zcash
LOW
maintainer orphaned
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from the official GitHub repository and downloads Berkeley DB from Oracle's official domain; the non-whitelisted host is actually a legitimate vendor site, and the source is compiled, not executed as a prebuilt binary.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official GitHub repository and downloads Berkeley DB from Oracle's official domain; the non-whitelisted host is actually a legitimate vendor site, and the source is compiled, not executed as a prebuilt binary.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
"https://download.oracle.com/berkeley-db/db-${_db_version}.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Nicola Squartini <tensor5@gmail.com>
2
# Maintainer: kpcyrd <kpcyrd[at]archlinux[dot]org>
3
4
pkgname=zcash
5
pkgver=5.3.0
6
_commit=35186b00928f3ba994f0e66bb234c412cbffc7b6
7
_db_version=6.2.23
8
pkgrel=4
9
pkgdesc='Permissionless financial system employing zero-knowledge security'
10
arch=('x86_64')
11
url='https://z.cash/'
12
license=('MIT')
13
depends=('boost-libs' 'libevent' 'libsodium' 'zeromq')
14
makedepends=('boost' 'clang' 'cmake' 'cxxbridge' 'git' 'gmock' 'python' 'rust' 'utf8cpp' 'wget')
15
options=(!lto)
16
source=("git+https://github.com/zcash/zcash.git#commit=${_commit}"
17
"https://download.oracle.com/berkeley-db/db-${_db_version}.tar.gz"
18
'zcashd.service')
19
sha256sums=('SKIP'
20
'47612c8991aa9ac2f6be721267c8d3cdccf5ac83105df8e50809daea24e95dc7'
21
'7b0919ac447824199aff8c17b5a5799b46414818c6aed314506c5295d0ce9ccd')
22
23
get_rust_target() {
24
RUSTC_BOOTSTRAP=1 rustc -Z unstable-options --print target-spec-json | python -c 'import json,sys;obj=json.load(sys.stdin);print(obj["llvm-target"])'
25
}
26
27
build() {
28
cd "db-${_db_version}/build_unix"
29
30
../dist/configure \
31
--prefix=/ \
32
--disable-shared \
33
--enable-cxx \
34
--disable-replication \
35
--enable-option-checking \
36
--with-pic
37
make libdb_cxx-6.2.a libdb-6.2.a
38
make DESTDIR="${srcdir}/db-root" install
39
40
cd "${srcdir}/${pkgname}"
41
42
CPPFLAGS="${CPPFLAGS} -I${srcdir}/db-root/include -I/usr/include/utf8cpp"
43
LDFLAGS="${LDFLAGS} -L${srcdir}/db-root/lib"
44
45
export CC=/usr/bin/clang
46
export CXX=/usr/bin/clang++
47
48
./autogen.sh
49
./configure --prefix=/usr \
50
--enable-online-rust
51
cp /usr/share/cxxbridge/cxx.h src/rust/include/rust/
52
make RUST_TARGET="$(get_rust_target)"
53
}
54
55
package() {
56
cd ${pkgname}
57
58
make DESTDIR="${pkgdir}" RUST_TARGET="$(get_rust_target)" install
59
60
for ext in '-cli' '-tx' 'd'; do
61
install -Dm644 contrib/zcash${ext}.bash-completion \
62
"${pkgdir}"/usr/share/bash-completion/completions/zcash${ext}
63
done
64
65
install -Dm644 ../zcashd.service -t "${pkgdir}"/usr/lib/systemd/user
66
install -Dm644 COPYING "${pkgdir}"/usr/share/licenses/${pkgname}/COPYING
67
}
68
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |