https://fukuchi.org/works/qrencode/qrencode-4.1.1.tar.gz returns 404, so depends takes qrencode from the bitcoincore.org fallback. #33494 moved the download to the GitHub tag archive but kept the file name. The archive has a different hash. #33577 reverted it because the new hash under the old name broke the release branches. In #33577 theuni proposed to change the file name too, and achow101 agreed to do that in a follow-up.
I download v4.1.1.tar.gz from https://github.com/fukuchi/libqrencode/archive/refs/tags/, with the hash from #33494, and store it as qrencode-4.1.1-v2.tar.gz. The old file name keeps its old hash on the fallback and in the CI caches. So the release branches are not affected. I left the doc/dependencies.md link, because the project page it points to still loads.
The GitHub file matches 5385bc1b8c2f20f3b91d258bf8ccc8cf62023935df2d2676b5b67049f31a049c. With FALLBACK_DOWNLOAD_PATH=http://127.0.0.1:9, make -C depends qrencode builds qrencode on this branch and fails on master. The fallback does not have qrencode-4.1.1-v2.tar.gz yet. In #33577 the fallback picked up the new tarball from master by itself, so I expect it to add this file after a merge. I did not run a Guix build.
This is one of several PRs from a large audit of Bitcoin Core that I did with the help of LLM tools. The audit produced its evidence all at once, which is why the PRs arrive together. I understand each change fully and will answer review questions myself.
