ardour-git

LOW
maintainer SpotlightKid 46 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The download from stuff.ardour.org is a non-executable media bundle (MIDI loops) for the application, hosted on a project-related domain; the worst case of a swapped source is non-malicious data tampering, not code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The download from stuff.ardour.org is a non-executable media bundle (MIDI loops) for the application, hosted on a project-related domain; the worst case of a swapped source is non-malicious data tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:96 "$_pkgname-midi-${pkgver%%.*}.zip::http://stuff.ardour.org/loops/ArdourBundledMedia.zip"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Christopher Arndt <aur at chrisarndt.de>
2# Contributor: Gimmeapill <gimmeapill at gmail.com>
3# Contributor: Boohbah <boohbah at gmail.com>
4# Contributor: SpepS <dreamspepser at yahoo.it>
5# Contributor: Bernardo Barros <bernardobarros at gmail.com>
6# Contributor: Uli Armbruster <uli_armbruster at web.de>
7# Contributor: Albert Gräf <aggraef -at- gmail -dot- com>
8
9_pkgname=ardour
10pkgname=$_pkgname-git
11pkgver=9.0.pre0.r675.ge273ec06bb
12pkgrel=1
13pkgdesc='Professional-grade digital audio workstation (git version)'
14arch=(x86_64)
15url='https://ardour.org/'
16license=(
17 CC0-1.0
18 GPL-2.0-or-later
19 GPL-3.0-or-later
20 MIT
21)
22groups=(pro-audio)
23depends=(
24 cairo
25 gcc-libs
26 glibc
27 hicolor-icon-theme
28 libsigc++
29 libx11
30 libxext
31 libxinerama
32 libxrandr
33 sh
34 taglib
35)
36makedepends=(
37 aubio
38 boost
39 cairomm
40 cppunit
41 curl
42 dbus
43 doxygen
44 fftw
45 flac
46 fluidsynth
47 fontconfig
48 freetype2
49 git
50 glib2
51 glibmm
52 graphviz
53 hidapi
54 itstool
55 jack
56 libarchive
57 liblo
58 liblrdf
59 libltc
60 libogg
61 libpng
62 libpulse
63 libsamplerate
64 libsndfile
65 libusb
66 libwebsockets
67 libxml2
68 lilv
69 lv2
70 pango
71 pangomm
72 python
73 readline
74 rubberband
75 serd
76 sord
77 sratom
78 unzip
79 vamp-plugin-sdk
80)
81optdepends=(
82 'harvid: video timeline'
83 'non-session-manager: for session management'
84 'xjadeo: video monitoring'
85)
86provides=(
87 $_pkgname
88 ladspa-host
89 lv2-host
90 vamp-host
91 vst-host
92 vst3-host
93)
94conflicts=($_pkgname)
95source=("$_pkgname::git+https://github.com/Ardour/ardour.git"
96 "$_pkgname-midi-${pkgver%%.*}.zip::http://stuff.ardour.org/loops/ArdourBundledMedia.zip"
97 'ardour-7.x-vendor_qm-dsp.patch')
98noextract=($_pkgname-midi-${pkgver%%.*}.zip)
99sha256sums=('SKIP'
100 'a00de00671cdc329b2ca35c2a5c4150af3d6588147f9dca2e3dea752aa2e234c'
101 '6393d52d2c084e03ba24f657352a76a58d5e9f530cfeecb87babf8990c902cbc')
102
103pkgver() {
104 cd $_pkgname
105 git describe --long | sed -r 's/([^-]*-g)/r\1/;s/-/./g'
106}
107
108prepare() {
109 cd $_pkgname
110
111 # using vendored version of qm-dsp because qm-dsp >= 1.8.0 is not compatible
112 patch -Np1 -r - -i "$srcdir"/ardour-7.x-vendor_qm-dsp.patch
113
114 # https://bugs.archlinux.org/task/54389
115 sed -e '8iexport GTK2_RC_FILES=/dev/null' -i gtk2_ardour/ardour.sh.in
116}
117
118build() {
119 cd $_pkgname
120
121 export LINKFLAGS="$LDFLAGS"
