aegisub-arch1t3cht-qt5-git

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source using git repositories and release tarballs from official project hosts (github.com, luajit.org, mesonbuild.com), with no execution of remote code or unverifiable binaries; skipped checksums are a quality issue but do not imply danger for source code from known project repositories.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using git repositories and release tarballs from official project hosts (github.com, luajit.org, mesonbuild.com), with no execution of remote code or unverifiable binaries; skipped checksums are a quality issue but do not imply danger for source code from known project repositories.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:62 "$pkgname-luajit::git+https://luajit.org/git/luajit.git#branch=v2.1"
PKGBUILD:64 "$pkgname-gtest_1.14.0-1_patch.zip::https://wrapdb.mesonbuild.com/v2/gtest_1.14.0-1/get_patch"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Funami
    
      2# Maintainer: Takina Lina <0tkl.zhaoqing@gmail.com>
    
      3# Contributor: Fredrick R. Brennan <copypaste@kittens.ph>
    
      4# Contributor: witchymary
    
      5
    
      6pkgname=aegisub-arch1t3cht-qt5-git
    
      7_subproj=aegisub-arch1t3cht-sub
    
      8pkgver=3.2.2.r1103.20caaabc0
    
      9pkgrel=1
    
      10pkgdesc="A general-purpose subtitle editor with ASS/SSA support (arch1t3cht fork)"
    
      11arch=('x86_64')
    
      12url="https://github.com/arch1t3cht/Aegisub"
    
      13license=(
    
      14  GPL
    
      15  BSD
    
      16)
    
      17provides=(aegisub)
    
      18conflicts=(
    
      19  aegisub
    
      20  aegisub-arch1t3cht
    
      21  aegisub-arch1t3cht-git
    
      22)
    
      23depends=(
    
      24  alsa-lib
    
      25  boost-libs
    
      26  ffmpeg
    
      27  ffms2
    
      28  fftw
    
      29  fontconfig
    
      30  hicolor-icon-theme
    
      31  hunspell
    
      32  icu
    
      33  jansson
    
      34  libass
    
      35  libgl
    
      36  libpulse
    
      37  openal
    
      38  portaudio
    
      39  python
    
      40  uchardet
    
      41  vapoursynth
    
      42  wxwidgets-common
    
      43  wxwidgets-qt5
    
      44  zlib
    
      45)
    
      46makedepends=(
    
      47  git
    
      48  meson
    
      49  cmake
    
      50  boost
    
      51)
    
      52optdepends=('avisynthplus: AviSynth source support'
    
      53            'vapoursynth-plugin-lsmashsource: VapourSynth plugin used by default (LWLibavSource)'
    
      54            'vapoursynth-plugin-bestsource: VapourSynth plugin used by default (BestSource)'
    
      55            'vapoursynth-plugin-wwxd: VapourSynth plugin for keyframe generation'
    
      56            'vapoursynth-plugin-scxvid: VapourSynth plugin for keyframe generation')
    
      57source=(
    
      58  "$pkgname::git+https://github.com/arch1t3cht/Aegisub.git#branch=feature"
    
      59  "$pkgname-bestsource::git+https://github.com/vapoursynth/bestsource.git#branch=master"
    
      60  "$_subproj-avisynth::git+https://github.com/AviSynth/AviSynthPlus.git#tag=v3.7.3"
    
      61  "$pkgname-vapoursynth::git+https://github.com/vapoursynth/vapoursynth.git#tag=R65"
    
      62  "$pkgname-luajit::git+https://luajit.org/git/luajit.git#branch=v2.1"
    
      63  "$pkgname-gtest-1.14.0.tar.gz::https://github.com/google/googletest/archive/refs/tags/v1.14.0.tar.gz"
    
      64  "$pkgname-gtest_1.14.0-1_patch.zip::https://wrapdb.mesonbuild.com/v2/gtest_1.14.0-1/get_patch"
    
      65  "$pkgname-gtest.wrap::https://wrapdb.mesonbuild.com/v2/gtest_1.14.0-1/gtest.wrap"
    
      66)
    
      67noextract=(
    
      68  $pkgname-gtest-1.14.0.tar.gz
    
      69  $pkgname-gtest_1.14.0-1_patch.zip
    
      70)
    
      71sha256sums=(
    
      72  'SKIP'
    
      73  'SKIP'
    
      74  'SKIP'
    
      75  'SKIP'
    
      76  'SKIP'
    
