kodi-git

LOW
maintainer graysky 84 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads source code and build dependencies from official project domains (github.com/xbmc, ffmpeg.org) and Kodi's own mirrors (mirrors.kodi.tv), which are legitimate sources for building the software; the non-whitelisted mirror is used only for non-executable dependency tarballs that are checksum-verified, posing minimal risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and build dependencies from official project domains (github.com/xbmc, ffmpeg.org) and Kodi's own mirrors (mirrors.kodi.tv), which are legitimate sources for building the software; the non-whitelisted mirror is used only for non-executable dependency tarballs that are checksum-verified, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:85 "https://mirrors.kodi.tv/build-deps/sources/crossguid-$_crossguid_version.tar.gz"

PKGBUILD

1 offending line(s) highlighted
1# vim:set ts=2 sw=2 et:
2# Maintainer graysky <therealgraysky AT protonmail DOT com>
3# Contributor: BlackIkeEagle < ike DOT devolder AT gmail DOT com >
4# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
5# Contributor: DonVla <donvla@users.sourceforge.net>
6# Contributor: Ulf Winkelvos <ulf [at] winkelvos [dot] de>
7# Contributor: Ralf Barth <archlinux dot org at haggy dot org>
8# Contributor: B & monty - Thanks for your hints :)
9# Contributor: marzoul
10# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
11# Contributor: Brad Fanella <bradfanella@archlinux.us>
12# Contributor: [vEX] <niechift.dot.vex.at.gmail.dot.com>
13# Contributor: Zeqadious <zeqadious.at.gmail.dot.com>
14# Contributor: Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
15# Contributor: Maxime Gauduin <alucryd@gmail.com>
16#
17# Original credits go to Edgar Hucek <gimli at dark-green dot com>
18# for his xbmc-vdpau-vdr PKGBUILD at https://archvdr.svn.sourceforge.net/svnroot/archvdr/trunk/archvdr/xbmc-vdpau-vdr/PKGBUILD
19
20# set this to anything to build with clang rather than with gcc
21_clangbuild=
22
23# define the applicaton render system, valid values are either 'gl' or 'gles'
24_renderer=gl
25
26pkgbase=kodi-git
27pkgname=("$pkgbase" "$pkgbase-eventclients" "$pkgbase-tools-texturepacker" "$pkgbase-dev")
28pkgver=r72345.d81c9184b1a
29pkgrel=1
30arch=('x86_64')
31url="https://kodi.tv"
32license=('GPL-2.0-or-later')
33makedepends=(
34 'bluez-libs' 'cmake' 'curl' 'dav1d' 'doxygen' 'git' 'glew'
35 # jdk23-openjdk causes build errors
36 'gperf' 'hicolor-icon-theme' 'java-runtime<21' 'fmt' 'libass'
37 'libbluray' 'libcdio' 'libcec' 'libgl' 'mariadb-libs' 'libmicrohttpd'
38 'libmodplug' 'libmpeg2' 'libnfs' 'libpulse' 'libva'
39 'libvdpau' 'libxrandr' 'libxslt' 'lirc' 'lzo' 'mesa' 'nasm'
40 'pipewire' 'python-pycryptodomex' 'python-pillow' 'python-pybluez'
41 'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'taglib'
42 'tinyxml' 'swig' 'upower' 'giflib' 'nlohmann-json' 'ghostscript' 'meson' 'gtest'
43 'graphviz' 'pcre' 'tinyxml2' 'libdisplay-info' 'exiv2'
44 # cmake/scripts/linux/Install.cmake calls distutils
45 # python 3.12 does no longer come with distutils on board
46 'python-setuptools'
47 # wayland
48 'wayland-protocols' 'waylandpp' 'libxkbcommon'
49 # gbm
50 'libinput'
51)
52options=(!lto)
53
54[[ -n "$_clangbuild" ]] && makedepends+=('clang' 'lld' 'llvm')
55
56_gitname=xbmc
57_codename=master
58
59# upstream pull requests to apply
60_prs=()
61
62# Found on their respective github release pages. One can check them against
63# what is pulled down when not specifying them in the cmake step.
64# $CHROOT/build/kodi-git/src/kodi-build/build/download
65#
66# https://github.com/xbmc/FFmpeg/tags
67# https://github.com/xbmc/libdvdcss/tags
68# https://github.com/xbmc/libdvdnav/tags
69# https://github.com/xbmc/libdvdread/tags
70#
71_libdvdcss_version="1.4.3-Next-Nexus-Alpha2-2"
72_libdvdnav_version="6.1.1-Next-Nexus-Alpha2-2"
73_libdvdread_version="6.1.3-Next-Nexus-Alpha2-2"
74_ffmpeg_version="9.0.1"
75_crossguid_version="ca1bf4b810e2d188d04cb6286f957008ee1b7681"
76_fstrcmp_version="0.7.D001"
77_flatbuffers_version="23.3.3"
78_libudfread_version="1.2.0"
79source=(
80 "git+https://github.com/xbmc/xbmc.git#branch=$_codename"
81 "libdvdcss-$_libdvdcss_version.tar.gz::https://github.com/xbmc/libdvdcss/archive/$_libdvdcss_version.tar.gz"
82 "libdvdnav-$_libdvdnav_version.tar.gz::https://github.com/xbmc/libdvdnav/archive/$_libdvdnav_version.tar.gz"
83 "libdvdread-$_libdvdread_version.tar.gz::https://github.com/xbmc/libdvdread/archive/$_libdvdread_version.tar.gz"
84 "https://ffmpeg.org/releases/ffmpeg-$_ffmpeg_version.tar.xz"
85 "https://mirrors.kodi.tv/build-deps/sources/crossguid-$_crossguid_version.tar.gz"
86 "https://mirrors.kodi.tv/build-deps/sources/fstrcmp-$_fstrcmp_version.tar.gz"
87 "https://mirrors.kodi.tv/build-deps/sources/flatbuffers-$_flatbuffers_version.tar.gz"
88 "https://mirrors.kodi.tv/build-deps/sources/libudfread-$_libudfread_version.tar.bz2"
89)
90noextract=(
91 "libdvdcss-$_libdvdcss_version.tar.gz"
92 "libdvdnav-$_libdvdnav_version.tar.gz"
93 "libdvdread-$_libdvdread_version.tar.gz"
94 "ffmpeg-$_ffmpeg_version.tar.xz"
95 "crossguid-$_crossguid_version.tar.gz"
96 "fstrcmp-$_fstrcmp_version.tar.gz"
97 "flatbuffers-$_flatbuffers_version.tar.gz"
98 "libudfread-$_libudfread_version.tar.bz2"
99)
100b2sums=('SKIP'
101 '2f503d3ab767094958f7ec10b4ad11ffd02665deee571c8f3c739bef5fc7e2ff84babc5a3fdee638dc095f896b72fe3ce65e6b688674cb5f7b7b77190992688c'
102 'db4d05836d8fbb3637ae50bdbfc0e4b612ee6b3be24addfea94ce772c3bf28d58b63a3f252d6f9f016f72f8cbb841cc1820b091226b136f4c4664385a32da73c'
103 'c94feb5a03a12efa5b7767965118d2500a088299ea36f3b82e46d157e45893e6b04503cb50f179ca681bac914457607fab26acfa6e304752b355c407578572d1'
104 '85b3b175211dfc013ae5df3ffd2bf2a1fd68f682f6b63d1a1a3aa431b7a8b5ef15c41108a6fa1ef2b15e6677f182ab02e48e0b56d3f301ef8e1777a473e8dd82'
105 '0f78a8ab5a420297f666b3b8156d499a9141ec25c049d4d2bb2ba594dc585abe211a149b83c605cce4f5530207231a065d5f3a87a0c969781de8c6381afa2527'
106 'a8b68fcb8613f0d30e5ff7b862b37408472162585ca71cdff328e3299ff50476fd265467bbd77b352b22bb88c590969044f74d91c5468475504568fd269fa69e'
107 'be5e3c8ea81ce4b6f2e2c1b2f22e1172434c435f096fa7dade060578c506cff0310e3e2ef0627e26ce2be44f740652eb9a8e1b63578c18f430f7925820f04e66'
108 '954caea7ae3cc91034ce1ba802e445f4989b9a75ec34b9373b523a312d7ed6296f14c32579edb5ef094379fbd1f48dd94d7dbc9a34ecdb263d765c23b63a81d4')
109
110pkgver() {
111 cd "$_gitname"
112 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
113}
114
115prepare() {
116 [[ -d kodi-build ]] && rm -rf kodi-build
