aegisub-japan7-git

maintainer RhiobeT · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source code hosted on legitimate project forges (GitHub, Bitbucket) with no execution of remote scripts or binaries; the non-standard host (bitbucket.org) is plausibly project-owned and used for a source dependency, not a swappable binary payload.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source code hosted on legitimate project forges (GitHub, Bitbucket) with no execution of remote scripts or binaries; the non-standard host (bitbucket.org) is plausibly project-owned and used for a source dependency, not a swappable binary payload.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:48 gtest-patch.zip::https://wrapdb.mesonbuild.com/v1/projects/gtest/1.8.1/1/get_zip

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: RhiobeT (Pierre Jeanjean) <rhiobet@gmail.com>
    
      2# Contributor: odrling <florianbadie@odrling.xyz>
    
      3pkgname=aegisub-japan7-git
    
      4pkgver=3.3.3.r852.f5ec0f718
    
      5pkgrel=1
    
      6pkgdesc='A fork of aegisub including tap-to-time feature and custom user scripts'
    
      7arch=(x86_64)
    
      8url=https://github.com/odrling/Aegisub
    
      9license=(
    
      10  BSD-3-Clause
    
      11  MIT
    
      12)
    
      13depends=(
    
      14  alsa-lib
    
      15  amaranth-font
    
      16  boost-libs
    
      17  ffmpeg
    
      18  fftw
    
      19  fontconfig
    
      20  hunspell
    
      21  icu
    
      22  libass
    
      23  libgl
    
      24  libpulse
    
      25  openssl
    
      26  uchardet
    
      27  xxhash
    
      28  wxgtk3
    
      29  zlib
    
      30)
    
      31makedepends=(
    
      32  autoconf-archive
    
      33  boost
    
      34  git
    
      35  intltool
    
      36  mesa
    
      37  meson
    
      38)
    
      39provides=(aegisub)
    
      40conflicts=(aegisub)
    
      41source=(
    
      42  aegisub::git+https://github.com/odrling/Aegisub.git
    
      43  bestsource::git+https://github.com/vapoursynth/bestsource.git#tag=R8
    
      44  ffms2::git+https://github.com/FFMS/ffms2.git
    
      45  libp2p::git+https://bitbucket.org/the-sekrit-twc/libp2p.git#commit=1e3818bd7277165819f659d410873fe5dab37af6
    
      46  luajit::git+https://github.com/LuaJIT/LuaJIT.git#branch=v2.1
    
      47  gtest.zip::https://github.com/google/googletest/archive/release-1.8.1.zip
    
      48  gtest-patch.zip::https://wrapdb.mesonbuild.com/v1/projects/gtest/1.8.1/1/get_zip
    
      49)
    
      50noextract=(
    
      51  gtest.zip
    
      52  gtest-patch.zip
    
      53)
    
      54sha256sums=(
    
      55  SKIP
    
      56  SKIP
    
      57  SKIP
    
      58  SKIP
    
      59  SKIP
    
      60  927827c183d01734cc5cfef85e0ff3f5a92ffe6188e0d18e909c5efebf28a0c7
    
      61  f79f5fd46e09507b3f2e09a51ea6eb20020effe543335f5aee59f30cc8d15805
    
      62)
    
      63
    
      64pkgver() {
    
      65  cd aegisub
    
      66
    
      67  tag='v3.3.3'
    
      68
    
      69  echo "${tag#v}.r$(git rev-list --count ${tag}..HEAD).$(git rev-parse --short HEAD)"
    
      70}
    
      71
    
      72prepare() {
    
      73  cd aegisub
    
      74
    
      75  # Clean up previous builds
    
      76  rm -vrf subprojects/bestsource subprojects/ffms2 subprojects/luajit subprojects/packagecache
    
      77
    
      78  # Initialize subproject wraps
    
      79  ln -vs ../../bestsource subprojects/bestsource
    
      80  rm -vrf subprojects/bestsource/libp2p
    
      81  ln -vs ../libp2p subprojects/bestsource/libp2p
    
      82  meson subprojects packagefiles --apply bestsource
    
      83  ln -vs ../../ffms2 subprojects/ffms2
    
      84  meson subprojects packagefiles --apply ffms2
    
      85  ln -vs ../../luajit subprojects/luajit
    
      86  meson subprojects packagefiles --apply luajit
    
      87  mkdir -vp subprojects/packagecache
    
      88  ln -vs ../../../gtest.zip subprojects/packagecache/gtest-1.8.1.zip
    
      89  ln -vs ../../../gtest-patch.zip subprojects/packagecache/gtest-1.8.1-1-wrap.zip
    
      90
    
      91  arch-meson builddir \
    
      92    -Dportaudio=disabled -Dopenal=disabled -Dvapoursynth=disabled -Davisynth=disabled \
    
      93    --force-fallback-for=ffms2 -D ffms2:default_library=static
    
      94}
    
      95
    
      96build() {
    
      97  cd aegisub
    
      98
    
      99  ninja -C builddir
    
      100}
    
      101
    
      102package() {
    
      103  cd aegisub
    
      104
    
      105  DESTDIR="${pkgdir}" ninja -C builddir install
    
      106  install -Dm 644 LICENCE -t "${pkgdir}"/usr/share/licenses/aegisub-git/
    
      107
    
      108  # Clean symlink to not break future builds
    
      109  rm -vf subprojects/bestsource/libp2p
    
      110}
    
      111
    
      112# vim: ts=2 sw=2 et:
    
      113
    
      114

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2