kodi-git-dev
LOW
maintainer graysky
84 votes
base
kodi-git
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source code and build dependencies from official project domains (github.com/xbmc, ffmpeg.org) and Kodi's own mirrors (mirrors.kodi.tv), which are legitimate sources for building the software; the non-whitelisted mirror is used only for non-executable dependency tarballs that are checksum-verified, posing minimal risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and build dependencies from official project domains (github.com/xbmc, ffmpeg.org) and Kodi's own mirrors (mirrors.kodi.tv), which are legitimate sources for building the software; the non-whitelisted mirror is used only for non-executable dependency tarballs that are checksum-verified, posing minimal risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:85
"https://mirrors.kodi.tv/build-deps/sources/crossguid-$_crossguid_version.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# vim:set ts=2 sw=2 et:
2
# Maintainer graysky <therealgraysky AT protonmail DOT com>
3
# Contributor: BlackIkeEagle < ike DOT devolder AT gmail DOT com >
4
# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
5
# Contributor: DonVla <donvla@users.sourceforge.net>
6
# Contributor: Ulf Winkelvos <ulf [at] winkelvos [dot] de>
7
# Contributor: Ralf Barth <archlinux dot org at haggy dot org>
8
# Contributor: B & monty - Thanks for your hints :)
9
# Contributor: marzoul
10
# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
11
# Contributor: Brad Fanella <bradfanella@archlinux.us>
12
# Contributor: [vEX] <niechift.dot.vex.at.gmail.dot.com>
13
# Contributor: Zeqadious <zeqadious.at.gmail.dot.com>
14
# Contributor: Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
15
# Contributor: Maxime Gauduin <alucryd@gmail.com>
16
#
17
# Original credits go to Edgar Hucek <gimli at dark-green dot com>
18
# for his xbmc-vdpau-vdr PKGBUILD at https://archvdr.svn.sourceforge.net/svnroot/archvdr/trunk/archvdr/xbmc-vdpau-vdr/PKGBUILD
19
20
# set this to anything to build with clang rather than with gcc
21
_clangbuild=
22
23
# define the applicaton render system, valid values are either 'gl' or 'gles'
24
_renderer=gl
25
26
pkgbase=kodi-git
27
pkgname=("$pkgbase" "$pkgbase-eventclients" "$pkgbase-tools-texturepacker" "$pkgbase-dev")
28
pkgver=r72345.d81c9184b1a
29
pkgrel=1
30
arch=('x86_64')
31
url="https://kodi.tv"
32
license=('GPL-2.0-or-later')
33
makedepends=(
34
'bluez-libs' 'cmake' 'curl' 'dav1d' 'doxygen' 'git' 'glew'
35
# jdk23-openjdk causes build errors
36
'gperf' 'hicolor-icon-theme' 'java-runtime<21' 'fmt' 'libass'
37
'libbluray' 'libcdio' 'libcec' 'libgl' 'mariadb-libs' 'libmicrohttpd'
38
'libmodplug' 'libmpeg2' 'libnfs' 'libpulse' 'libva'
39
'libvdpau' 'libxrandr' 'libxslt' 'lirc' 'lzo' 'mesa' 'nasm'
40
'pipewire' 'python-pycryptodomex' 'python-pillow' 'python-pybluez'
41
'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'taglib'
42
'tinyxml' 'swig' 'upower' 'giflib' 'nlohmann-json' 'ghostscript' 'meson' 'gtest'
43
'graphviz' 'pcre' 'tinyxml2' 'libdisplay-info' 'exiv2'
44
# cmake/scripts/linux/Install.cmake calls distutils
45
# python 3.12 does no longer come with distutils on board
46
'python-setuptools'
47
# wayland
48
'wayland-protocols' 'waylandpp' 'libxkbcommon'
49
# gbm
50
'libinput'
51
)
52
options=(!lto)
53
54
[[ -n "$_clangbuild" ]] && makedepends+=('clang' 'lld' 'llvm')
55
56
_gitname=xbmc
57
_codename=master
58
59
# upstream pull requests to apply
60
_prs=()