122 python waf configure \
123 --prefix=/usr \
124 --configdir=/etc \
125 --cxx17 \
126 --freedesktop \
127 --no-phone-home \
128 --optimize \
129 --ptformat \
130 --use-external-libs \
131 --with-backends=alsa,dummy,jack,pulseaudio
132 python waf build $MAKEFLAGS
133}
134
135package() {
136 depends+=(
137 alsa-lib libasound.so
138 aubio libaubio.so
139 cairomm libcairomm-1.0.so
140 curl libcurl.so
141 dbus libdbus-1.so
142 fftw libfftw3f.so libfftw3f_threads.so
143 fluidsynth libfluidsynth.so
144 fontconfig libfontconfig.so
145 glib2 libglib-2.0.so libgobject-2.0.so
146 glibmm libglibmm-2.4.so
147 jack libjack.so
148 libarchive libarchive.so
149 liblo liblo.so
150 libpulse libpulse.so
151 liblrdf liblrdf.so
152 libltc libltc.so
153 libpng libpng16.so
154 libsamplerate libsamplerate.so
155 libsndfile libsndfile.so
156 libusb libusb-1.0.so
157 libwebsockets libwebsockets.so
158 libxml2 libxml2.so
159 lilv liblilv-0.so
160 pango libpango-1.0.so libpangocairo-1.0.so libpangoft2-1.0.so
161 pangomm libpangomm-1.4.so
162 readline libreadline.so
163 rubberband librubberband.so
164 vamp-plugin-sdk libvamp-hostsdk.so libvamp-sdk.so
165 )
166
167 cd $_pkgname
168
169 python waf --destdir="$pkgdir" i18n
170 python waf --destdir="$pkgdir" install
171
172 # Install XDG integration
173 # File types
174 install -vDm 644 "build/gtk2_$_pkgname/$_pkgname.xml" \
175 -t "$pkgdir"/usr/share/mime/packages/
176
177 # application starter desktop file
178 install -vDm644 "build/gtk2_$_pkgname/$_pkgname${pkgver%%.*}.desktop" \
179 "$pkgdir"/usr/share/applications/ardour.desktop
180
181 # Icons
182 for size in 16 22 32 48; do
183 install -vdm 755 "$pkgdir"/usr/share/icons/hicolor/${size}x${size}/mimetypes
184 ln -sf "/usr/share/ardour${pkgver%%.*}/icons/application-x-ardour_${size}px.png" \
185 "$pkgdir"/usr/share/icons/hicolor/${size}x${size}/mimetypes/application-x-ardour.png
186 done
187 for size in 16 22 32 48 256 512; do
188 install -vdm 755 "$pkgdir"/usr/share/icons/hicolor/${size}x${size}/apps
189 ln -sf "/usr/share/ardour${pkgver%%.*}/resources/Ardour-icon_${size}px.png" \
190 "$pkgdir"/usr/share/icons/hicolor/${size}x${size}/apps/$_pkgname${pkgver%%.*}.png
191 done
192
193 # Man pages
194 install -vDm 644 "$_pkgname.1"* -t "$pkgdir"/usr/share/man/man1/
195
196 # from the official package at https://archlinux.org/packages/extra/x86_64/ardour/
197 # installation of MIDI files is a bit of a horrorshow,
198 # as upstream is not flexible about tarball naming, etc.
199 install -vdm 755 "$pkgdir"/usr/share/$_pkgname${pkgver%%.*}/media
200 unzip "$srcdir"/$_pkgname-midi-${pkgver%%.*}.zip \
201 -d "$pkgdir"/usr/share/$_pkgname${pkgver%%.*}/media
202
203 install -vdm 755 "$pkgdir"/usr/share/licenses/$pkgname
204 ln -s "/usr/share/$_pkgname${pkgver%%.*}/media/MIDI Beats/LICENSE" \
205 "$pkgdir"/usr/share/licenses/$pkgname/LICENSE.beats
206 ln -s "/usr/share/$_pkgname${pkgver%%.*}/media/MIDI Chords/LICENSE" \
207 "$pkgdir"/usr/share/licenses/$pkgname/LICENSE.chords
208 ln -s "/usr/share/$_pkgname${pkgver%%.*}/media/MIDI Progressions/LICENSE" \
209 "$pkgdir"/usr/share/licenses/$pkgname/LICENSE.progressions
210}
211

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion