drumgizmo-git

maintainer orphaned · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The VST SDK zip is downloaded from steinberg.net, which is the official Steinberg website (the actual vendor of the VST SDK). This is not an unofficial or personal host — Steinberg is the legitimate upstream for VST SDK downloads. The zip has a proper md5sum checksum (b4ed4f4f4be77b267f1821fc1413ea36), so integrity is verified. The git source has SKIP for its checksum, which is normal and expected for git+http sources in AUR PKGBUILDs. The VST SDK sources are used as build-time input (--with-vst-sources) to compile the plugin, not executed directly. The main concern is that the Steinberg SDK URL may have changed or become unavailable (it's a 2017 build), making this potentially broken, and there are minor issues (base64-encoded email in maintainer field is cosmetic obfuscation but not a security concern). Overall this is a legitimate open-source drum plugin building against the official VST SDK — the cheaper model's MEDIUM rating was a false positive based on not recognizing steinberg.net as the official vendor host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The VST SDK zip is downloaded from steinberg.net, which is the official Steinberg website (the actual vendor of the VST SDK). This is not an unofficial or personal host — Steinberg is the legitimate upstream for VST SDK downloads. The zip has a proper md5sum checksum (b4ed4f4f4be77b267f1821fc1413ea36), so integrity is verified. The git source has SKIP for its checksum, which is normal and expected for git+http sources in AUR PKGBUILDs. The VST SDK sources are used as build-time input (--with-vst-sources) to compile the plugin, not executed directly. The main concern is that the Steinberg SDK URL may have changed or become unavailable (it's a 2017 build), making this potentially broken, and there are minor issues (base64-encoded email in maintainer field is cosmetic obfuscation but not a security concern). Overall this is a legitimate open-source drum plugin building against the official VST SDK — the cheaper model's MEDIUM rating was a false positive based on not recognizing steinberg.net as the official vendor host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("$_pkgname::git+http://git.drumgizmo.org/drumgizmo.git"
PKGBUILD:16 "http://www.steinberg.net/sdk_downloads/vstsdk367_03_03_2017_build_352.zip")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: sekret, mail=$(echo c2VrcmV0QHBvc3Rlby5zZQo= | base64 -d)
    
      2_pkgname=drumgizmo
    
      3pkgname=$_pkgname-git
    
      4pkgver=0.9.14.r17.ge3e60b5
    
      5pkgrel=2
    
      6pkgdesc="an open source cross-platform drum plugin and stand-alone application (lv2)"
    
      7arch=('i686' 'x86_64' 'armv6h' 'armv7h')
    
      8url="http://www.drumgizmo.org"
    
      9license=('GPL')
    
      10groups=('lv2-plugins')
    
      11depends=('libsmf' 'libxext' 'expat' 'jack' 'zita-resampler')
    
      12makedepends=('git' 'lv2')
    
      13provides=("$_pkgname")
    
      14conflicts=("$_pkgname")
    
      15source=("$_pkgname::git+http://git.drumgizmo.org/drumgizmo.git"
    
      16        "http://www.steinberg.net/sdk_downloads/vstsdk367_03_03_2017_build_352.zip")
    
      17md5sums=('SKIP'
    
      18         'b4ed4f4f4be77b267f1821fc1413ea36')
    
      19
    
      20pkgver() {
    
      21  cd "$_pkgname"
    
      22  git describe --long --tags | sed -r 's/^v//;s/([^-]*-g)/r\1/;s/-/./g'
    
      23}
    
      24
    
      25prepare() {
    
      26  cd "$_pkgname"
    
      27  git submodule init
    
      28  git submodule update
    
      29  ./autogen.sh
    
      30}
    
      31
    
      32build() {
    
      33  cd "$_pkgname"
    
      34  ./configure --prefix=/usr \
    
      35              --enable-lv2 \
    
      36              --enable-vst \
    
      37              --with-vst-sources="$srcdir/VST_SDK/VST2_SDK"
    
      38  make
    
      39}
    
      40
    
      41package() {
    
      42  cd "$_pkgname"
    
      43  make DESTDIR="$pkgdir/" install
    
      44}
    
      45
    
      46# vim:set ts=2 sw=2 et:
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2