Last Reviews

5 review results, newest first.

Showing risky reviews only

Risk 4/5 · High keys/pgp/14F26682D0916CDD81E37B6D61B7B526D98F0353.asc

Comment

The change replaces the existing Mozilla release signing key material with a different, much larger PGP public key block that includes additional self-signatures and a new user ID ('No longer trust this key.'). For a package that relies on this key to verify upstream Firefox Nightly artifacts, swapping the trusted key material is a supply-chain integrity change: it can alter which releases are accepted or rejected, and if the new key is not the exact intended upstream replacement, it could enable acceptance of attacker-controlled signatures or break verification in a way that users may bypass. I did not see any obvious build-script execution or network abuse in this file, but the trust-anchor change itself is high impact and should be treated cautiously. The diff alone does not prove malicious intent, but it is a security-sensitive key rotation that needs independent validation against upstream Mozilla key announcements before being accepted.

@@ -12,53 +12,100 @@ blnJ6INpvYgsEZjV6CFG1EiDJDPu2Zxap8ep0iRMbBBZnpfZTn7SKAcurDJptxin
 CRclTcdOdi1iSZ35LZW0R2FKNnGL33u1IhxU9HRLw3XuljXCOZ84RLn6M+PBc1eZ
 suv1TA+Mn111yD3uDv/u/edZ/xeJccF6bYcMvUgRRZh0sgZ0ZT4b0Q6YcQARAQAB
 tC9Nb3ppbGxhIFNvZnR3YXJlIFJlbGVhc2VzIDxyZWxlYXNlQG1vemlsbGEuY29t
-PokCTwQTAQIAIgUCValABAIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AAIQkQ
-Ybe1JtmPA1MWIQQU8maC0JFs3YHje21ht7Um2Y8DU1CqD/9Gvr9Xu4uqsjDHRQWS
-fI0lqxElmFSRjF0awsPXzM7Q1rxV7dCxik4LeiOmpoVTOmqboo2/x5d938q7uPdY
-av2Q+RuNk2CG/LpXku9rgmTE7oszEqQliqKoXajUZ91rw19wrTwYXLgLQvzM3CUA
-O+Z0yjjfza2Yc0ZtNN+3sF5VpGsT3Fb14aYZDaNg6yPFvkyxp0B1lS4rwgL3lkeV
-QNHeAf0qqF9tBankGj3bgqK/5/YlTM2usb3x46bVBvwX2t4/NnYM5hEnI57inwam
-X6SiMJc2e2QmBzAnVrXJETrDL1HOl4GUJ6hC4tL3Yw2d7515BlSyRNkWhhdRp1/q
-9t1+ovSe48Ip2X2WF5/VA3ATfQhHKa3p+EkIV98VCMZ14x9KIIeBwjyJyFBuvOEE
-IYZHdsAdqf1zYRtD6m6obcBrRiNfoNsYmNY4joDrVupI96ksIxVpepXaZkQhplZ1
-mQ4eOdGtToIl1cb/4PibVgFnBgzrR4mQ27h4wzAwWdGweJZ/tuGoqm3C6TwfIgan
-ajiPyKqsVFUkRsr9y12EDcfUCUq6D182t/AJ+qE0JIGO73tXTdTbqPTgkyf2etnZ
