aegisub-arch1t3cht-xdg-git

maintainer ObserverOfTime · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host is GitHub, which hosts the project's own source; the package builds from git sources and applies a patch, with no execution of untrusted prebuilt binaries.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is GitHub, which hosts the project's own source; the package builds from git sources and applies a patch, with no execution of untrusted prebuilt binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 "aegisub-gtest-1.8.1-1-wrap.zip::https://wrapdb.mesonbuild.com/v1/projects/gtest/1.8.1/1/get_zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ObserverOfTime <chronobserver@disroot.org>
    
      2# Based on aegisub-arch1t3cht-git
    
      3
    
      4pkgname=aegisub-arch1t3cht-xdg-git
    
      5pkgver=3.2.2.r1221.7db477c3e+xdg
    
      6pkgrel=1
    
      7pkgdesc="A general-purpose subtitle editor with ASS/SSA support (arch1t3cht fork + XDG patch)"
    
      8arch=('x86_64')
    
      9url="https://github.com/arch1t3cht/Aegisub"
    
      10license=('GPL' 'BSD')
    
      11provides=('aegisub' 'aegisub-arch1t3cht-git')
    
      12conflicts=('aegisub' 'aegisub-arch1t3cht-git')
    
      13depends=('alsa-lib'
    
      14         'boost-libs'
    
      15         'ffmpeg'
    
      16         'fftw'
    
      17         'fontconfig'
    
      18         'hicolor-icon-theme'
    
      19         'hunspell'
    
      20         'icu'
    
      21         'libass'
    
      22         'libgl'
    
      23         'libiconv'
    
      24         'libpulse'
    
      25         'uchardet'
    
      26         'wxwidgets-gtk3'
    
      27         'xxhash'
    
      28         'zlib'
    
      29         'vapoursynth')
    
      30makedepends=('boost' 'cmake' 'ffms2' 'git' 'meson' 'openal' 'portaudio')
    
      31optdepends=('ffms2: FFMS2 video source support'
    
      32            'openal: OpenAL audio source support'
    
      33            'portaudio: PortAudio audio source support')
    
      34source=("aegisub::git+https://github.com/arch1t3cht/Aegisub.git#branch=feature"
    
      35        "aegisub-luajit::git+https://github.com/LuaJIT/LuaJIT.git#branch=v2.1"
    
      36        "aegisub-vapoursynth::git+https://github.com/vapoursynth/vapoursynth.git#tag=R70"
    
      37        "aegisub-gtest-1.8.1.zip::https://github.com/google/googletest/archive/release-1.8.1.zip"
    
      38        "aegisub-gtest-1.8.1-1-wrap.zip::https://wrapdb.mesonbuild.com/v1/projects/gtest/1.8.1/1/get_zip"
    
      39        "support-xdg-base-directory.patch::https://github.com/arch1t3cht/Aegisub/pull/160.patch")
    
      40noextract=("aegisub-gtest-1.8.1.zip" "aegisub-gtest-1.8.1-1-wrap.zip")
    
      41sha256sums=('SKIP'
    
      42            'SKIP'
    
      43            'd18d94cb2c583c0f5e570056f9b2b3996709329a4773c4168c2cb05922f1a54e'
    
      44            '927827c183d01734cc5cfef85e0ff3f5a92ffe6188e0d18e909c5efebf28a0c7'
    
      45            'f79f5fd46e09507b3f2e09a51ea6eb20020effe543335f5aee59f30cc8d15805'
    
      46            'c1d4b8c2302b2433f357c2ed9f88d1c5f99d8a2e1cf8e0185f15330ecd4d5ff1')
    
      47
    
      48pkgver() {
    
      49  cd aegisub
    
      50  local tag='v3.2.2'
    
      51  printf "%s.r%s.%s+xdg" "${tag#v}" \
    
      52    "$(git rev-list --count ${tag}..HEAD)" \
    
      53    "$(git rev-parse --short HEAD)"
    
      54}
    
      55
    
      56prepare() {
    
      57  cd aegisub
    
      58
    
      59  local buildtype
    
      60  declare -a meson_flags
    
      61
    
      62  if [[ -d build ]]; then
    
      63    meson_flags+=('--reconfigure')
    
      64  else
    
      65    patch -N -p1 -i ../support-xdg-base-directory.patch
    
      66
    
      67    ln -s ../../aegisub-vapoursynth subprojects/vapoursynth
    
      68    ln -s ../../aegisub-luajit subprojects/luajit
    
      69
    
      70    mkdir subprojects/packagecache
    
      71    ln -s ../../../aegisub-gtest-1.8.1.zip subprojects/packagecache/gtest-1.8.1.zip
    
      72    ln -s ../../../aegisub-gtest-1.8.1-1-wrap.zip subprojects/packagecache/gtest-1.8.1-1-wrap.zip
    
      73  fi
    
      74
    
      75  meson subprojects packagefiles --apply vapoursynth
    
      76  meson subprojects packagefiles --apply luajit
    
      77
    
      78  arch-meson "${meson_flags[@]}" \
    
      79    -D b_lto=false \
    
      80    -D default_audio_output=ALSA \
    
      81    -D avisynth=disabled \
    
      82    -D bestsource=disabled \
    
      83    build
    
      84}
    
      85
    
      86build() {
    
      87  cd aegisub
    
      88  meson compile -C build
    
      89}
    
      90
    
      91check() {
    
      92  cd aegisub
    
      93  meson test -C build
    
      94}
    
      95
    
      96package() {
    
      97  cd aegisub
    
      98  meson install -C build --destdir "${pkgdir}"
    
      99  install -Dm644 LICENCE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      100}
    
      101

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2