ardour-git

maintainer SpotlightKid · 46 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The download from stuff.ardour.org is a non-executable media bundle (MIDI loops) for the application, hosted on a project-related domain; the worst case of a swapped source is non-malicious data tampering, not code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The download from stuff.ardour.org is a non-executable media bundle (MIDI loops) for the application, hosted on a project-related domain; the worst case of a swapped source is non-malicious data tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:96 "$_pkgname-midi-${pkgver%%.*}.zip::http://stuff.ardour.org/loops/ArdourBundledMedia.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christopher Arndt <aur at chrisarndt.de>
    
      2# Contributor: Gimmeapill <gimmeapill at gmail.com>
    
      3# Contributor: Boohbah <boohbah at gmail.com>
    
      4# Contributor: SpepS <dreamspepser at yahoo.it>
    
      5# Contributor: Bernardo Barros <bernardobarros at gmail.com>
    
      6# Contributor: Uli Armbruster <uli_armbruster at web.de>
    
      7# Contributor: Albert Gräf <aggraef -at- gmail -dot- com>
    
      8
    
      9_pkgname=ardour
    
      10pkgname=$_pkgname-git
    
      11pkgver=9.0.pre0.r675.ge273ec06bb
    
      12pkgrel=1
    
      13pkgdesc='Professional-grade digital audio workstation (git version)'
    
      14arch=(x86_64)
    
      15url='https://ardour.org/'
    
      16license=(
    
CC0-1.0
    
GPL-2.0-or-later
    
GPL-3.0-or-later
    
MIT
    
      21)
    
      22groups=(pro-audio)
    
      23depends=(
    
cairo
    
gcc-libs
    
glibc
    
hicolor-icon-theme
    
libsigc++
    
libx11
    
libxext
    
libxinerama
    
libxrandr
    
sh
    
taglib
    
      35)
    
      36makedepends=(
    
aubio
    
boost
    
cairomm
    
cppunit
    
curl
    
dbus
    
doxygen
    
fftw
    
flac
    
fluidsynth
    
fontconfig
    
freetype2
    
git
    
glib2
    
glibmm
    
graphviz
    
hidapi
    
itstool
    
jack
    
libarchive
    
liblo
    
liblrdf
    
libltc
    
libogg
    
libpng
    
libpulse
    
libsamplerate
    
libsndfile
    
libusb
    
libwebsockets
    
libxml2
    
lilv
    
lv2
    
pango
    
pangomm
    
python
    
readline
    
rubberband
    
serd
    
sord
    
sratom
    
unzip
    
vamp-plugin-sdk
    
      80)
    
      81optdepends=(
    
'harvid: video timeline'
    
'non-session-manager: for session management'
    
'xjadeo: video monitoring'
    
      85)
    
      86provides=(
    
$_pkgname
    
ladspa-host
    
lv2-host
    
vamp-host
    
vst-host
    
vst3-host
    
      93)
    
      94conflicts=($_pkgname)
    
      95source=("$_pkgname::git+https://github.com/Ardour/ardour.git"
    
      "$_pkgname-midi-${pkgver%%.*}.zip::http://stuff.ardour.org/loops/ArdourBundledMedia.zip"
    
      'ardour-7.x-vendor_qm-dsp.patch')
    
      98noextract=($_pkgname-midi-${pkgver%%.*}.zip)
    
      99sha256sums=('SKIP'
    
          'a00de00671cdc329b2ca35c2a5c4150af3d6588147f9dca2e3dea752aa2e234c'
    
          '6393d52d2c084e03ba24f657352a76a58d5e9f530cfeecb87babf8990c902cbc')
    
      102
    
      103pkgver() {
    
cd $_pkgname
    
git describe --long | sed -r 's/([^-]*-g)/r\1/;s/-/./g'
    
      106}
    
      107
    
      108prepare() {
    
cd $_pkgname
    
      110
    
# using vendored version of qm-dsp because qm-dsp >= 1.8.0 is not compatible
    
patch -Np1 -r - -i "$srcdir"/ardour-7.x-vendor_qm-dsp.patch
    
      113
    
# https://bugs.archlinux.org/task/54389
    
sed -e '8iexport GTK2_RC_FILES=/dev/null' -i gtk2_ardour/ardour.sh.in
    
      116}
    
      117
    
      118build() {
    
cd $_pkgname
    
      120
    
export LINKFLAGS="$LDFLAGS"
    