-QQZum3L7w41NvfxZfn+gLrUGDBXwqLjovDJvt8iZTPPyMTzemOHuzf40Iq+9sf5V
-9PXZ/5X9+ymE3cTAbAk9MLd9fbkCDQRn0pB9ARAA5UjKHSxk88UtbGgVPRaE/MfD
-wGGCcIE11kCH35IzQCmrZVxApKMGMqK16s5O1zoRWHQraKRsYodDVK/A12xgvTVx
-KQlIk5GKD/UO7V6H7aeWjye63vFP/9X7YVDJYUIsN5C8uUCzdAcysxjFNzA2TeqL
-/PVnlDh7pF7ZopFTTQu1KiYPoIpbL2cBqpNE3PN2d0nAjILKyFfhttTMDMTtZuCH
-8TT8WAEbDzstghOrJTpRLiW+hRcH7z1fHAzE70jvgvXXyBcTLJvP4k3T/DzuFcAq
-doqNqxK+hsoTiZq7xJeqY47rozGIxoXheyavegjCjyr1bl36ED63bbmKmratlkSu
-Y8vjh14wJ4qZ6mMtNr0KjFfahWkNYY5gVHIlGQsPLIfg7eAKj/mq/is5Mmo8V8o+
-2uNYUkoZ/g/hQPQZIFfZD6Y5/ZcdawwkTi3xPuPFAJIBBQzC3ozXyHVq4ipx+S42
-90mFyXYa8nIIwhuQDcCiK4ppI+ChUKYl1tzoCj3J2YxQHlDWtikw0oIyy5U/05xf
-wWgcRUxc6+vR/pZ+P6IfK187ZVOqvD9yqgLK4+hKuDGOzX9xFLPmD19nTOs61DI0
-HnIndg9Mbe9rX9ct+WuM9xPhlSR6P2eQWkI1Z0RlVYP/Pe9cEZJXXU30J3LrRBsP
-jJm8ONXYZD53AAXWjUEAEQEAAYkEcgQYAQoAJhYhBBTyZoLQkWzdgeN7bWG3tSbZ
-jwNTBQJn0pB9AhsCBQkDwmcAAkAJEGG3tSbZjwNTwXQgBBkBCgAdFiEECb7tY/NG
-Ki3/qzuHXstkl8GiAlYFAmfSkH0ACgkQXstkl8GiAlb0jhAAlu/hGFvjHomXvnHY
-t+njr97d9lUOHNR0uMrwD9pxEXslEG4lUlFqKMnm2eB2SeaWZvN+qXLOwxZRyIDB
-UlG+KM0UN6Jx63nMmkFGxcRQC6DeJUIPUqVW8vOMKL0Rv2zrEJCNInwNkTTbSzjX
-B2q1vWfOIMBICSD5gfYPOlMRplU0zf240MptoktgiMoD0xXVgcCupSV0Wyih8F7j
-MhlEXK8wPsaavtebQhZgut+ad6ebUklgiS8ZR5Wg/x0SicBWEtXC/DC5+htXSp20
-x+FmyAXB/VdIcj0y0PjIBW0GoFOR8V5EucGMkr/LBjEaptp23VvnsjjLBNDXqhc2
-uVMXVK7QjyL9+jSL/2iE2Xeik3cttoRuFPfszjGnLgyAvYW2F11zaBa8X/xMVFpf
-DstotJHsfA75jQKk61X8K3hHMoS6VjkOlX1vUlAmGktyMzP6kEMAzcom6JXoFx+j
-Pk9mjAXLvhSYTTZXOT+jK4j+jgoyKHLRTNZBWQ5lNO7h442S2AaJk6dEV2IspWB4
-sQNdMt2Fu7AZLb7BfcjuUs/0BakrwCFzzV5TBTozB1t/B8nUQu0ppr8mYyNpaSvl
-oaunzx3x49H2NgDjtnarR6wHrulElV7QxxUmW70ZAarTlLuVkqzqaL10dPN4fC5r
-/8hccwrSzdaExTu8bAncTb6lOy1/wBAAtLCR7MPdByE9X7kIBRhjsKYxcHrPMhTX
-zAJLrVjxB0O+qa1Yd0xVOnjFPXh9Lpy8Hi4XNpwZAnsJUhZ5mDAQXNmJ6/d0qmdQ
-4aDRZBLCZBADQkKDr+pLQB5Q8g2OFa01xHu+gKoBh5FyOjjtQlyUP8oo1MKfbtu0
-dFoSalN1O0LqzGJUSUU5tvdr20derAtanyAn41n7qaWu+8faGbUIDJBMNFgLuc3r
-1AmsodHwcDcB5Hl+KBAcvC+Z9CVXZ6tkTXsZP4vm3QfFf8cpkKKb3U8Cmpr7uJjR
-4o8AbmJpwAGsGL3POH97HSi++7GwEMpQUJK7sciK+cBWt1L+Rs7WonkjcwEynR2V
-Do9Lot5khGHG2zRo89l52xfK2gvuQUshJ8nnkC6EmmyTP7nm6+ImGn8ffM0Fi1D5
-2YWanhFGT82+7TO/o4a1pnLozlfbg9vNv84CkEwvzhwSZveJmJ70nZlhbrz8P3qw
