aacskeys

maintainer ToadKing · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is downloaded from archive.deb-multimedia.org, a non-whitelisted but plausible Debian multimedia repository; the package builds from verifiable source code with provided checksums, and no remote code execution or obfuscated payloads are present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from archive.deb-multimedia.org, a non-whitelisted but plausible Debian multimedia repository; the package builds from verifiable source code with provided checksums, and no remote code execution or obfuscated payloads are present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://archive.deb-multimedia.org/pool/main/a/${pkgname}/${pkgname}_${_origpkgver}.orig.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: LinRs <LinRs at users.noreply.github.com>
    
      2# Contribtor: Paul Burton <paulburton89@gmail.com>
    
      3# Contributor: Zebulon <zeb@zebulon.org.uk>
    
      4# Maintainer: Pablo Lezaeta <prflr88@gmail.com>
    
      5
    
      6pkgname=aacskeys
    
      7pkgver="0.4.0f"
    
      8_origpkgver="0.4.0e"
    
      9_dmover="dmo7"
    
      10pkgrel=10
    
      11pkgdesc="A library and program to retrieve decryption keys for HD discs"
    
      12arch=("i686" "x86_64")
    
      13url="http://cyberside.net.ee/ripping/BD_DeviceKeys"
    
      14license=('custom:Public Domain')
    
      15depends=("openssl")
    
      16makedepends=("java-environment" "premake3")
    
      17source=("https://archive.deb-multimedia.org/pool/main/a/${pkgname}/${pkgname}_${_origpkgver}.orig.tar.gz"
    
      18	      "https://archive.deb-multimedia.org/pool/main/a/${pkgname}/${pkgname}_${_origpkgver}-${_dmover}.diff.gz"
    
      19        "aacskeys-0.4.0f.patch"
    
      20        "001-aacskeys-OpenSSL-build-fixes.patch"
    
      21        "002-BN_bn2bin-fix.patch")
    
      22sha1sums=('8790f0d4098d6bc83304ad2136cc9681374df83a'
    
      23          '481c737983332a4a38aab0b292ba0cd958bb629c'
    
      24          'dca9a9cb6bdd4cf6c4f7cbef1be3556728166117'
    
      25          '1b55ac6b6c31b603c0cf4970dcff6833fa77c86f'
    
      26          '7329ef386c87a4de02d00510b64d0844997becb2')
    
      27
    
      28prepare() {
    
      29  zcat ${pkgname}_${_origpkgver}-${_dmover}.diff.gz > ${srcdir}/${pkgname}_${_origpkgver}-${_dmover}.diff
    
      30  cd "${srcdir}/${pkgname}-${_origpkgver}"
    
      31  patch -Np1 -i "${srcdir}/${pkgname}_${_origpkgver}-${_dmover}.diff"
    
      32  patch -Np1 -i ../aacskeys-0.4.0f.patch
    
      33  patch -Np1 -i ../001-aacskeys-OpenSSL-build-fixes.patch
    
      34  patch -Np1 -i ../002-BN_bn2bin-fix.patch
    
      35
    
      36  # Make sure use resent premake
    
      37  sed -i 's|/usr/local/ssl/include|/usr/include|' premake.lua
    
      38  sed -i 's|/usr/local/ssl/lib|/usr/lib|' premake.lua
    
      39  sed -i "s|/usr/lib/jvm/java-6-sun/include|/usr/lib/jvm/$(archlinux-java get)/include|" premake.lua
    
      40}
    
      41
    
      42build() {
    
      43  cd "${srcdir}/${pkgname}-${_origpkgver}"
    
      44
    
      45  make
    
      46}
    
      47
    
      48package() {
    
      49  cd "${srcdir}/${pkgname}-${_origpkgver}"
    
      50
    
      51  # Install lib
    
      52  mkdir -p "${pkgdir}/usr/lib"
    
      53  mkdir -p "${pkgdir}/usr/share/dumphd/"
    
      54  cp -v "lib/linux/"*.so "${pkgdir}/usr/lib/"
    
      55  cp -v "${pkgdir}/usr/lib/libaacskeys.so" "${pkgdir}/usr/share/dumphd/libaacskeys.so"
    
      56
    
      57
    
      58  # Install program
    
      59  mkdir -p "${pkgdir}/usr/bin"
    
      60  cp -v "bin/linux/aacskeys" "${pkgdir}/usr/bin"
    
      61
    
      62  # Install resources
    
      63  mkdir -p "${pkgdir}/usr/share/${pkgname}"
    
      64  cp -v ./debian/HostKeyCertificate_PS3.txt "${pkgdir}/usr/share/${pkgname}/HostKeyCertificate.txt"
    
      65  cp -v ./debian/ProcessingDeviceKeysSimple.txt "${pkgdir}/usr/share/${pkgname}/"
    
      66
    
      67  # Author just say is public domain on upstream user forum thread once but later
    
      68  # 	it went MiA so no full license or ammend exist for the next maintainer
    
      69  #	who update it more and neither for the last one responsible of this version.
    
      70  #install -D -m644 "${srcdir}/license" "${pkgdir}/usr/share/licenses/${pkgbase}/license"
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2