ir.lv2

maintainer Gelmo · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a snapshot from the project's own git host (sig7.se), which is plausibly project-owned despite not being on a standard forge; it builds from source and installs only the project's own code, with no evidence of malicious behavior or unverifiable binaries.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a snapshot from the project's own git host (sig7.se), which is plausibly project-owned despite not being on a standard forge; it builds from source and installs only the project's own code, with no evidence of malicious behavior or unverifiable binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 https://git.hq.sig7.se/$pkgname.git/snapshot/$relcommit.tar.gz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gelmo <gelmo[at]outlook.com>
    
      2# Maintainer: David Runge <dvzrv@archlinux.org>
    
      3
    
      4pkgname=ir.lv2
    
      5pkgver=1.3.4
    
      6pkgrel=4
    
      7relcommit=a523bba0f336d26197b271b64799c4f369e487a8
    
      8relcommitshort=a523bba
    
      9pkgdesc="No-latency/low-latency, realtime, high performance signal convolver for reverb effects"
    
      10arch=(x86_64)
    
      11url="https://tomscii.sig7.se/plugins/ir.lv2"
    
      12license=(GPL2)
    
      13groups=(
    
      14  lv2-plugins
    
      15  pro-audio
    
      16)
    
      17depends=(
    
      18  cairo
    
      19  gcc-libs
    
      20  glibc
    
      21  lv2-host
    
      22)
    
      23makedepends=(
    
      24  glib2
    
      25  gtk2
    
      26  libsamplerate
    
      27  libsndfile
    
      28  lv2
    
      29  zita-convolver
    
      30)
    
      31checkdepends=(lv2lint)
    
      32source=(
    
      33  https://git.hq.sig7.se/$pkgname.git/snapshot/$relcommit.tar.gz
    
      34  $pkgname-1.3.4-lv2-1.18.0.patch::https://github.com/tomszilagyi/ir.lv2/pull/20/commits/001904135bafa8931e4cf67402e0fa332feb857d.patch
    
      35)
    
      36sha512sums=('394725dd8345dc09efd77acd43befa0c70548ca4056b5b56d573a47ec1458b957ee0bd7acf8f7237a69c48d1d6b0a037e55734da57f306c4f48f0e4457cc5057'
    
      37            'a1f4279df4ae916658249a4634b707f64982c0dc3baea7753e87f56bec3d4f26dd2bc4cf00db904ee054402a59986678478d810730b55bf50455749312af1b13')
    
      38b2sums=('33816a91079d24608b9ac058ac2018f3bdc535a14329ab7c81b31706cd3ed7329555ae4fd9e8ceeb84bead544feec3b62b5ff33667c8894fa9c01cf786804b6f'
    
      39        '5630b894dcdb7d1ccf378b3308670c6648a6227cf42751d2c1c903f7f887252ce9e1bf72cfc4828df536f8afa6501a41590e494464f69a01b4fd3065fadb0968')
    
      40
    
      41prepare() {
    
      42  patch -Np1 -d $pkgname-$relcommitshort -i ../$pkgname-1.3.4-lv2-1.18.0.patch
    
      43}
    
      44
    
      45build() {
    
      46  make -C $pkgname-$relcommitshort
    
      47}
    
      48
    
      49check() {
    
      50  local lv2lint_options=(
    
      51    # ignore tests that upstream won't fix: https://github.com/tomszilagyi/ir.lv2/issues/21
    
      52    -t "Plugin Version Minor"
    
      53    -t "Plugin Version Micro"
    
      54    -t "Plugin Symbols"
    
      55    -t "UI Symbols"
    
      56    -t "Port Properties"
    
      57    -Mpack
    
      58    -I $pkgname-$relcommitshort
    
      59    "http://tomszilagyi.github.io/plugins/lv2/ir"
    
      60  )
    
      61
    
      62  lv2lint "${lv2lint_options[@]}"
    
      63}
    
      64
    
      65package() {
    
      66  depends+=(
    
      67    gtk2 libgdk-x11-2.0.so libgtk-x11-2.0.so
    
      68    glib2 libgobject-2.0.so libglib-2.0.so
    
      69    libsamplerate libsamplerate.so
    
      70    libsndfile libsndfile.so
    
      71    zita-convolver libzita-convolver.so
    
      72  )
    
      73
    
      74  make DESTDIR="$pkgdir/" install -C $pkgname-$relcommitshort
    
      75  install -vDm 644 $pkgname-$relcommitshort/{ChangeLog,README.md} -t "$pkgdir/usr/share/doc/$pkgname/"
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2