-/T3HoYi0ImUIh1BmRFzCaRDCC2r2wkPD3b+9IZ5h1Gf6gIDEnXh45sKxXBx8kBEu
-3jlu0SfH7NEIAcAdAelXqpMZPqeqDnte4z2I013JMYpFT4iSWBv0tHFUBB9ufm5d
-hvmPajHmmPG1tdN/0tujtGTKBxZIpk9aZiAawpLqOZeQNr9PI6U/GRtqSek9tgwH
-O1FPgm7RVTg=
-=SScT
+PokCTgQTAQoAOAIbAwIeAQIXgBYhBBTyZoLQkWzdgeN7bWG3tSbZjwNTBQJpobDu
+BQsJCAcCBhUKCQgLAgQWAgMBAAoJEGG3tSbZjwNTpYQQAK+60Ky1K+VzJMVvjTed
+chr/ACHsjRXDHfJHWp2hDBDgGLjr0Muwo3XIaNyWhW1fwmxvyMULFVmWGb7qGTeI
+82O8yhY3bLMN6iA+XZwf1PsCZYHTls2KTYRUHYixobOA+9L0mWqWriNHeoBXe3c+
+SZ2jNYe/o4IR1X/zeVVpVkUqpzKcKmhpDOfgWKZBxrBRFUm0wJnFrL+AcjVpeQi8
+CreR1AXzyRWT3pIGfpYilfTNSZNy7e3oruplcu0Jk3aDdtTsJP95aej7nyI1eBdA
+k2hoMe4o2jCweaef5LO0y8u6G6Kie9/LUAqQZVQuU7Zce0m0l9MNPujYv1pUy5Rk
+MxtRyrUOJQLP60a1f1WZgU2YOm9OgS6gO+NoZ7fr4/5wj3C8Y7Hyzn7I1KXkvj+v
+6CF6u45xDPdfC5qj9p5HAE81bPmUpXFkeeIwn8La3NJoVjiagl7OxuoFi27F4oKS
+GxnArPtIoiQYuIVsZ2pPvkhPLt2lLXbi5vGHfPKhK/kg/mvkUshiCK+jTpYZ078e
+g+meCFXOoRNH6Qkd7Q1MgrKzOGAkuRVNWtnx1Ata8lxEqYuhaUlqW7okd1fNSdug
+htvZH5TgDUjlzkAS1eLsFIRCqZIVBRUXgQvU02zt2OPdBuNgiXqRbZcSmsyKs1X2
+2RG5i9WmTtP6Rv+ZL61pGsVAuQINBGfSkH0BEADlSModLGTzxS1saBU9FoT8x8PA
+YYJwgTXWQIffkjNAKatlXECkowYyorXqzk7XOhFYdCtopGxih0NUr8DXbGC9NXEp
+CUiTkYoP9Q7tXoftp5aPJ7re8U//1fthUMlhQiw3kLy5QLN0BzKzGMU3MDZN6ov8
+9WeUOHukXtmikVNNC7UqJg+gilsvZwGqk0Tc83Z3ScCMgsrIV+G21MwMxO1m4Ifx
+NPxYARsPOy2CE6slOlEuJb6FFwfvPV8cDMTvSO+C9dfIFxMsm8/iTdP8PO4VwCp2
+io2rEr6GyhOJmrvEl6pjjuujMYjGheF7Jq96CMKPKvVuXfoQPrdtuYqatq2WRK5j
+y+OHXjAnipnqYy02vQqMV9qFaQ1hjmBUciUZCw8sh+Dt4AqP+ar+KzkyajxXyj7a
+41hSShn+D+FA9BkgV9kPpjn9lx1rDCROLfE+48UAkgEFDMLejNfIdWriKnH5Ljb3
+SYXJdhrycgjCG5ANwKIrimkj4KFQpiXW3OgKPcnZjFAeUNa2KTDSgjLLlT/TnF/B
+aBxFTFzr69H+ln4/oh8rXztlU6q8P3KqAsrj6Eq4MY7Nf3EUs+YPX2dM6zrUMjQe
+cid2D0xt72tf1y35a4z3E+GVJHo/Z5BaQjVnRGVVg/8971wRklddTfQncutEGw+M
+mbw41dhkPncABdaNQQARAQABiQRyBBgBCgAmFiEEFPJmgtCRbN2B43ttYbe1JtmP
+A1MFAmfSkH0CGwIFCQPCZwACQAkQYbe1JtmPA1PBdCAEGQEKAB0WIQQJvu1j80Yq
+Lf+rO4dey2SXwaICVgUCZ9KQfQAKCRBey2SXwaICVvSOEACW7+EYW+MeiZe+cdi3
+6eOv3t32VQ4c1HS4yvAP2nEReyUQbiVSUWooyebZ4HZJ5pZm836pcs7DFlHIgMFS
+Ub4ozRQ3onHrecyaQUbFxFALoN4lQg9SpVby84wovRG/bOsQkI0ifA2RNNtLONcH
+arW9Z84gwEgJIPmB9g86UxGmVTTN/bjQym2iS2CIygPTFdWBwK6lJXRbKKHwXuMy
+GURcrzA+xpq+15tCFmC635p3p5tSSWCJLxlHlaD/HRKJwFYS1cL8MLn6G1dKnbTH
