kodi-git-tools-texturepacker

LOW
maintainer graysky 84 votes base kodi-git scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package builds Kodi from its official git repository and downloads additional sources from kodi.tv's mirrors or official project sites; all fetched code is part of the normal build process, and the non-whitelisted host (mirrors.kodi.tv) is a legitimate infrastructure for Kodi project dependencies, posing no supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds Kodi from its official git repository and downloads additional sources from kodi.tv's mirrors or official project sites; all fetched code is part of the normal build process, and the non-whitelisted host (mirrors.kodi.tv) is a legitimate infrastructure for Kodi project dependencies, posing no supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:81 "https://mirrors.kodi.tv/build-deps/sources/libdvdcss-$_libdvdcss_version.tar.bz2"

PKGBUILD

1 offending line(s) highlighted
1# vim:set ts=2 sw=2 et:
2# Maintainer graysky <therealgraysky AT protonmail DOT com>
3# Contributor: BlackIkeEagle < ike DOT devolder AT gmail DOT com >
4# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
5# Contributor: DonVla <donvla@users.sourceforge.net>
6# Contributor: Ulf Winkelvos <ulf [at] winkelvos [dot] de>
7# Contributor: Ralf Barth <archlinux dot org at haggy dot org>
8# Contributor: B & monty - Thanks for your hints :)
9# Contributor: marzoul
10# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
11# Contributor: Brad Fanella <bradfanella@archlinux.us>
12# Contributor: [vEX] <niechift.dot.vex.at.gmail.dot.com>
13# Contributor: Zeqadious <zeqadious.at.gmail.dot.com>
14# Contributor: Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
15# Contributor: Maxime Gauduin <alucryd@gmail.com>
16#
17# Original credits go to Edgar Hucek <gimli at dark-green dot com>
18# for his xbmc-vdpau-vdr PKGBUILD at https://archvdr.svn.sourceforge.net/svnroot/archvdr/trunk/archvdr/xbmc-vdpau-vdr/PKGBUILD
19
20# set this to anything to build with clang rather than with gcc
21_clangbuild=
22
23# define the applicaton render system, valid values are either 'gl' or 'gles'
24_renderer=gl
25
26pkgbase=kodi-git
27pkgname=("$pkgbase" "$pkgbase-eventclients" "$pkgbase-tools-texturepacker" "$pkgbase-dev")
28pkgver=r73041.8c23c64b0dc
29pkgrel=1
30arch=('x86_64')
31url="https://kodi.tv"
32license=('GPL-2.0-or-later')
33makedepends=(
34 'bluez-libs' 'cmake' 'curl' 'dav1d' 'doxygen' 'git' 'glew'
35 # jdk23-openjdk causes build errors
36 'gperf' 'hicolor-icon-theme' 'java-runtime<21' 'fmt' 'libass'
37 'libbluray' 'libcdio' 'libcec' 'libgl' 'mariadb-libs' 'libmicrohttpd'
38 'libmodplug' 'libmpeg2' 'libnfs' 'libpulse' 'libva'
39 'libvdpau' 'libxrandr' 'libxslt' 'lirc' 'lzo' 'mesa' 'nasm'
40 'pipewire' 'python-pycryptodomex' 'python-pillow' 'python-pybluez'
41 'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'taglib'
42 'tinyxml' 'swig' 'upower' 'giflib' 'nlohmann-json' 'ghostscript' 'meson' 'gtest'
43 'graphviz' 'pcre' 'tinyxml2' 'libdisplay-info' 'exiv2'
44 # cmake/scripts/linux/Install.cmake calls distutils
45 # python 3.12 does no longer come with distutils on board
46 'python-setuptools'
47 # wayland
48 'wayland-protocols' 'waylandpp' 'libxkbcommon'
49 # gbm
50 'libinput'
51)
52options=(!lto)
53
54[[ -n "$_clangbuild" ]] && makedepends+=('clang' 'lld' 'llvm')
55
56_gitname=xbmc
57_codename=master
58
59# upstream pull requests to apply
60_prs=()
61
62# Found on their respective github release pages. One can check them against
63# what is pulled down when not specifying them in the cmake step.
