coolvlviewer-experimental

LOW

maintainer toastercup 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a tarball from a project-associated domain (sldev.free.fr) used to build the software from source; while the host is not standard, it is plausibly the developer's own, and the package does not execute untrusted prebuilt binaries or exfiltrate data.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a project-associated domain (sldev.free.fr) used to build the software from source; while the host is not standard, it is plausibly the developer's own, and the package does not execute untrusted prebuilt binaries or exfiltrate data.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("http://sldev.free.fr/sources/CoolVLViewer-src-${pkgver//./}.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alex Tharp <alex at toastercup dot io>
    
      2pkgname=coolvlviewer-experimental
    
      3pkgver=1.32.1.9
    
      4pkgrel=1
    
      5pkgdesc="A third-party viewer for Second Life (C) (secondlife) and OpenSim (opensimulator) grids. ('VL' stands for virtual life, formerly known as 'Cool SL Viewer'; built from source)"
    
      6url="http://sldev.free.fr"
    
      7license=('custom')
    
      8depends=('apr-util' 'glib2>=2.32' 'libgl' 'libidn' 'mesa' 'sdl' 'glu' 'pangox-compat' 'gconf' 'libxss' 'libxrandr' 'libxcomposite' 'libgl' 'lib32-zlib' 'libcups' 'atk' 'lib32-util-linux' 'lib32-libsndfile' 'lib32-libidn' 'libxcursor' 'libxtst')
    
      9optdepends=(
    
      10	'libpulse: for PulseAudio support'
    
      11	'alsa-lib: for ALSA support'
    
      12	'lib32-alsa-lib: for ALSA support'
    
      13	'nvidia-utils: for NVIDIA support'
    
      14	'pepper-flash: for inworld Flash support'
    
      15	'gst-plugins-good: for video support'
    
      16	'gst-plugins-bad: for video support'
    
      17	'gst-plugins-ugly: for video support'
    
      18	'lib32-freealut: for OpenAL support'
    
      19	'lib32-libidn11: for voice support'
    
      20	'wine: for SLVoice support')
    
      21makedepends=("cmake" "bison" "flex" "python" "make" "bzip2" "glibc" "libx11" "libgl" "libxrender" "libidn" "libxinerama" "lib32-libxinerama")
    
      22arch=('x86_64')
    
      23conflicts=('coolvlviewer-bin' 'coolvlviewer' 'coolvlviewer-experimental-bin')
    
      24install=coolvlviewer.install
    
      25source=("http://sldev.free.fr/sources/CoolVLViewer-src-${pkgver//./}.tar.bz2"
    
      26        "coolvlviewer.desktop"
    
      27        "coolvlviewer.launcher")
    
      28sha1sums=('ac357f65ad0321475f6b3a9bfb4bb73eece1edf5'
    
      29          'd5defd3d847fcfb7cdf41150ab55684dedc79275'
    
      30          '3ef1284a00a4437e4c34f809311ee0672604ef04')
    
      31
    
      32build() {
    
      33	cd $srcdir/linden
    
      34	./linux-build.sh
    
      35}
    
      36
    
      37package() {
    
      38	# Install Desktop File
    
      39	install -D -m644 $srcdir/coolvlviewer.desktop \
    
      40		$pkgdir/usr/share/applications/coolvlviewer.desktop
    
      41
    
      42	# Install Icon File
    
      43	install -D -m755 $srcdir/linden/indra/viewer-linux-x86_64-release/newview/CoolVLViewer-x86_64-$pkgver/cvlv_icon.png \
    
      44		$pkgdir/usr/share/pixmaps/clvl_icon.png
    
      45
    
      46	# Install Launcher
    
      47	install -D -m755 $srcdir/coolvlviewer.launcher \
    
      48		$pkgdir/usr/bin/coolvlviewer
    
      49
    
      50	# Install License
    
      51	install -D -m644 $srcdir/linden/indra/viewer-linux-x86_64-release/newview/CoolVLViewer-x86_64-$pkgver/licenses.txt \
    
      52		$pkgdir/usr/share/licenses/$pkgname/LISENSE
    
      53
    
      54	# Move Data to Destination Directory
    
      55	mv $srcdir/linden/indra/viewer-linux-x86_64-release/newview/CoolVLViewer-x86_64-$pkgver/ $srcdir/coolvlviewer
    
      56	install -d $pkgdir/opt/
    
      57	mv coolvlviewer/ $pkgdir/opt/
    
      58
    
      59	# Change Permissions of files to root:games
    
      60	chown -R root:games $pkgdir/opt/coolvlviewer
    
      61	chmod -R g+rw $pkgdir/opt/coolvlviewer
    
      62
    
      63	# Make Binary Group-Executable
    
      64	chmod g+x $pkgdir/opt/coolvlviewer/cool_vl_viewer
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2