cmake' 'ninja')
    
      16provides=('qv2ray')
    
      17conflicts=('qv2ray')
    
      18
    
      19source=('Qv2ray::git+https://github.com/Qv2ray/Qv2ray')
    
      20
    
      21sha512sums=('SKIP')
    
      22
    
      23pkgver() {
    
      24    printf "%s" $(cat ${srcdir}/Qv2ray/makespec/VERSION)
    
      25}
    
      26
    
      27prepare() {
    
      28    cd "${srcdir}/Qv2ray"
    
      29    git submodule update --recursive --init
    
      30}
    
      31
    
      32build() {
    
      33    export _QV2RAY_BUILD_INFO_="Qv2ray from AUR"
    
      34    export _QV2RAY_BUILD_EXTRA_INFO_="(Manual Build) $(uname -a | cut -d " " -f3,13)"
    
      35
    
      36    cd "${srcdir}/Qv2ray"
    
      37    mkdir -p build && cd build
    
      38    cmake .. \
    
      39        -DCMAKE_INSTALL_PREFIX=${pkgdir}/usr \
    
      40        -DQV2RAY_ZXING_PROVIDER="module" \
    
      41        -DQV2RAY_TRANSLATION_PATH="/usr/share/qv2ray/lang" \
    
      42        -DQV2RAY_DEFAULT_VASSETS_PATH="/usr/share/v2ray" \
    
      43        -DQV2RAY_DEFAULT_VCORE_PATH="/usr/bin/v2ray" \
    
      44        -DQV2RAY_DISABLE_AUTO_UPDATE=on \
    
      45        -DCMAKE_BUILD_TYPE=Release \
    
      46        -GNinja
    
      47    ninja
    
      48}
    
      49
    
      50package() {
    
      51    cd "${srcdir}/Qv2ray"
    
      52    ninja -C "build" install
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 00:03:55	Low	2
2026-10-18 23:23:07	Medium	1
2026-06-18 16:11:54	Clean	0