64# $CHROOT/build/kodi-git/src/kodi-build/build/download
65#
66# https://github.com/xbmc/FFmpeg/tags
67# https://github.com/xbmc/libdvdcss/tags
68# https://github.com/xbmc/libdvdnav/tags
69# https://github.com/xbmc/libdvdread/tags
70#
71_libdvdcss_version="1.5.0"
72_libdvdnav_version="7.0.0"
73_libdvdread_version="7.0.1"
74_ffmpeg_version="9.0.2"
75_crossguid_version="ca1bf4b810e2d188d04cb6286f957008ee1b7681"
76_fstrcmp_version="0.7.D001"
77_flatbuffers_version="23.3.3"
78_libudfread_version="1.2.0"
79source=(
80 "git+https://github.com/xbmc/xbmc.git#branch=$_codename"
81 "https://mirrors.kodi.tv/build-deps/sources/libdvdcss-$_libdvdcss_version.tar.bz2"
82 "https://mirrors.kodi.tv/build-deps/sources/libdvdnav-$_libdvdnav_version.tar.bz2"
83 "https://mirrors.kodi.tv/build-deps/sources/libdvdread-$_libdvdread_version.tar.bz2"
84 "https://ffmpeg.org/releases/ffmpeg-$_ffmpeg_version.tar.xz"
85 "https://mirrors.kodi.tv/build-deps/sources/crossguid-$_crossguid_version.tar.gz"
86 "https://mirrors.kodi.tv/build-deps/sources/fstrcmp-$_fstrcmp_version.tar.gz"
87 "https://mirrors.kodi.tv/build-deps/sources/flatbuffers-$_flatbuffers_version.tar.gz"
88 "https://mirrors.kodi.tv/build-deps/sources/libudfread-$_libudfread_version.tar.bz2"
89)
90noextract=(
91 "libdvdcss-$_libdvdcss_version.tar.bz2"
92 "libdvdnav-$_libdvdnav_version.tar.bz2"
93 "libdvdread-$_libdvdread_version.tar.bz2"
94 "ffmpeg-$_ffmpeg_version.tar.xz"
95 "crossguid-$_crossguid_version.tar.gz"
96 "fstrcmp-$_fstrcmp_version.tar.gz"
97 "flatbuffers-$_flatbuffers_version.tar.gz"
98 "libudfread-$_libudfread_version.tar.bz2"
99)
100b2sums=('SKIP'
101 '2f503d3ab767094958f7ec10b4ad11ffd02665deee571c8f3c739bef5fc7e2ff84babc5a3fdee638dc095f896b72fe3ce65e6b688674cb5f7b7b77190992688c'
102 'db4d05836d8fbb3637ae50bdbfc0e4b612ee6b3be24addfea94ce772c3bf28d58b63a3f252d6f9f016f72f8cbb841cc1820b091226b136f4c4664385a32da73c'
103 'c94feb5a03a12efa5b7767965118d2500a088299ea36f3b82e46d157e45893e6b04503cb50f179ca681bac914457607fab26acfa6e304752b355c407578572d1'
104 'c768e75f3b129d7e51131ebe36813fdddbf8087637a15d3bad6e10a73b1d4fc815deee189809ff51750c5e00c4df401134417c911a3c97393d40e56cf3fd8308'
105 '0f78a8ab5a420297f666b3b8156d499a9141ec25c049d4d2bb2ba594dc585abe211a149b83c605cce4f5530207231a065d5f3a87a0c969781de8c6381afa2527'
106 'a8b68fcb8613f0d30e5ff7b862b37408472162585ca71cdff328e3299ff50476fd265467bbd77b352b22bb88c590969044f74d91c5468475504568fd269fa69e'
107 'be5e3c8ea81ce4b6f2e2c1b2f22e1172434c435f096fa7dade060578c506cff0310e3e2ef0627e26ce2be44f740652eb9a8e1b63578c18f430f7925820f04e66'
108 '954caea7ae3cc91034ce1ba802e445f4989b9a75ec34b9373b523a312d7ed6296f14c32579edb5ef094379fbd1f48dd94d7dbc9a34ecdb263d765c23b63a81d4')
109
110pkgver() {
111 cd "$_gitname"
112 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
113}
114
115prepare() {
116 [[ -d kodi-build ]] && rm -rf kodi-build
117 mkdir "$srcdir/kodi-build"
118
119 cd "$_gitname"
120
121 local _pr
122 for _pr in "${_prs[@]}"; do
123 msg2 "Applying pull request $_pr"