+4WbIBcH9V0hyPTLQ+MgFbQagU5HxXkS5wYySv8sGMRqm2nbdW+eyOMsE0NeqFza5
+UxdUrtCPIv36NIv/aITZd6KTdy22hG4U9+zOMacuDIC9hbYXXXNoFrxf/ExUWl8O
+y2i0kex8DvmNAqTrVfwreEcyhLpWOQ6VfW9SUCYaS3IzM/qQQwDNyibolegXH6M+
+T2aMBcu+FJhNNlc5P6MriP6OCjIoctFM1kFZDmU07uHjjZLYBomTp0RXYiylYHix
+A10y3YW7sBktvsF9yO5Sz/QFqSvAIXPNXlMFOjMHW38HydRC7SmmvyZjI2lpK+Wh
+q6fPHfHj0fY2AOO2dqtHrAeu6USVXtDHFSZbvRkBqtOUu5WSrOpovXR083h8Lmv/
+yFxzCtLN1oTFO7xsCdxNvqU7LX/AEAC0sJHsw90HIT1fuQgFGGOwpjFwes8yFNfM
+AkutWPEHQ76prVh3TFU6eMU9eH0unLweLhc2nBkCewlSFnmYMBBc2Ynr93SqZ1Dh
+oNFkEsJkEANCQoOv6ktAHlDyDY4VrTXEe76AqgGHkXI6OO1CXJQ/yijUwp9u27R0
+WhJqU3U7QurMYlRJRTm292vbR16sC1qfICfjWfuppa77x9oZtQgMkEw0WAu5zevU
+Cayh0fBwNwHkeX4oEBy8L5n0JVdnq2RNexk/i+bdB8V/xymQopvdTwKamvu4mNHi
+jwBuYmnAAawYvc84f3sdKL77sbAQylBQkruxyIr5wFa3Uv5GztaieSNzATKdHZUO
+j0ui3mSEYcbbNGjz2XnbF8raC+5BSyEnyeeQLoSabJM/uebr4iYafx98zQWLUPnZ
+hZqeEUZPzb7tM7+jhrWmcujOV9uD282/zgKQTC/OHBJm94mYnvSdmWFuvPw/erD9
+PcehiLQiZQiHUGZEXMJpEMILavbCQ8Pdv70hnmHUZ/qAgMSdeHjmwrFcHHyQES7e
+OW7RJ8fs0QgBwB0B6Veqkxk+p6oOe17jPYjTXckxikVPiJJYG/S0cVQEH25+bl2G
++Y9qMeaY8bW103/S26O0ZMoHFkimT1pmIBrCkuo5l5A2v08jpT8ZG2pJ6T22DAc7
+UU+CbtFVOIkCUgQoAQoAPBYhBBTyZoLQkWzdgeN7bWG3tSbZjwNTBQJqdGyCHh0C
+V2Ugbm8gbG9uZ2VyIHRydXN0IHRoaXMga2V5LgAKCRBht7Um2Y8DU11HEACFwqH7
+UhVmLoPhZrX5EJvCRUQOzb3CvRXFi6ZJ6J204+VxYXY+VxAHWmAj4Yre/IeYjFtZ
+xBLfTQI7lAspqiGHox4B9RuUwMvm6pnHkMLliY8tSSeFff1GPikVu27TswECDRX1
+xWCVP/Z8gn/E6Eraa2vwt0mC/9dWobC/vm5hsdmlxf5dwgcLkIoZKOgJoPlWygo0
+9HXczXGOh2g1rv4GVm38shlpTbf05ve6JEvySaF7F+653c6KkQT7/q6SU91uux34
+JT2MvtaVDHxvK77fTZAX+QOaJyLO9I+wNDbUsIF73h9qQQsZqHBk4UGKoe+S5Kkl
+gkhnZeUwSG4gSOEkj29hOU+emwSiSLX1PQoeuqo5P+G/f7YktuSSzv8rHVHRdMTO
+hL1Y3rgisuD6HmKqWt09mKTsjGIx6PToccPSJKHu8ehlQxDGwSon2cXOSSsJoKQr
+T4U9cvYy2ueCjserD594YJi/A5Dj6aMyF5TuYlFd3jLFxCZWpgUCX6OfMkRHMofu
+5sewjNj/TvElUhPdL7LMNbP9L7/aYMywdH5A1PEvVJJuI3ymfR44aRnE2aEsgvj+
+PznDO8KCH9XfbQdFFfIdejS6IIJ8hdapupqT5pfIj3bZY9/NCLTKmUCIra07WosI
+fzYa2n/IzVDURGLp1qxfGzeBhPPtGqbZIteaKbkCDQRqdGqkARAAxeUfl3aelP0r
+qK5gRa/GklAInaeX/ZABDDRbQFrQ2nEaf7lgClNaXAtm0zrjFw3SjqvthxvZigBg
+UT+2SRARqxRzI/GwCvUWCeD3ZpE28ELeha1bNRtni+D4yDOmOA0AC/J0IbhcqeI0