61
62
# Found on their respective github release pages. One can check them against
63
# what is pulled down when not specifying them in the cmake step.
64
# $CHROOT/build/kodi-git/src/kodi-build/build/download
65
#
66
# https://github.com/xbmc/FFmpeg/tags
67
# https://github.com/xbmc/libdvdcss/tags
68
# https://github.com/xbmc/libdvdnav/tags
69
# https://github.com/xbmc/libdvdread/tags
70
#
71
_libdvdcss_version="1.4.3-Next-Nexus-Alpha2-2"
72
_libdvdnav_version="6.1.1-Next-Nexus-Alpha2-2"
73
_libdvdread_version="6.1.3-Next-Nexus-Alpha2-2"
74
_ffmpeg_version="9.0.1"
75
_crossguid_version="ca1bf4b810e2d188d04cb6286f957008ee1b7681"
76
_fstrcmp_version="0.7.D001"
77
_flatbuffers_version="23.3.3"
78
_libudfread_version="1.2.0"
79
source=(
80
"git+https://github.com/xbmc/xbmc.git#branch=$_codename"
81
"libdvdcss-$_libdvdcss_version.tar.gz::https://github.com/xbmc/libdvdcss/archive/$_libdvdcss_version.tar.gz"
82
"libdvdnav-$_libdvdnav_version.tar.gz::https://github.com/xbmc/libdvdnav/archive/$_libdvdnav_version.tar.gz"
83
"libdvdread-$_libdvdread_version.tar.gz::https://github.com/xbmc/libdvdread/archive/$_libdvdread_version.tar.gz"
84
"https://ffmpeg.org/releases/ffmpeg-$_ffmpeg_version.tar.xz"
85
"https://mirrors.kodi.tv/build-deps/sources/crossguid-$_crossguid_version.tar.gz"
86
"https://mirrors.kodi.tv/build-deps/sources/fstrcmp-$_fstrcmp_version.tar.gz"
87
"https://mirrors.kodi.tv/build-deps/sources/flatbuffers-$_flatbuffers_version.tar.gz"
88
"https://mirrors.kodi.tv/build-deps/sources/libudfread-$_libudfread_version.tar.bz2"
89
)
90
noextract=(
91
"libdvdcss-$_libdvdcss_version.tar.gz"
92
"libdvdnav-$_libdvdnav_version.tar.gz"
93
"libdvdread-$_libdvdread_version.tar.gz"
94
"ffmpeg-$_ffmpeg_version.tar.xz"
95
"crossguid-$_crossguid_version.tar.gz"
96
"fstrcmp-$_fstrcmp_version.tar.gz"
97
"flatbuffers-$_flatbuffers_version.tar.gz"
98
"libudfread-$_libudfread_version.tar.bz2"
99
)
100
b2sums=('SKIP'
101
'2f503d3ab767094958f7ec10b4ad11ffd02665deee571c8f3c739bef5fc7e2ff84babc5a3fdee638dc095f896b72fe3ce65e6b688674cb5f7b7b77190992688c'
102
'db4d05836d8fbb3637ae50bdbfc0e4b612ee6b3be24addfea94ce772c3bf28d58b63a3f252d6f9f016f72f8cbb841cc1820b091226b136f4c4664385a32da73c'
103
'c94feb5a03a12efa5b7767965118d2500a088299ea36f3b82e46d157e45893e6b04503cb50f179ca681bac914457607fab26acfa6e304752b355c407578572d1'
104
'85b3b175211dfc013ae5df3ffd2bf2a1fd68f682f6b63d1a1a3aa431b7a8b5ef15c41108a6fa1ef2b15e6677f182ab02e48e0b56d3f301ef8e1777a473e8dd82'
105
'0f78a8ab5a420297f666b3b8156d499a9141ec25c049d4d2bb2ba594dc585abe211a149b83c605cce4f5530207231a065d5f3a87a0c969781de8c6381afa2527'
106
'a8b68fcb8613f0d30e5ff7b862b37408472162585ca71cdff328e3299ff50476fd265467bbd77b352b22bb88c590969044f74d91c5468475504568fd269fa69e'
107
'be5e3c8ea81ce4b6f2e2c1b2f22e1172434c435f096fa7dade060578c506cff0310e3e2ef0627e26ce2be44f740652eb9a8e1b63578c18f430f7925820f04e66'
108
'954caea7ae3cc91034ce1ba802e445f4989b9a75ec34b9373b523a312d7ed6296f14c32579edb5ef094379fbd1f48dd94d7dbc9a34ecdb263d765c23b63a81d4')
109
110
pkgver() {
111