      77  '8ad598c73ad796e0d8280b082cebd82a630d73e73cd3c70057938a6501bba5d7'
    
      78  '2e693c7d3f9370a7aa6dac802bada0874d3198ad4cfdf75647b818f691182b50'
    
      79  '2ba6bda5e7afa70d4aafc3a262a4eda0dce9a9cee72f5d0f00056cef645dd06b'
    
      80)
    
      81
    
      82pkgver() {
    
      83  cd $pkgname
    
      84  tag='v3.2.2'
    
      85  printf "%s.r%s.%s" "${tag#v}" "$(git rev-list --count $tag..HEAD)" "$(git rev-parse --short HEAD)"
    
      86}
    
      87
    
      88prepare() {
    
      89  cd $pkgname
    
      90
    
      91  cp -f $srcdir/$pkgname-gtest.wrap subprojects/gtest.wrap
    
      92  sed -i 's/\tsort/\tstd::sort/' tests/tests/fs.cpp
    
      93  sed -i '26i#include <algorithm>' libaegisub/include/libaegisub/fs.h
    
      94  sed -i '55s/-1, Get/-1, 0, Get/' src/audio_provider_bestsource.cpp
    
      95  sed -i '111s/0, ""/0, 0, ""/' src/video_provider_bestsource.cpp
    
      96
    
      97  # If build dir exists (it won't ever if makepkg is passed --cleanbuild) call --reconfigure rather than setup without it which will fail)
    
      98  local MESON_FLAGS=''
    
      99  if [ -d build ]; then
    
      100    MESON_FLAGS='--reconfigure'
    
      101  else
    
      102    # Initialize subproject wraps for bestsource
    
      103    ln -s "$srcdir/$pkgname-bestsource" subprojects/bestsource
    
      104
    
      105    # Initialize subproject wraps for avisynth
    
      106    ln -s "$srcdir/$_subproj-avisynth" subprojects/avisynth
    
      107
    
      108    # Initialize subproject wraps for vapoursynth
    
      109    ln -s "$srcdir/$pkgname-vapoursynth" subprojects/vapoursynth
    
      110
    
      111    # Initialize subproject wraps for luajit
    
      112    ln -s "$srcdir/$pkgname-luajit" subprojects/luajit
    
      113
    
      114    # Initialize subproject wraps for gtest
    
      115    mkdir subprojects/packagecache
    
      116    ln -s "$srcdir/$pkgname-gtest-1.14.0.tar.gz" subprojects/packagecache/gtest-1.14.0.tar.gz
    
      117    ln -s "$srcdir/$pkgname-gtest_1.14.0-1_patch.zip" subprojects/packagecache/gtest_1.14.0-1_patch.zip
    
      118  fi
    
      119
    
      120  meson subprojects packagefiles --apply bestsource
    
      121  meson subprojects packagefiles --apply avisynth
    
      122  meson subprojects packagefiles --apply vapoursynth
    
      123  meson subprojects packagefiles --apply luajit
    
      124
    
      125  # check if the OPTIONS array contains "!strip"
    
      126  check_makepkg_options() (
    
      127    source /etc/makepkg.conf
    
      128
    
      129    if [ "$?" -ne 0 ]; then
    
      130      >&2 echo 'Failed to source /etc/makepkg.conf'
    
      131      echo release # use release as fallback buildtype
    
      132      return 1
    
      133    fi
    
      134
    
      135    if [[ " ${OPTIONS[@]} " =~ ' !strip ' ]]; then
    
      136      >&2 echo '!strip found in OPTIONS array'
    
      137      echo debug
    
      138    else
    
      139      >&2 echo '!strip not found in OPTIONS array'
    
      140      echo release
    
      141    fi
    
      142  )
    
      143  local BUILDTYPE="$(check_makepkg_options 2> /dev/null)"
    
      144
    
      145  echo -e "[binaries]\nwx-config = '/usr/bin/wx-config-qt'" > tmp.ini
    
      146  arch-meson --buildtype="${BUILDTYPE}" -D default_audio_output=PulseAudio -D vapoursynth=enabled --native-file tmp.ini ${MESON_FLAGS} build
    
      147}
    
      148
    
      149build() {
    
      150  cd $pkgname
    
      151  meson compile -C build
    
      152}
    
      153
    
      154package() {
    
      155  cd $pkgname
    
      156  meson install -C build --destdir "$pkgdir"
    
      157  install -Dm644 LICENCE -t "$pkgdir/usr/share/licenses/$pkgname"
    
      158}
    
      159

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2