Insecure bzr:// download (possibly?)
https://invent.kde.org/sdk/kdesrc-build/-/blob/master/kf5-frameworks-build-include#L22
I couldn't find anywhere whether the bzr:// protocol is secure.
https://invent.kde.org/sdk/kdesrc-build/-/blob/master/kf5-frameworks-build-include#L22
I couldn't find anywhere whether the bzr:// protocol is secure.