124 git fetch origin "pull/$_pr/head"
125 git diff --binary "$(git merge-base HEAD FETCH_HEAD)" FETCH_HEAD | git apply --3way -
126 done
127
128 rm -rf system/certs # remove not needed cacert
129
130 if [[ -n "$_clangbuild" ]]; then
131 msg "Building with clang"
132 export CC=clang CXX=clang++
133 fi
134}
135
136build() {
137 cd "$srcdir/kodi-build"
138 # disable https://rfc.archlinux.page/0023-pack-relative-relocs/
139 export LDFLAGS=${LDFLAGS/-Wl,-z,pack-relative-relocs}
140
141 _args=(
142 -DCMAKE_BUILD_TYPE=Release
143 -DCMAKE_INSTALL_PREFIX=/usr
144 -DCMAKE_INSTALL_LIBDIR=/usr/lib
145 -DENABLE_SSE=ON
146 -DENABLE_SSE2=ON
147 -DENABLE_SSE3=ON
148 -DENABLE_SSSE3=ON
149 -DENABLE_SSE4_1=ON
150 -DENABLE_SSE4_2=ON
151 -DENABLE_AVX=ON
152 -DENABLE_AVX2=ON
153 -DUSE_LTO=$(nproc)
154 -DENABLE_LDGOLD=OFF
155 -DENABLE_AIRTUNES=OFF
156 -DENABLE_PLIST=OFF
157 -DENABLE_AVAHI=ON
158 -DENABLE_BLURAY=ON
159 -DENABLE_CEC=ON
160 -DENABLE_DBUS=ON
161 -DENABLE_DVDCSS=ON
162 -DENABLE_EGL=ON
163 -DENABLE_EVENTCLIENTS=ON
164 -DENABLE_MICROHTTPD=ON
165 -DENABLE_MYSQLCLIENT=ON
166 -DENABLE_NFS=ON
167 -DENABLE_OPTICAL=ON
168 -DENABLE_SMBCLIENT=ON
169 -DENABLE_UDEV=ON
170 -DENABLE_UPNP=ON
171 -DENABLE_VAAPI=ON
172 -DENABLE_VDPAU=ON
173 -DENABLE_XSLT=ON
174 -DENABLE_LIRCCLIENT=ON
175 -DENABLE_INTERNAL_RapidJSON=OFF
176 -DENABLE_INTERNAL_FFMPEG=ON
177 -DENABLE_INTERNAL_CROSSGUID=ON
178 -DENABLE_INTERNAL_FSTRCMP=ON
179 -DENABLE_INTERNAL_FLATBUFFERS=ON
180 -DENABLE_INTERNAL_UDFREAD=ON
181 -DLIBDVDCSS_URL="$srcdir/libdvdcss-$_libdvdcss_version.tar.bz2"
182 -DLIBDVDNAV_URL="$srcdir/libdvdnav-$_libdvdnav_version.tar.bz2"
183 -DLIBDVDREAD_URL="$srcdir/libdvdread-$_libdvdread_version.tar.bz2"
184 -DENABLE_SSE=ON -DENABLE_SSE2=ON -DENABLE_SSE3=ON -DENABLE_SSSE3=ON
185 -DENABLE_SSE4_1=ON -DENABLE_SSE4_2=ON -DENABLE_AVX=ON -DENABLE_AVX2=ON
186 -DFFMPEG_URL="$srcdir/ffmpeg-$_ffmpeg_version.tar.xz"
187 -DCROSSGUID_URL="$srcdir/crossguid-$_crossguid_version.tar.gz"
188 -DFSTRCMP_URL="$srcdir/fstrcmp-$_fstrcmp_version.tar.gz"
189 -DFLATBUFFERS_URL="$srcdir/flatbuffers-$_flatbuffers_version.tar.gz"
190 -DFLATC_URL="$srcdir/flatbuffers-$_flatbuffers_version.tar.gz"
191 -DUDFREAD_URL="$srcdir/libudfread-$_libudfread_version.tar.bz2"
192 -DAPP_RENDER_SYSTEM=$_renderer
193 )
194
195 echo "building kodi"
196 cmake "${_args[@]}" ../"$_gitname"
197 make
198}
199
200# kodi
201# components: kodi
202package_kodi-git() {
203 pkgdesc="A software media player and entertainment hub for digital media (master branch, $_renderer renderer)"
204 depends=(
205 'bluez-libs' 'curl' 'dav1d' 'desktop-file-utils' 'hicolor-icon-theme' 'fmt'
206 'lcms2' 'libass' 'libbluray' 'libcdio' 'libcec' 'libmicrohttpd' 'libnfs'
207 'libpulse' 'libva' 'libvdpau' 'libxslt' 'lirc' 'lzo'
208 'mariadb-libs' 'mesa' 'libpipewire' 'python-pillow' 'python-pycryptodomex'
209 'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'sqlite'
210 'tinyxml' 'taglib' 'libxrandr' 'libxkbcommon' 'waylandpp' 'libinput'