+M12GEaoItmtMvyTIjkMhiocAo0cAJSawVKZcopjyeF35rRik4/9q3BkKuJiHQ7wr
+OvmDMmUcvK/EvMGRfsrC6bBG6kD8IMxtrsmxfADL+I3AU/nO1m/VoELJ6wJUI7Ea
+EYHEvLMMCM5vmV1DAcIL+c0czuRtmAqbs7r8f9P1NMdXyZdX6W1tO/OXPgfoCGTF
+pmN4HcZdCaaiKSqR4+Rl10gVe9h5rDgVM7ovLtFMdipRZTL0S/CF+VT6D8DlM0Gs
+yTNeQfuYk6BdyZmJSEaHe9wUB6049DZMExTvWo0WQrXqBzmDmGP6N5SRjRcEiJKh
+92eMGuj9mNsaaHox9MbBNuWdjRKdh9eP5MmnCQRdB6tk4fwaLuzLUa93s+N87e4d
+L+Rii9ySwFn8+ZIrf1MdfIeCJqs7JfyknpQyTOHlFBoqTu3RX6juTFP47qjbfEY7
+3CAzvAp7ezPo+d2wDbETyWONvBYg956nPtlkkhG5kWlqvEszc+csDXniUy2nN1L8
+VJVJrJDdvlCDPEBEh86b+XZ+Lu8dtOcAEQEAAYkEcgQYAQoAJhYhBBTyZoLQkWzd
+geN7bWG3tSbZjwNTBQJqdGqkAhsCBQkDwmcAAkAJEGG3tSbZjwNTwXQgBBkBCgAd
+FiEEgn5lhghnlhjNNJ+TZ45FXXZ2eqMFAmp0aqQACgkQZ45FXXZ2eqPDbw/+Lb5n
+g/VGisSSokJsy9cjwR09OTN+KSN7NrfU9LkiX4Y8/AxMw67oroU6cMHk8+IjlPTQ
+aAUhs5sWH6xROOCF74DSjFCraB1gBV7ft0hDD3mDslxQYVgQVUOhTvuSmvHByn02
+4VPU4i0Icgh8LpVjGaiyB4BiGl91rgxEMSDW6Vl0yG5Mi5pdxZR+wXkQsyQRmZtU
+3paLGErt8Ucm73ma+JIYUhja70bkSh2AU99KpvVTZHx3sb84PlmPa4n+dYkwj5wZ
+O13T7JR0nuBNv7rmWnzgiB87F5at09Pw6s3L8O3pWhlkYhvrcaOG4ZxJzC+h+Ole
+7O4Km/rHUlFVYph7qu1hVp6I3MPSHIOsltsf8heg7wlxhYVGz9RhYIMCzCINIG0l
+fcMkGvOPftO0faCF1I65ZYgdzdAPMuRdPAwig+hXz42982arsma+n9+0ckqDF4LD
+OnOK5Sj20eg5LOQo4OnRy35gqyzl9/GwyScYWMrNTV0UpR99fMnJtMHYqLtjvcFf
+LF013Ejiv3XNDPoPkHAP9tz859+ZToiJVBxzV5Q9vAj4W48Yx6HlCXlfqeprsfeB
+WU6WhUo9Q4LTLT+4UKMYUemnRfp0SvK80s8gMU6s0kGKTaxOaCb39EJMR0nFUd7j
+36PFYvVCGFUEYaGlLCBPI5akyt3u1y34ie79YxocHA/+NM8kkJpUBn8Ug8ewAUe+
+6kE2P8Y811ChqZemHnC1GFdhQqTWELlxh00XCYx6XsyRZKc72aqYuu2WVw1+F8+c
+QV2CNFAgJZ59TKzIfOycoKOc4HMUuwbmQPGHA+qm7ZDbb7j6urzrJ8n+3BWuiG3G
+VU33gTfOHoctKMuplm5WLdJxrWV3N/iaDX3gqhkWeYh2aqKX+8S9HEvtNfrjW4pH
+zMJ5ddIVYz985fUyPg/B5tKbJCfJ2aqGQa7qc7OxUePjUx/eic0MWRcle7/i2sjs
+3/jNBT637KWZB/d98QAYif/fAQQiXIgAdSgwEElH5fpZuWRMzol4DHjlbcoUlI1v
+U4H/ahELYLNfk3EPi861nCgrwD11xHcTb1gre2tHNTHQK3wQoykKu/+ubIm03ROp
+6kfsGg5WdeDdyGwEn/drCK3T/0uCri/Ue4AhhX9t8TbyAAPQ0ZooIRU9YsplvmmJ
+9FpNlBUpUorMtU1E1eaenwiCdoqEEwPdudrMgKRKd9Bco9owuRKeD70zg9XJjeud
+w2C11cLCjMqA3L1oEOwxSRsYaZEijqDFYmmY0KRQfcxJ9Vt/PfzolxiHIflbTPY4
+Sb6RHrnOF2mmd+BA9kSLTtkLhJEU6VtmD8XoDH1I1TUP+ObieKnBQg9/7LQVQfWd
+bK+W3WvvXQQLUU9k4IsERbA=
+=/Lt1
 -----END PGP PUBLIC KEY BLOCK-----

Risk 4/5 · High PKGBUILD

masterpdfeditor Result #2302

Comment

High-confidence supply-chain/integrity regression. The PKGBUILD now fetches the SHA1 checksum at build time via `curl` from the vendor website instead of pinning it in the source array. That bypasses Arch's checksum verification model and makes the build trust a live network response, which can be altered or fail nondeterministically. The checksum extraction also references `${_patchver}`, which is undefined in this snippet, further weakening reliability. The source URL itself remains HTTPS and on the vendor domain, and the qt5->qt6 dependency update is not inherently suspicious, but the dynamic checksum retrieval is a clear packaging integrity issue.

@@ -6,17 +6,19 @@
 
 pkgname=masterpdfeditor
 pkgver=5.9.99
-pkgrel=3
+pkgrel=4
 pkgdesc='A complete solution for viewing, creating and editing PDF files'
 url='https://code-industry.net/free-pdf-editor/'
 arch=('x86_64')
 license=('custom')
 makedepends=('patchelf')
-source_x86_64=("https://code-industry.net/public/master-pdf-editor-${pkgver}-qt5.x86_64.tar.gz")
-sha1sums_x86_64=('bf84fca45c8e416f959b9667a21baf45d87e0f39')
+source_x86_64=("https://code-industry.net/public/master-pdf-editor-${pkgver}-qt6.11.1.x86_64.tar.gz")
+_checksum=$(curl 'https://code-industry.net/checksum-information/' | grep -oP '[a-f0-9]{40}(?=.*master-pdf-editor-'"${pkgver}${_patchver}"'-qt6.11.1.x86_64.tar.gz)')
+sha1sums_x86_64=("${_checksum% *}")
 
 package() {
-  depends=('libgl' 'pkcs11-helper' 'qt5-base' 'qt5-svg' 'qt5-declarative' 'sane')
+  depends=('libgl' 'pkcs11-helper' 'qt6-base' 'qt6-svg' 'qt6-declarative' 'sane')
+  optdepends=('qt6-wayland: Wayland platform plugin')
 
   install -d "$pkgdir"{/opt/,/usr/bin/}
   cp -a --no-preserve=ownership master-pdf-editor-${pkgver%%.*} "$pkgdir/opt/"