cd "$_gitname"
112
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
113
}
114
115
prepare() {
116
[[ -d kodi-build ]] && rm -rf kodi-build
117
mkdir "$srcdir/kodi-build"
118
119
cd "$_gitname"
120
121
local _pr
122
for _pr in "${_prs[@]}"; do
123
msg2 "Applying pull request $_pr"
124
git fetch origin "pull/$_pr/head"
125
git diff --binary "$(git merge-base HEAD FETCH_HEAD)" FETCH_HEAD | git apply --3way -
126
done
127
128
rm -rf system/certs # remove not needed cacert
129
130
if [[ -n "$_clangbuild" ]]; then
131
msg "Building with clang"
132
export CC=clang CXX=clang++
133
fi
134
}
135
136
build() {
137
cd "$srcdir/kodi-build"
138
# disable https://rfc.archlinux.page/0023-pack-relative-relocs/
139
export LDFLAGS=${LDFLAGS/-Wl,-z,pack-relative-relocs}
140
141
_args=(
142
-DCMAKE_BUILD_TYPE=Release
143
-DCMAKE_INSTALL_PREFIX=/usr
144
-DCMAKE_INSTALL_LIBDIR=/usr/lib
145
-DENABLE_SSE=ON
146
-DENABLE_SSE2=ON
147
-DENABLE_SSE3=ON
148
-DENABLE_SSSE3=ON
149
-DENABLE_SSE4_1=ON
150
-DENABLE_SSE4_2=ON
151
-DENABLE_AVX=ON
152
-DENABLE_AVX2=ON
153
-DUSE_LTO=$(nproc)
154
-DENABLE_LDGOLD=OFF
155
-DENABLE_AIRTUNES=OFF
156
-DENABLE_PLIST=OFF
157
-DENABLE_AVAHI=ON
158
-DENABLE_BLURAY=ON
159
-DENABLE_CEC=ON
160
-DENABLE_DBUS=ON
161
-DENABLE_DVDCSS=ON
162
-DENABLE_EGL=ON
163
-DENABLE_EVENTCLIENTS=ON
164
-DENABLE_MICROHTTPD=ON
165
-DENABLE_MYSQLCLIENT=ON
166
-DENABLE_NFS=ON
167
-DENABLE_OPTICAL=ON
168
-DENABLE_SMBCLIENT=ON
169
-DENABLE_UDEV=ON
170
-DENABLE_UPNP=ON
171
-DENABLE_VAAPI=ON
172
-DENABLE_VDPAU=ON
173
-DENABLE_XSLT=ON
174
-DENABLE_LIRCCLIENT=ON
175
-DENABLE_INTERNAL_RapidJSON=OFF
176
-DENABLE_INTERNAL_FFMPEG=ON
177
-DENABLE_INTERNAL_CROSSGUID=ON
178
-DENABLE_INTERNAL_FSTRCMP=ON
179
-DENABLE_INTERNAL_FLATBUFFERS=ON
180
-DENABLE_INTERNAL_UDFREAD=ON
181
-DENABLE_SSE=ON -DENABLE_SSE2=ON -DENABLE_SSE3=ON -DENABLE_SSSE3=ON
182
-DENABLE_SSE4_1=ON -DENABLE_SSE4_2=ON -DENABLE_AVX=ON -DENABLE_AVX2=ON
183
-Dlibdvdcss_URL="$srcdir/libdvdcss-$_libdvdcss_version.tar.gz"
184
-Dlibdvdnav_URL="$srcdir/libdvdnav-$_libdvdnav_version.tar.gz"
185
-Dlibdvdread_URL="$srcdir/libdvdread-$_libdvdread_version.tar.gz"
186
-DFFMPEG_URL="$srcdir/ffmpeg-$_ffmpeg_version.tar.xz"
187
-DCROSSGUID_URL="$srcdir/crossguid-$_crossguid_version.tar.gz"
188
-DFSTRCMP_URL="$srcdir/fstrcmp-$_fstrcmp_version.tar.gz"
189
-DFLATBUFFERS_URL="$srcdir/flatbuffers-$_flatbuffers_version.tar.gz"
190
-DUDFREAD_URL="$srcdir/libudfread-$_libudfread_version.tar.bz2"
191
-DAPP_RENDER_SYSTEM=$_renderer
192
)
193
194
echo "building kodi"
195
cmake "${_args[@]}" ../"$_gitname"
196
make
197
}
198
199
# kodi
200
# components: kodi
201
package_kodi-git() {
202
pkgdesc="A software media player and entertainment hub for digital media (master branch, $_renderer renderer)"
203
depends=(
204
'bluez-libs' 'curl' 'dav1d' 'desktop-file-utils' 'hicolor-icon-theme' 'fmt'
205
'lcms2' 'libass' 'libbluray' 'libcdio' 'libcec' 'libmicrohttpd' 'libnfs'
206
'libpulse' 'libva' 'libvdpau' 'libxslt' 'lirc' 'lzo'
207
'mariadb-libs' 'mesa' 'libpipewire' 'python-pillow' 'python-pycryptodomex'