211 'pcre' 'tinyxml2' 'libdisplay-info' 'exiv2'
212)
213 [[ -n "$_clangbuild" ]] && depends+=('glu')
214
215 optdepends=(
216 'bluez: Blutooth support'
217 'python-pybluez: Bluetooth support'
218 'pulseaudio: PulseAudio support'
219 'pipewire: PipeWire support'
220 'upower: Display battery level'
221 )
222 provides=("kodi-common=${pkgver}" 'kodi-x11' 'kodi-wayland' 'kodi-gbm' 'kodi')
223 conflicts=('kodi' 'kodi-gles' 'kodi-x11' 'kodi-wayland' 'kodi-gbm')
224
225 _components=(
226 'kodi'
227 'kodi-bin'
228 )
229
230 cd kodi-build
231 for _cmp in ${_components[@]}; do
232 DESTDIR="$pkgdir" /usr/bin/cmake \
233 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
234 -P cmake_install.cmake
235 done
236
237 # avoid error <general>: GetDirectory - Error getting /usr/lib/kodi/addons
238 # https://bugs.archlinux.org/task/77366
239 mkdir -p "$pkgdir"/usr/lib/kodi/addons
240
241 # https://gitlab.archlinux.org/archlinux/packaging/packages/kodi/-/issues/2
242 mkdir -p "$pkgdir"/usr/share/kodi/system/certs
243 ln -s /etc/ssl/cert.pem "$pkgdir"/usr/share/kodi/system/certs/cacert.pem
244
245}
246
247# kodi-eventclients
248# components: kodi-eventclients-common kodi-eventclients-ps3 kodi-eventclients-kodi-send
249package_kodi-git-eventclients() {
250 pkgdesc="Kodi Event Clients (master branch)"
251 provides=("kodi-eventclients=${pkgver}")
252 conflicts=('kodi-eventclients')
253 optdepends=(
254 'kodi: local machine eventclient use'
255 'python: most eventclients are implemented in python'
256 )
257
258 _components=(
259 'kodi-eventclients-common'
260 'kodi-eventclients-ps3'
261 'kodi-eventclients-kodi-send'
262 )
263
264 cd kodi-build
265 for _cmp in ${_components[@]}; do
266 DESTDIR="$pkgdir" /usr/bin/cmake \
267 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
268 -P cmake_install.cmake
269 done
270}
271
272# kodi-tools-texturepacker
273# components: kodi-tools-texturepacker
274package_kodi-git-tools-texturepacker() {
275 pkgdesc="Kodi Texturepacker tool (master branch)"
276 provides=("kodi-tools-texturepacker=${pkgver}")
277 conflicts=('kodi-tools-texturepacker')
278 depends=('libpng' 'giflib' 'libjpeg-turbo' 'lzo')
279
280 _components=(
281 'kodi-tools-texturepacker'
282 )
283
284 cd kodi-build
285 for _cmp in ${_components[@]}; do
286 DESTDIR="$pkgdir" /usr/bin/cmake \
287 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
288 -P cmake_install.cmake
289 done
290}
291
292# kodi-dev
293# components: kodi-addon-dev kodi-eventclients-dev
294package_kodi-git-dev() {
295 pkgdesc="Kodi dev files (master branch)"
296 provides=("kodi-dev=${pkgver}")
297 conflicts=('kodi-dev')
298
299 _components=(
300 'kodi-addon-dev'
301 'kodi-eventclients-dev'
302 )
303
304 cd kodi-build
305 for _cmp in ${_components[@]}; do
306 DESTDIR="$pkgdir" /usr/bin/cmake \
307 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
308 -P cmake_install.cmake
309 done
310}
311

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2
2026-10-13 00:23:45 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion