gogglesmm-git

maintainer FabioLolix · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own git repositories with submodules handled locally; skipped checksums are expected for git sources and do not introduce supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own git repositories with submodules handled locally; skipped checksums are expected for git sources and do not introduce supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Fabio 'Lolix' Loli <lolix@disroot.org>
    
      2# Contributor: Sander Jansen
    
      3
    
      4pkgname=gogglesmm-git
    
      5pkgver=1.3.1.r1.g6f02ca9
    
      6pkgrel=1
    
      7pkgdesc="Music Manager and Player"
    
      8url="https://github.com/gogglesmm/gogglesmm"
    
      9license=(GPL-3.0-or-later)
    
      10arch=(x86_64 aarch64)
    
      11depends=(
    
      12    alsa-lib
    
      13    dbus
    
      14    faad2
    
      15    flac
    
      16    fontconfig
    
      17    freetype2
    
      18    glibc
    
      19    glu
    
      20    hicolor-icon-theme
    
      21    libepoxy
    
      22    libgcc
    
      23    libglvnd
    
      24    libice
    
      25    libjpeg-turbo
    
      26    libmad
    
      27    libogg
    
      28    libpulse expat
    
      29    libsm
    
      30    libstdc++
    
      31    libtiff
    
      32    libtiff
    
      33    libvorbis
    
      34    libwebp
    
      35    libx11
    
      36    libxcursor
    
      37    libxext
    
      38    libxfixes
    
      39    libxft
    
      40    libxi
    
      41    libxrandr
    
      42    libxrender
    
      43    openjpeg2
    
      44    openssl
    
      45    opus
    
      46    sndio
    
      47    sndio
    
      48    sqlite
    
      49    taglib
    
      50    zlib
    
      51    )
    
      52optdepends=(
    
      53    'libpulse: PulseAudio Output'
    
      54    )
    
      55makedepends=(
    
      56    cmake
    
      57    git
    
      58    libpulse
    
      59    )
    
      60conflicts=(gogglesmm)
    
      61replaces=(gogglesmm)
    
      62source=("git+https://github.com/gogglesmm/gogglesmm.git"
    
      63        "git+https://github.com/gogglesguy/fox.git")
    
      64sha256sums=('SKIP'
    
      65            'SKIP')
    
      66
    
      67prepare() {
    
      68  cd "gogglesmm"
    
      69  git submodule init
    
      70  git config submodule.fox.url "${srcdir}/fox"
    
      71  git -c protocol.file.allow=always submodule update
    
      72}
    
      73
    
      74pkgver() {
    
      75  cd "gogglesmm"
    
      76  git describe --long --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      77}
    
      78
    
      79build() {
    
      80  # Disable all warnings
    
      81  export CFLAGS+=" -w"
    
      82  export CXXFLAGS+=" -w"
    
      83
    
      84  local _flags=(
    
      85
    
      86  )
    
      87
    
      88  cmake -B build -S "gogglesmm" -Wno-author \
    
      89    -DCMAKE_BUILD_TYPE=None \
    
      90    -DCMAKE_INSTALL_PREFIX=/usr \
    
      91    "${_flags[@]}"
    
      92
    
      93  cmake --build build
    
      94}
    
      95
    
      96package() {
    
      97  DESTDIR="${pkgdir}" cmake --install build
    
      98}
    
      99

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,70 +1,99 @@
+# Maintainer: Fabio 'Lolix' Loli <lolix@disroot.org>
+# Contributor: Sander Jansen
+
 pkgname=gogglesmm-git
-pkgver=1.2.0
+pkgver=1.3.1.r1.g6f02ca9
 pkgrel=1
 pkgdesc="Music Manager and Player"
-url="https://gogglesmm.github.io"
-license=('GPL3')
-arch=('x86_64')
-depends=('libepoxy'
-         'glu'
-         'libsm'
-         'libxcursor'
-         'libxrandr'
-         'libxi'
-         'libxft'
-         'libvorbis'
-         'libwebp'
-         'libjpeg-turbo'
-         'openssl'
-         'libmad'
-         'flac'
-         'faad2'
-         'opus'
-         'taglib>=1.9.0'
-         'sqlite'
-         'dbus'
-         'hicolor-icon-theme')
+url="https://github.com/gogglesmm/gogglesmm"
+license=(GPL-3.0-or-later)
+arch=(x86_64 aarch64)
+depends=(
+    alsa-lib
+    dbus
+    faad2
+    flac
+    fontconfig
+    freetype2
+    glibc
+    glu
+    hicolor-icon-theme
+    libepoxy
+    libgcc
+    libglvnd
+    libice
+    libjpeg-turbo
+    libmad
+    libogg
+    libpulse expat
+    libsm
+    libstdc++
+    libtiff
+    libtiff
+    libvorbis
+    libwebp
+    libx11
+    libxcursor
+    libxext
+    libxfixes
+    libxft
+    libxi
+    libxrandr
+    libxrender
+    openjpeg2
+    openssl
+    opus
+    sndio
+    sndio
+    sqlite
+    taglib
+    zlib
+    )
+optdepends=(
+    'libpulse: PulseAudio Output'
+    )
+makedepends=(
+    cmake
+    git
+    libpulse
+    )
+conflicts=(gogglesmm)
+replaces=(gogglesmm)
+source=("git+https://github.com/gogglesmm/gogglesmm.git"
+        "git+https://github.com/gogglesguy/fox.git")
+sha256sums=('SKIP'
+            'SKIP')
 
-# Dependencies:
-# expat => dbus
-# libogg => libvorbis
-# libxfixes => libxcursor
-# libtiff => libwebp
-#
-# dbus => libpulse
-# flac => libsndfile => libpulse
-# openssl => libpulse
-
-
-optdepends=('python2: import utilities'
-            'libpulse: PulseAudio Output'
-            'alsa-lib: ALSA Output')
-
-makedepends=('cmake'
-             'pkgconfig'
-             'alsa-lib'
-             'libpulse')
-
-conflicts=('musicmanager')
-replaces=('musicmanager')
-
-md5sums=('SKIP')
-source=("$pkgname"::'git+https://github.com/gogglesmm/gogglesmm.git')
+prepare() {
+  cd "gogglesmm"
+  git submodule init
+  git config submodule.fox.url "${srcdir}/fox"
+  git -c protocol.file.allow=always submodule update
+}
 
 pkgver() {
-  cd "$pkgname"
-  git describe --long | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
-  }
+  cd "gogglesmm"
+  git describe --long --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
+}
 
 build() {
-  cd "$pkgname"
-  cmake .
-  make
-  }
+  # Disable all warnings
+  export CFLAGS+=" -w"
+  export CXXFLAGS+=" -w"
+
+  local _flags=(
+
+  )
+
+  cmake -B build -S "gogglesmm" -Wno-author \
+    -DCMAKE_BUILD_TYPE=None \
+    -DCMAKE_INSTALL_PREFIX=/usr \
+    "${_flags[@]}"
+
+  cmake --build build
+}
 
 package() {
-  cd "$pkgname"
-  make DESTDIR="$pkgdir" install
-  }
+  DESTDIR="${pkgdir}" cmake --install build
+}
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 05:37:03	MEDIUM	1
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 05:19:42	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0