208
'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'sqlite'
209
'tinyxml' 'taglib' 'libxrandr' 'libxkbcommon' 'waylandpp' 'libinput'
210
'pcre' 'tinyxml2' 'libdisplay-info' 'exiv2'
211
)
212
[[ -n "$_clangbuild" ]] && depends+=('glu')
213
214
optdepends=(
215
'bluez: Blutooth support'
216
'python-pybluez: Bluetooth support'
217
'pulseaudio: PulseAudio support'
218
'pipewire: PipeWire support'
219
'upower: Display battery level'
220
)
221
provides=("kodi-common=${pkgver}" 'kodi-x11' 'kodi-wayland' 'kodi-gbm' 'kodi')
222
conflicts=('kodi' 'kodi-gles' 'kodi-x11' 'kodi-wayland' 'kodi-gbm')
223
224
_components=(
225
'kodi'
226
'kodi-bin'
227
)
228
229
cd kodi-build
230
for _cmp in ${_components[@]}; do
231
DESTDIR="$pkgdir" /usr/bin/cmake \
232
-DCMAKE_INSTALL_COMPONENT="$_cmp" \
233
-P cmake_install.cmake
234
done
235
236
# avoid error <general>: GetDirectory - Error getting /usr/lib/kodi/addons
237
# https://bugs.archlinux.org/task/77366
238
mkdir -p "$pkgdir"/usr/lib/kodi/addons
239
240
# https://gitlab.archlinux.org/archlinux/packaging/packages/kodi/-/issues/2
241
mkdir -p "$pkgdir"/usr/share/kodi/system/certs
242
ln -s /etc/ssl/cert.pem "$pkgdir"/usr/share/kodi/system/certs/cacert.pem
243
244
}
245
246
# kodi-eventclients
247
# components: kodi-eventclients-common kodi-eventclients-ps3 kodi-eventclients-kodi-send
248
package_kodi-git-eventclients() {
249
pkgdesc="Kodi Event Clients (master branch)"
250
provides=("kodi-eventclients=${pkgver}")
251
conflicts=('kodi-eventclients')
252
optdepends=(
253
'kodi: local machine eventclient use'
254
'python: most eventclients are implemented in python'
255
)
256
257
_components=(
258
'kodi-eventclients-common'
259
'kodi-eventclients-ps3'
260
'kodi-eventclients-kodi-send'
261
)
262
263
cd kodi-build
264
for _cmp in ${_components[@]}; do
265
DESTDIR="$pkgdir" /usr/bin/cmake \
266
-DCMAKE_INSTALL_COMPONENT="$_cmp" \
267
-P cmake_install.cmake
268
done
269
}
270
271
# kodi-tools-texturepacker
272
# components: kodi-tools-texturepacker
273
package_kodi-git-tools-texturepacker() {
274
pkgdesc="Kodi Texturepacker tool (master branch)"
275
provides=("kodi-tools-texturepacker=${pkgver}")
276
conflicts=('kodi-tools-texturepacker')
277
depends=('libpng' 'giflib' 'libjpeg-turbo' 'lzo')
278
279
_components=(
280
'kodi-tools-texturepacker'
281
)
282
283
cd kodi-build
284
for _cmp in ${_components[@]}; do
285
DESTDIR="$pkgdir" /usr/bin/cmake \
286
-DCMAKE_INSTALL_COMPONENT="$_cmp" \
287
-P cmake_install.cmake
288
done
289
}
290
291
# kodi-dev
292
# components: kodi-addon-dev kodi-eventclients-dev
293
package_kodi-git-dev() {
294
pkgdesc="Kodi dev files (master branch)"
295
provides=("kodi-dev=${pkgver}")
296
conflicts=('kodi-dev')
297
298
_components=(
299
'kodi-addon-dev'
300
'kodi-eventclients-dev'
301
)
302
303
cd kodi-build
304
for _cmp in ${_components[@]}; do
305
DESTDIR="$pkgdir" /usr/bin/cmake \
306
-DCMAKE_INSTALL_COMPONENT="$_cmp" \
307
-P cmake_install.cmake
308
done
309
}
310
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |