Revert "depends: Update URL for `qrencode` package source tarball"
What the developer wrote
Authored by Ava Chow
Revert "depends: Update URL for `qrencode` package source tarball"
This reverts commit 93a70a42d30fa2f9404b76d5bbdb5ea316fc1032.
What changed, and why it matters
This commit simply reverts a recent change to the download URL and checksum for the qrencode dependency used in Bitcoin Core's build system. It restores the older, original source URL and its corresponding hash. There is no security issue visible in the diff itself.
No security action required. Treat as ordinary build maintenance. If reviewing the reverted commit 93a70a42, verify that the GitHub archive hash matched the official release tarball and that no supply-chain discrepancy existed.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit reverts depends/packages/qrencode.mk to use the original fukuchi.org download path and the original SHA-256 hash (da448ed4f52aba6bcb0cd48cac0dd51b8692bccc4cd127431402fca6f8171e8e) instead of the GitHub archive URL and hash introduced by commit 93a70a42. This is a build-system dependency-source change, not a code change affecting consensus, networking, wallet, or runtime behavior.
Changed components
depends/packages/qrencode.mkInspect captured patch +2 / −3
diff --git a/depends/packages/qrencode.mk b/depends/packages/qrencode.mk
index 9aae62f0..e3f61409 100644
--- a/depends/packages/qrencode.mk
+++ b/depends/packages/qrencode.mk
@@ -1,9 +1,8 @@
package=qrencode
$(package)_version=4.1.1
-$(package)_download_path=https://github.com/fukuchi/libqrencode/archive/refs/tags/
-$(package)_download_file=v$($(package)_version).tar.gz
+$(package)_download_path=https://fukuchi.org/works/qrencode/
$(package)_file_name=$(package)-$($(package)_version).tar.gz
-$(package)_sha256_hash=5385bc1b8c2f20f3b91d258bf8ccc8cf62023935df2d2676b5b67049f31a049c
+$(package)_sha256_hash=da448ed4f52aba6bcb0cd48cac0dd51b8692bccc4cd127431402fca6f8171e8e
$(package)_patches=cmake_fixups.patch
define $(package)_set_vars
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.