dcpomatic

maintainer markusk · 7 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a git checkout from a project-owned host (git.carlh.net) used to build the software from its official repository; this is normal AUR packaging behavior despite the non-whitelisted domain.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git checkout from a project-owned host (git.carlh.net) used to build the software from its official repository; this is normal AUR packaging behavior despite the non-whitelisted domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("${pkgname}::git+https://git.carlh.net/git/${pkgbase}.git#tag=v${pkgver}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Markus Kalb <mk@filmkreis.tu-darmstadt.de>
    
      2# Maintainer: Benjamin Radel <aur@radel.tk>
    
      3# Contributor: Stefan Karner <stefan.karner@student.tuwien.ac.at>
    
      4pkgname=dcpomatic
    
      5pkgbase=dcpomatic
    
      6pkgver=2.18.45
    
      7provides=('dcpomatic')
    
      8conflicts=('dcpomatic')
    
      9pkgrel=1
    
      10pkgdesc="A free, open-source program to generate Digital Cinema Packages (DCPs) from videos or images"
    
      11arch=('i686' 'x86_64')
    
      12url="https://dcpomatic.com/"
    
      13#  CXXFLAGS="$CXXFLAGS  -I/usr/include/openjpeg-1.5/  -std=c++11"
    
      14license=('GPL-2.0-or-later')
    
      15depends=('libsub>=1.6.62' 'libcxml>=0.17.17' 'libdcp>=1.10.59' 'libttf>=0.0.6' 'ffmpeg>=7.0' 'glib2' 'glu' 'icu' 'imagemagick' 'libssh' 'libharu' 'wxwidgets-gtk3' 'wxwidgets-common' 'libzip' 'xz' 'libsndfile' 'libsamplerate' 'pangomm' 'rtaudio' 'x264' 'openssl' 'leqm-nrt>=0.0.2.r13.gd75d0af' 'xerces-c' 'libxml++2.6' 'gtkmm3' 'cairomm')
    
      16makedepends=('python' 'which' 'boost>=1.91.0' 'git' )
    
      17source=("${pkgname}::git+https://git.carlh.net/git/${pkgbase}.git#tag=v${pkgver}")
    
      18
    
      19sha256sums=('8010b45ff89f92e0dc7f20be6c70367b7a40767be3d0bc3a58228c3c3268fff2')
    
      20
    
      21# Pull fixes until new major release is available
    
      22_cherry_picks=()
    
      23
    
      24prepare() {
    
      25  cd "${srcdir}/${pkgname}"
    
      26  ## Set Version in Source
    
      27  # sed -i "/^\+VERSION/ s/XXXXXX/${pkgver}/" ${srcdir}/0001-set-version.patch
    
      28  for p in "${source[@]}"; do
    
      29    if [[ "$p" =~ \.patch$ ]]; then
    
      30      echo "Applying patch ${p##*/}"
    
      31      patch -p1 -N -i "${srcdir}/${p##*/}"
    
      32    fi
    
      33  done
    
      34
    
      35  for commit in "${_cherry_picks[@]}"; do
    
      36    git cherry-pick "${commit}"
    
      37  done
    
      38}
    
      39
    
      40
    
      41 build() {
    
      42   cd "${srcdir}/${pkgname}"
    
      43   python waf configure --prefix=/usr --disable-tests
    
      44   python waf build
    
      45 }
    
      46
    
      47 package() {
    
      48   cd "${srcdir}/${pkgname}"
    
      49   python waf install --destdir="$pkgdir"
    
      50   cd "${pkgdir}"
    
      51   if [ -d usr/lib64  ]
    
      52   then
    
      53     mv usr/lib64 usr/lib
    
      54   fi
    
      55   ln -s "$(which openssl)" usr/bin/dcpomatic2_openssl
    
      56 }
    
      57
    
      58# vim:set ts=2 sw=2 et:
    
      59

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 # Contributor: Stefan Karner <stefan.karner@student.tuwien.ac.at>
 pkgname=dcpomatic
 pkgbase=dcpomatic
-pkgver=2.18.43
+pkgver=2.18.45
 provides=('dcpomatic')
 conflicts=('dcpomatic')
 pkgrel=1
@@ -12,11 +12,11 @@
 url="https://dcpomatic.com/"
 #  CXXFLAGS="$CXXFLAGS  -I/usr/include/openjpeg-1.5/  -std=c++11"
 license=('GPL-2.0-or-later')
-depends=('libsub>=1.6.61' 'libcxml>=0.17.17' 'libdcp>=1.10.58' 'ffmpeg>=7.0' 'glib2' 'glu' 'icu' 'imagemagick' 'libssh'  'wxwidgets-gtk3' 'wxwidgets-common' 'libzip' 'xz' 'libsndfile' 'libsamplerate' 'pangomm' 'rtaudio' 'x264' 'openssl' 'leqm-nrt>=0.0.2.r12.g30dcaea' 'xerces-c' 'libxml++2.6' 'gtkmm3' 'cairomm')
+depends=('libsub>=1.6.62' 'libcxml>=0.17.17' 'libdcp>=1.10.59' 'libttf>=0.0.6' 'ffmpeg>=7.0' 'glib2' 'glu' 'icu' 'imagemagick' 'libssh' 'libharu' 'wxwidgets-gtk3' 'wxwidgets-common' 'libzip' 'xz' 'libsndfile' 'libsamplerate' 'pangomm' 'rtaudio' 'x264' 'openssl' 'leqm-nrt>=0.0.2.r13.gd75d0af' 'xerces-c' 'libxml++2.6' 'gtkmm3' 'cairomm')
 makedepends=('python' 'which' 'boost>=1.91.0' 'git' )
 source=("${pkgname}::git+https://git.carlh.net/git/${pkgbase}.git#tag=v${pkgver}")
 
-sha256sums=('0a9c75c1987f2f0254ee057a183755b6391a171a7c720f285b761336b51f3f9d')
+sha256sums=('8010b45ff89f92e0dc7f20be6c70367b7a40767be3d0bc3a58228c3c3268fff2')
 
 # Pull fixes until new major release is available
 _cherry_picks=()

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 17:12:22	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 18:55:24	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1