Risk 3/5 · Elevated PKGBUILD

bottles Result #1943

Comment

The change is mostly packaging cleanup, but it also removes a patch and replaces it with in-tree source edits that force Bottles to believe it is never running in Flatpak/CPAK/container contexts. Specifically, prepare() now rewrites runtime checks in bottles.py, cli.py, and backend/globals.py to set CPAK_CONTAINER_ID and make the container-detection function always return False. That is a behavioral bypass of upstream environment/sandbox detection, which could disable safety-related code paths or alter how the app handles sandboxed execution. I did not find evidence of network fetches, privilege escalation, or install-script persistence in this diff, so the risk is moderate rather than severe.

@@ -38,48 +39,64 @@ depends=(
   vkbasalt-cli
 )
 makedepends=(
-  meson
-  ninja
+  appstream-glib
   blueprint-compiler
-  gobject-introspection
   desktop-file-utils
-  appstream-glib
   gettext
   glib2-devel
+  meson
 )
 optdepends=(
-  'vulkan-tools: vkcube test / Vulkan info'
-  'xorg-xdpyinfo: display info detection'
+  '7zip: extract 7z archives'
+  'gamescope: gamescope session integration'
   'imagemagick: icon/image conversion'
-  'vmtouch: preload bottle files into memory'
+  'lib32-alsa-lib: 32-bit ALSA for downloaded runners'
+  'lib32-fontconfig: 32-bit font rendering for downloaded runners'
+  'lib32-glibc: 32-bit support for downloaded runners'
+  'lib32-gnutls: 32-bit TLS for downloaded runners'
+  'lib32-libglvnd: 32-bit OpenGL/X11 for downloaded runners'
+  'lib32-libpulse: 32-bit PulseAudio for downloaded runners'
+  'lib32-vulkan-driver: 32-bit Vulkan driver (DXVK) for downloaded runners'
+  'lib32-vulkan-icd-loader: 32-bit Vulkan loader (DXVK) for downloaded runners'
   'mangohud: performance overlay'
-  'gamemode: feral gamemode integration'
-  'gamescope: gamescope session integration'
+  'python-pysocks: SOCKS proxy support'
+  'umu-launcher: manage UMU Launcher prefixes'
+  'vmtouch: preload bottle files into memory'
+  'vulkan-tools: vkcube test / Vulkan info'
+  'wine: use system installed wine as runner for bottles'
+  'xorg-xdpyinfo: display info detection'
   'xterm: fallback terminal for "Run executable in terminal"'
 )
 source=(
   "${_pkgname}-${pkgver}.tar.gz::https://github.com/bottlesdevs/Bottles/archive/refs/tags/${pkgver}.tar.gz"
-  remove-flatpak-checks.patch
 )
 sha256sums=(
-  8d81cc6a3f25675ef15f7ec35fadba247f17634b016be7eead6af536aee8c536
-  5b4a8818bdac2bfb46615959f02ef4dc94cfcc30768357ed56e91d15842d0ea7
+  "607994bbc29d7e8f3b0d3cd852b7a97a0f1e2c90e4dcacefc2e8ce632709e8db"
 )
 
 prepare() {
-  # Fix warning about flatpak and sandbox environment
-  patch --forward --directory="${srcdir}/${_pkgname}-${pkgver}" --strip=1 --input="${srcdir}/remove-flatpak-checks.patch"
+  cd "${srcdir}/${_pkgname}-${pkgver}"
+
+  grep -q "fs.is_file('/' + '.flatpak-info')" bottles/frontend/meson.build
+  sed -i "s|fs.is_file('/' + '.flatpak-info')|fs.is_file(meson.current_source_dir() / 'meson.build')|" \
+    bottles/frontend/meson.build
+
+  grep -q '^import os$' bottles/frontend/bottles.py bottles/frontend/cli/cli.py
+  sed -i '/^import os$/a os.environ.setdefault("CPAK_CONTAINER_ID", "1")' \
+    bottles/frontend/bottles.py bottles/frontend/cli/cli.py
+
+  grep -q 'return "FLATPAK_ID" in os.environ or is_cpak()' bottles/backend/globals.py
+  sed -i 's|return "FLATPAK_ID" in os.environ or is_cpak()|return False|' \
+    bottles/backend/globals.py
 }
 
 build() {
-  cd "${srcdir}/${_pkgname}-${pkgver}"
-  meson setup --prefix='/usr' build
-  ninja -C build
+  arch-meson "${_pkgname}-${pkgver}" build
+  meson compile -C build
 }
 
 package() {
-  cd "${srcdir}/${_pkgname}-${pkgver}"
-  DESTDIR="${pkgdir}" ninja -C build install
+  meson install -C build --destdir "${pkgdir}"
 }
 
 # vim: set ft=sh ts=2 sw=2 et:

Risk 3/5 · Elevated sanitize.patch

ventoy-bin Result #749

Comment

The patch is a cleanup of Ventoy upstream shell scripts, but it also removes several safety/validation checks and changes logging behavior. In Ventoy2Disk.sh it drops the guard that ensured the script is run from the released install package, the decompression/setup steps for bundled tools, and the explicit bash/ash invocation plus directory restoration, replacing them with a direct call to ./tool/VentoyWorker.sh. That makes execution more dependent on the caller’s current environment and working directory, which is a packaging/integrity regression, though not an obvious backdoor. In VentoyWeb.sh it removes the root check and redirects logs to /var/log/ventoy.log, which is a broader system write target and could affect system state outside the package directory. The patch also removes a mips64 path in VentoyPlugson.sh and a tool self-test in ventoy_lib.sh, but those are lower risk. Overall I see moderate risk from weakened safety checks and external log writes, but no clear malicious payload.

@@ -6,8 +6,8 @@ Let me do some optimisations.
 If you are interested to improve this patch, welcome to mail me.
 
 diff -Npur a/tool/ventoy_lib.sh b/tool/ventoy_lib.sh
---- a/tool/ventoy_lib.sh	2026-04-05 09:27:04.000000000 -0600
-+++ b/tool/ventoy_lib.sh	2026-04-06 10:03:00.691008472 -0600
+--- a/tool/ventoy_lib.sh	2026-07-24 06:59:22.000000000 -0600
++++ b/tool/ventoy_lib.sh	2026-07-24 09:00:04.344697720 -0600
 @@ -51,31 +51,6 @@ vtoy_gen_uuid() {
  }

Risk 3/5 · Elevated arch-core.patch

pi-hole-core Result #285

Comment

The patch changes logrotate targets from /var/log/pihole to /run/log/pihole and switches from copytruncate to create, which is a packaging/runtime behavior change but not inherently malicious. The added sudoers file grants the pihole user passwordless execution of /usr/bin/pihole as root, which is a significant privilege-escalation/persistence surface if the package installs that file or enables it automatically. However, in the provided diff hunk the sudoers file is only introduced as a template and there is no evidence here of automatic installation or additional commands beyond the expected pihole binary. Overall this is a moderate-risk change because it introduces a root-privilege mechanism that must be carefully justified and audited in surrounding packaging logic.

@@ -83,25 +83,25 @@ diff -uprN pi-hole-6.3/advanced/Templates/logrotate pi-hole-6.3.cust/advanced/Te
 +/run/log/pihole/pihole.log {
      # su #
      daily
-     copytruncate
-@@ -9,7 +9,7 @@
-     nomail
+     create 640 pihole pihole
+@@ -13,7 +13,7 @@
  }
- 
+
+ # FTL.log and webserver.log are opened and closed for each line, therefore no postrotate is needed
 -/var/log/pihole/FTL.log {
 +/run/log/pihole/FTL.log {
      # su #
      weekly
-     copytruncate
-@@ -20,7 +20,7 @@
+     create 640 pihole pihole
+@@ -24,7 +24,7 @@
      nomail
  }
- 
+
 -/var/log/pihole/webserver.log {
 +/run/log/pihole/webserver.log {
      # su #
      weekly
-     copytruncate
+     create 640 pihole pihole
 diff -uprN pi-hole-6.3/advanced/Templates/pihole.sudo pi-hole-6.3.cust/advanced/Templates/pihole.sudo
 --- pi-hole-6.3/advanced/Templates/pihole.sudo	1970-01-01 01:00:00.000000000 +0100
 +++ pi-hole-6.3.cust/advanced/Templates/pihole.sudo	2025-11-27 23:02:14.748944993 +0100