python waf configure \
    
  --prefix=/usr \
    
  --configdir=/etc \
    
  --cxx17 \
    
  --freedesktop \
    
  --no-phone-home \
    
  --optimize \
    
  --ptformat \
    
  --use-external-libs \
    
  --with-backends=alsa,dummy,jack,pulseaudio
    
python waf build $MAKEFLAGS
    
      133}
    
      134
    
      135package() {
    
depends+=(
    
  alsa-lib libasound.so
    
  aubio libaubio.so
    
  cairomm libcairomm-1.0.so
    
  curl libcurl.so
    
  dbus libdbus-1.so
    
  fftw libfftw3f.so libfftw3f_threads.so
    
  fluidsynth libfluidsynth.so
    
  fontconfig libfontconfig.so
    
  glib2 libglib-2.0.so libgobject-2.0.so
    
  glibmm libglibmm-2.4.so
    
  jack libjack.so
    
  libarchive libarchive.so
    
  liblo liblo.so
    
  libpulse libpulse.so
    
  liblrdf liblrdf.so
    
  libltc libltc.so
    
  libpng libpng16.so
    
  libsamplerate libsamplerate.so
    
  libsndfile libsndfile.so
    
  libusb libusb-1.0.so
    
  libwebsockets libwebsockets.so
    
  libxml2 libxml2.so
    
  lilv liblilv-0.so
    
  pango libpango-1.0.so libpangocairo-1.0.so libpangoft2-1.0.so
    
  pangomm libpangomm-1.4.so
    
  readline libreadline.so
    
  rubberband librubberband.so
    
  vamp-plugin-sdk libvamp-hostsdk.so libvamp-sdk.so
    
)
    
      166
    
cd $_pkgname
    
      168
    
python waf --destdir="$pkgdir" i18n
    
python waf --destdir="$pkgdir" install
    
      171
    
# Install XDG integration
    
# File types
    
install -vDm 644 "build/gtk2_$_pkgname/$_pkgname.xml" \
    
  -t "$pkgdir"/usr/share/mime/packages/
    
      176
    
# application starter desktop file
    
install -vDm644 "build/gtk2_$_pkgname/$_pkgname${pkgver%%.*}.desktop" \
    
  "$pkgdir"/usr/share/applications/ardour.desktop
    
      180
    
# Icons
    
for size in 16 22 32 48; do
    
  install -vdm 755 "$pkgdir"/usr/share/icons/hicolor/${size}x${size}/mimetypes
    
  ln -sf "/usr/share/ardour${pkgver%%.*}/icons/application-x-ardour_${size}px.png" \
    
    "$pkgdir"/usr/share/icons/hicolor/${size}x${size}/mimetypes/application-x-ardour.png
    
done
    
for size in 16 22 32 48 256 512; do
    
  install -vdm 755 "$pkgdir"/usr/share/icons/hicolor/${size}x${size}/apps
    
  ln -sf "/usr/share/ardour${pkgver%%.*}/resources/Ardour-icon_${size}px.png" \
    
    "$pkgdir"/usr/share/icons/hicolor/${size}x${size}/apps/$_pkgname${pkgver%%.*}.png
    
done
    
      192
    
# Man pages
    
install -vDm 644 "$_pkgname.1"* -t "$pkgdir"/usr/share/man/man1/
    
      195
    
# from the official package at https://archlinux.org/packages/extra/x86_64/ardour/
    
# installation of MIDI files is a bit of a horrorshow,
    
# as upstream is not flexible about tarball naming, etc.
    
install -vdm 755 "$pkgdir"/usr/share/$_pkgname${pkgver%%.*}/media
    
unzip "$srcdir"/$_pkgname-midi-${pkgver%%.*}.zip \
    
  -d "$pkgdir"/usr/share/$_pkgname${pkgver%%.*}/media
    
      202
    
install -vdm 755 "$pkgdir"/usr/share/licenses/$pkgname
    
ln -s "/usr/share/$_pkgname${pkgver%%.*}/media/MIDI Beats/LICENSE" \
    
  "$pkgdir"/usr/share/licenses/$pkgname/LICENSE.beats
    
ln -s "/usr/share/$_pkgname${pkgver%%.*}/media/MIDI Chords/LICENSE" \
    
  "$pkgdir"/usr/share/licenses/$pkgname/LICENSE.chords
    
ln -s "/usr/share/$_pkgname${pkgver%%.*}/media/MIDI Progressions/LICENSE" \
    
  "$pkgdir"/usr/share/licenses/$pkgname/LICENSE.progressions
    
      210}
    
      211

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2