117 mkdir "$srcdir/kodi-build"
118
119 cd "$_gitname"
120
121 local _pr
122 for _pr in "${_prs[@]}"; do
123 msg2 "Applying pull request $_pr"
124 git fetch origin "pull/$_pr/head"
125 git diff --binary "$(git merge-base HEAD FETCH_HEAD)" FETCH_HEAD | git apply --3way -
126 done
127
128 rm -rf system/certs # remove not needed cacert
129
130 if [[ -n "$_clangbuild" ]]; then
131 msg "Building with clang"
132 export CC=clang CXX=clang++
133 fi
134}
135
136build() {
137 cd "$srcdir/kodi-build"
138 # disable https://rfc.archlinux.page/0023-pack-relative-relocs/
139 export LDFLAGS=${LDFLAGS/-Wl,-z,pack-relative-relocs}
140
141 _args=(
142 -DCMAKE_BUILD_TYPE=Release
143 -DCMAKE_INSTALL_PREFIX=/usr
144 -DCMAKE_INSTALL_LIBDIR=/usr/lib
145 -DENABLE_SSE=ON
146 -DENABLE_SSE2=ON
147 -DENABLE_SSE3=ON
148 -DENABLE_SSSE3=ON
149 -DENABLE_SSE4_1=ON
150 -DENABLE_SSE4_2=ON
151 -DENABLE_AVX=ON
152 -DENABLE_AVX2=ON
153 -DUSE_LTO=$(nproc)
154 -DENABLE_LDGOLD=OFF
155 -DENABLE_AIRTUNES=OFF
156 -DENABLE_PLIST=OFF
157 -DENABLE_AVAHI=ON
158 -DENABLE_BLURAY=ON
159 -DENABLE_CEC=ON
160 -DENABLE_DBUS=ON
161 -DENABLE_DVDCSS=ON
162 -DENABLE_EGL=ON
163 -DENABLE_EVENTCLIENTS=ON
164 -DENABLE_MICROHTTPD=ON
165 -DENABLE_MYSQLCLIENT=ON
166 -DENABLE_NFS=ON
167 -DENABLE_OPTICAL=ON
168 -DENABLE_SMBCLIENT=ON
169 -DENABLE_UDEV=ON
170 -DENABLE_UPNP=ON
171 -DENABLE_VAAPI=ON
172 -DENABLE_VDPAU=ON
173 -DENABLE_XSLT=ON
174 -DENABLE_LIRCCLIENT=ON
175 -DENABLE_INTERNAL_RapidJSON=OFF
176 -DENABLE_INTERNAL_FFMPEG=ON
177 -DENABLE_INTERNAL_CROSSGUID=ON
178 -DENABLE_INTERNAL_FSTRCMP=ON
179 -DENABLE_INTERNAL_FLATBUFFERS=ON
180 -DENABLE_INTERNAL_UDFREAD=ON
181 -DENABLE_SSE=ON -DENABLE_SSE2=ON -DENABLE_SSE3=ON -DENABLE_SSSE3=ON
182 -DENABLE_SSE4_1=ON -DENABLE_SSE4_2=ON -DENABLE_AVX=ON -DENABLE_AVX2=ON
183 -Dlibdvdcss_URL="$srcdir/libdvdcss-$_libdvdcss_version.tar.gz"
184 -Dlibdvdnav_URL="$srcdir/libdvdnav-$_libdvdnav_version.tar.gz"
185 -Dlibdvdread_URL="$srcdir/libdvdread-$_libdvdread_version.tar.gz"
186 -DFFMPEG_URL="$srcdir/ffmpeg-$_ffmpeg_version.tar.xz"
187 -DCROSSGUID_URL="$srcdir/crossguid-$_crossguid_version.tar.gz"
188 -DFSTRCMP_URL="$srcdir/fstrcmp-$_fstrcmp_version.tar.gz"
189 -DFLATBUFFERS_URL="$srcdir/flatbuffers-$_flatbuffers_version.tar.gz"
190 -DUDFREAD_URL="$srcdir/libudfread-$_libudfread_version.tar.bz2"
191 -DAPP_RENDER_SYSTEM=$_renderer
192 )
193
194 echo "building kodi"
195 cmake "${_args[@]}" ../"$_gitname"
196 make
197}
198
199# kodi
200# components: kodi
201package_kodi-git() {
202 pkgdesc="A software media player and entertainment hub for digital media (master branch, $_renderer renderer)"
203 depends=(
204 'bluez-libs' 'curl' 'dav1d' 'desktop-file-utils' 'hicolor-icon-theme' 'fmt'
205 'lcms2' 'libass' 'libbluray' 'libcdio' 'libcec' 'libmicrohttpd' 'libnfs'
206 'libpulse' 'libva' 'libvdpau' 'libxslt' 'lirc' 'lzo'
207 'mariadb-libs' 'mesa' 'libpipewire' 'python-pillow' 'python-pycryptodomex'
208 'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'sqlite'
