depends: Update URL for `qrencode` package source tarball
What the developer wrote
Authored by Hennadii Stepanov
depends: Update URL for `qrencode` package source tarball
The https://fukuchi.org/ homepage no longer links to the source tarball,
and previously available files appear to have been removed. The homepage
now instructs users to download source tarballs from the GitHub releases
page instead.
The diff between the source trees is immaterial.
What changed, and why it matters
This commit simply changes the download location for a third-party QR-code library used in Bitcoin Core's build system. The old website no longer hosts the source file, so the build script now fetches the same library version from GitHub instead. The commit message explicitly states the difference between the two source trees is immaterial, and the change is accompanied by a matching SHA-256 hash update. There is no indication of a security vulnerability or malicious change.
No security action needed. Verify the new SHA-256 hash matches the official libqrencode v4.1.1 GitHub release tarball if desired, and ensure reproducible builds are unaffected.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch updates depends/packages/qrencode.mk to point the qrencode 4.1.1 source tarball download to GitHub releases instead of fukuchi.org. It adds a _download_file variable, updates _download_path, and changes the _sha256_hash from da448ed4f52aba6bcb0cd48cac0dd51b8692bccc4cd127431402fca6f8171e8e to 5385bc1b8c2f20f3b91d258bf8ccc8cf62023935df2d2676b5b67049f31a049c. The commit message says the source tree diff is immaterial, implying the new tarball is equivalent/repacked. No code changes affect runtime behavior.
Changed components
depends/packages/qrencode.mkInspect captured patch +3 / −2
diff --git a/depends/packages/qrencode.mk b/depends/packages/qrencode.mk
index e3f61409..9aae62f0 100644
--- a/depends/packages/qrencode.mk
+++ b/depends/packages/qrencode.mk
@@ -1,8 +1,9 @@
package=qrencode
$(package)_version=4.1.1
-$(package)_download_path=https://fukuchi.org/works/qrencode/
+$(package)_download_path=https://github.com/fukuchi/libqrencode/archive/refs/tags/
+$(package)_download_file=v$($(package)_version).tar.gz
$(package)_file_name=$(package)-$($(package)_version).tar.gz
-$(package)_sha256_hash=da448ed4f52aba6bcb0cd48cac0dd51b8692bccc4cd127431402fca6f8171e8e
+$(package)_sha256_hash=5385bc1b8c2f20f3b91d258bf8ccc8cf62023935df2d2676b5b67049f31a049c
$(package)_patches=cmake_fixups.patch
define $(package)_set_vars
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.