zcash

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the official GitHub repository and downloads Berkeley DB from Oracle's official domain; the non-whitelisted host is actually a legitimate vendor site, and the source is compiled, not executed as a prebuilt binary.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official GitHub repository and downloads Berkeley DB from Oracle's official domain; the non-whitelisted host is actually a legitimate vendor site, and the source is compiled, not executed as a prebuilt binary.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "https://download.oracle.com/berkeley-db/db-${_db_version}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nicola Squartini <tensor5@gmail.com>
    
      2# Maintainer: kpcyrd <kpcyrd[at]archlinux[dot]org>
    
      3
    
      4pkgname=zcash
    
      5pkgver=5.3.0
    
      6_commit=35186b00928f3ba994f0e66bb234c412cbffc7b6
    
      7_db_version=6.2.23
    
      8pkgrel=4
    
      9pkgdesc='Permissionless financial system employing zero-knowledge security'
    
      10arch=('x86_64')
    
      11url='https://z.cash/'
    
      12license=('MIT')
    
      13depends=('boost-libs' 'libevent' 'libsodium' 'zeromq')
    
      14makedepends=('boost' 'clang' 'cmake' 'cxxbridge' 'git' 'gmock' 'python' 'rust' 'utf8cpp' 'wget')
    
      15options=(!lto)
    
      16source=("git+https://github.com/zcash/zcash.git#commit=${_commit}"
    
      17        "https://download.oracle.com/berkeley-db/db-${_db_version}.tar.gz"
    
      18        'zcashd.service')
    
      19sha256sums=('SKIP'
    
      20            '47612c8991aa9ac2f6be721267c8d3cdccf5ac83105df8e50809daea24e95dc7'
    
      21            '7b0919ac447824199aff8c17b5a5799b46414818c6aed314506c5295d0ce9ccd')
    
      22
    
      23get_rust_target() {
    
      24    RUSTC_BOOTSTRAP=1 rustc -Z unstable-options --print target-spec-json | python -c 'import json,sys;obj=json.load(sys.stdin);print(obj["llvm-target"])'
    
      25}
    
      26
    
      27build() {
    
      28    cd "db-${_db_version}/build_unix"
    
      29
    
      30    ../dist/configure \
    
      31        --prefix=/ \
    
      32        --disable-shared \
    
      33        --enable-cxx \
    
      34        --disable-replication \
    
      35        --enable-option-checking \
    
      36        --with-pic
    
      37    make libdb_cxx-6.2.a libdb-6.2.a
    
      38    make DESTDIR="${srcdir}/db-root" install
    
      39
    
      40    cd "${srcdir}/${pkgname}"
    
      41
    
      42    CPPFLAGS="${CPPFLAGS} -I${srcdir}/db-root/include -I/usr/include/utf8cpp"
    
      43    LDFLAGS="${LDFLAGS} -L${srcdir}/db-root/lib"
    
      44
    
      45    export CC=/usr/bin/clang
    
      46    export CXX=/usr/bin/clang++
    
      47
    
      48    ./autogen.sh
    
      49    ./configure --prefix=/usr \
    
      50        --enable-online-rust
    
      51    cp /usr/share/cxxbridge/cxx.h src/rust/include/rust/
    
      52    make RUST_TARGET="$(get_rust_target)"
    
      53}
    
      54
    
      55package() {
    
      56    cd ${pkgname}
    
      57
    
      58    make DESTDIR="${pkgdir}" RUST_TARGET="$(get_rust_target)" install
    
      59
    
      60    for ext in '-cli' '-tx' 'd'; do
    
      61        install -Dm644 contrib/zcash${ext}.bash-completion \
    
      62            "${pkgdir}"/usr/share/bash-completion/completions/zcash${ext}
    
      63    done
    
      64
    
      65    install -Dm644 ../zcashd.service -t "${pkgdir}"/usr/lib/systemd/user
    
      66    install -Dm644 COPYING "${pkgdir}"/usr/share/licenses/${pkgname}/COPYING
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2