209 'tinyxml' 'taglib' 'libxrandr' 'libxkbcommon' 'waylandpp' 'libinput'
210 'pcre' 'tinyxml2' 'libdisplay-info' 'exiv2'
211)
212 [[ -n "$_clangbuild" ]] && depends+=('glu')
213
214 optdepends=(
215 'bluez: Blutooth support'
216 'python-pybluez: Bluetooth support'
217 'pulseaudio: PulseAudio support'
218 'pipewire: PipeWire support'
219 'upower: Display battery level'
220 )
221 provides=("kodi-common=${pkgver}" 'kodi-x11' 'kodi-wayland' 'kodi-gbm' 'kodi')
222 conflicts=('kodi' 'kodi-gles' 'kodi-x11' 'kodi-wayland' 'kodi-gbm')
223
224 _components=(
225 'kodi'
226 'kodi-bin'
227 )
228
229 cd kodi-build
230 for _cmp in ${_components[@]}; do
231 DESTDIR="$pkgdir" /usr/bin/cmake \
232 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
233 -P cmake_install.cmake
234 done
235
236 # avoid error <general>: GetDirectory - Error getting /usr/lib/kodi/addons
237 # https://bugs.archlinux.org/task/77366
238 mkdir -p "$pkgdir"/usr/lib/kodi/addons
239
240 # https://gitlab.archlinux.org/archlinux/packaging/packages/kodi/-/issues/2
241 mkdir -p "$pkgdir"/usr/share/kodi/system/certs
242 ln -s /etc/ssl/cert.pem "$pkgdir"/usr/share/kodi/system/certs/cacert.pem
243
244}
245
246# kodi-eventclients
247# components: kodi-eventclients-common kodi-eventclients-ps3 kodi-eventclients-kodi-send
248package_kodi-git-eventclients() {
249 pkgdesc="Kodi Event Clients (master branch)"
250 provides=("kodi-eventclients=${pkgver}")
251 conflicts=('kodi-eventclients')
252 optdepends=(
253 'kodi: local machine eventclient use'
254 'python: most eventclients are implemented in python'
255 )
256
257 _components=(
258 'kodi-eventclients-common'
259 'kodi-eventclients-ps3'
260 'kodi-eventclients-kodi-send'
261 )
262
263 cd kodi-build
264 for _cmp in ${_components[@]}; do
265 DESTDIR="$pkgdir" /usr/bin/cmake \
266 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
267 -P cmake_install.cmake
268 done
269}
270
271# kodi-tools-texturepacker
272# components: kodi-tools-texturepacker
273package_kodi-git-tools-texturepacker() {
274 pkgdesc="Kodi Texturepacker tool (master branch)"
275 provides=("kodi-tools-texturepacker=${pkgver}")
276 conflicts=('kodi-tools-texturepacker')
277 depends=('libpng' 'giflib' 'libjpeg-turbo' 'lzo')
278
279 _components=(
280 'kodi-tools-texturepacker'
281 )
282
283 cd kodi-build
284 for _cmp in ${_components[@]}; do
285 DESTDIR="$pkgdir" /usr/bin/cmake \
286 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
287 -P cmake_install.cmake
288 done
289}
290
291# kodi-dev
292# components: kodi-addon-dev kodi-eventclients-dev
293package_kodi-git-dev() {
294 pkgdesc="Kodi dev files (master branch)"
295 provides=("kodi-dev=${pkgver}")
296 conflicts=('kodi-dev')
297
298 _components=(
299 'kodi-addon-dev'
300 'kodi-eventclients-dev'
301 )
302
303 cd kodi-build
304 for _cmp in ${_components[@]}; do
305 DESTDIR="$pkgdir" /usr/bin/cmake \
306 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
307 -P cmake_install.cmake
308 done
309}
310

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion