kodi-rpi

maintainer graysky · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds Kodi and related components from source hosted on GitHub and official mirrors; the non-standard host (mirrors.kodi.tv) is plausibly part of Kodi's infrastructure, and all downloads are verified with checksums, posing minimal risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds Kodi and related components from source hosted on GitHub and official mirrors; the non-standard host (mirrors.kodi.tv) is plausibly part of Kodi's infrastructure, and all downloads are verified with checksums, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:52 "https://mirrors.kodi.tv/build-deps/sources/crossguid-$_crossguid_version.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Contributor graysky <therealgraysky AT proton DOT me>
    
      2# Contributor: BlackIkeEagle < ike DOT devolder AT gmail DOT com>
    
      3
    
      4pkgbase=kodi-rpi
    
      5pkgname=(
    
'kodi-rpi'
    
'kodi-rpi-eventclients' 'kodi-rpi-tools-texturepacker' 'kodi-rpi-dev'
    
      8)
    
      9
    
      10_commitnumber=66020
    
      11_commit=d5b1ab28fe6ba844beaa6a489021101b6c0622db
    
      12
    
      13# set this to anything to build with clang
    
      14# recommend manually setting -DUSE_LTO=OFF to -DUSE_LTO=$(nproc) in build()
    
      15_clangbuild=
    
      16
    
      17pkgver=21.3
    
      18pkgrel=7
    
      19arch=('aarch64' 'armv7h')
    
      20url="https://github.com/graysky2/xbmc/tree/gs-gbm_omega"
    
      21license=('GPL-2.0-or-later')
    
      22makedepends=(
    
'bluez-libs' 'cmake' 'curl' 'dav1d' 'doxygen' 'git' 'glew'
    
'gperf' 'hicolor-icon-theme' 'fmt' 'libass' 'java-environment<21'
    
'libbluray' 'libcdio' 'libcec' 'libgl' 'mariadb-libs' 'libmicrohttpd'
    
'libmodplug' 'libmpeg2' 'libnfs' 'libpulse'
    
'libxrandr' 'libxslt' 'lirc' 'lzo' 'mesa' 'nasm'
    
'pipewire' 'python-pycryptodomex' 'python-pillow' 'python-pybluez'
    
'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'taglib'
    
'tinyxml' 'swig' 'upower' 'giflib' 'rapidjson' 'ghostscript' 'meson' 'gtest'
    
'graphviz' 'libinput' 'libxkbcommon' 'pcre' 'libdisplay-info' 'tinyxml2' 'python-setuptools'
    
      32)
    
      33
    
      34[[ -n "$_clangbuild" ]] && makedepends+=('clang' 'lld' 'llvm')
    
      35
    
      36_codename=Omega
    
      37_init_version=2.0
    
      38_libdvdcss_version="1.4.3-Next-Nexus-Alpha2-2"
    
      39_libdvdnav_version="6.1.1-Next-Nexus-Alpha2-2"
    
      40_libdvdread_version="6.1.3-Next-Nexus-Alpha2-2"
    
      41_ffmpeg_version="6.1.3"
    
      42_crossguid_version="ca1bf4b810e2d188d04cb6286f957008ee1b7681"
    
      43_fstrcmp_version="0.7.D001"
    
      44_flatbuffers_version="23.3.3"
    
      45_libudfread_version="1.1.2"
    
      46source=(
    
"xbmc-$pkgver.${_commit:0:10}.tar.gz::https://github.com/graysky2/xbmc/archive/$_commit.tar.gz"
    
"libdvdcss-$_libdvdcss_version.tar.gz::https://github.com/xbmc/libdvdcss/archive/$_libdvdcss_version.tar.gz"
    
"libdvdnav-$_libdvdnav_version.tar.gz::https://github.com/xbmc/libdvdnav/archive/$_libdvdnav_version.tar.gz"
    
"libdvdread-$_libdvdread_version.tar.gz::https://github.com/xbmc/libdvdread/archive/$_libdvdread_version.tar.gz"
    
"https://ffmpeg.org/releases/ffmpeg-$_ffmpeg_version.tar.gz"
    
"https://mirrors.kodi.tv/build-deps/sources/crossguid-$_crossguid_version.tar.gz"
    
"https://mirrors.kodi.tv/build-deps/sources/fstrcmp-$_fstrcmp_version.tar.gz"
    
"https://mirrors.kodi.tv/build-deps/sources/flatbuffers-$_flatbuffers_version.tar.gz"
    
"https://mirrors.kodi.tv/build-deps/sources/libudfread-$_libudfread_version.tar.gz"
    
"ArchARM-kodi-init-v$_init_version.tar.gz::https://github.com/graysky2/kodi-standalone-service/archive/v$_init_version.tar.gz"
    
kodi.config.txt
    
0001-ffmpeg-build-with-lto-when-duse-lto.patch::https://github.com/xbmc/xbmc/commit/2cc6f1728ccb67ef575fe57680dd42836e3d6a1f.patch
    
0001-Merge-pull-request-28016-from-heitbaum-giflib.patch
    
0002-backport-NFS-replace-nfs_create-with-nfs_open2.patch
    
      61)
    
      62backup=(boot/kodi.config.txt etc/conf.d/kodi-standalone)
    
      63noextract=(
    
"libdvdcss-$_libdvdcss_version.tar.gz"
    
"libdvdnav-$_libdvdnav_version.tar.gz"
    
"libdvdread-$_libdvdread_version.tar.gz"
    
"ffmpeg-$_ffmpeg_version.tar.gz"
    
"crossguid-$_crossguid_version.tar.gz"
    
"fstrcmp-$_fstrcmp_version.tar.gz"
    
"flatbuffers-$_flatbuffers_version.tar.gz"
    
"libudfread-$_libudfread_version.tar.gz"
    
      72)
    
      73sha256sums=('561edb25c047d604f7a67c1689fd47a101646a544426a690c32709c564dcbfde'
    
          'f38c4a4e7a4f4da6d8e83b8852489aa3bb6588a915dc41f5ee89d9aad305a06e'
    
          '584f62a3896794408d46368e2ecf2c6217ab9c676ce85921b2d68b8961f49dfc'
    
          '719130091e3adc9725ba72df808f24a14737a009dca5a4c38c601c0c76449b62'
    
          '3be466dfd1a312d752c20ece5b413248a5808fba3c967da0624bac48a4380857'
    
          '6be27e0b3a4907f0cd3cfadec255ee1b925569e1bd06e67a4d2f4267299b69c4'
    
          'e4018e850f80700acee8da296e56e15b1eef711ab15157e542e7d7e1237c3476'
    
          '8aff985da30aaab37edf8e5b02fda33ed4cbdd962699a8e2af98fdef306f4e4d'
    
          '2bf16726ac98d093156195bb049a663e07d3323e079c26912546f4e05c77bac5'
    
          '995910eb228986cfb8b921a86d421e06130dfb629a97681eb8c0a2e7ede2d9cf'
    
          '5ac76e6ff16d8f0f60a414647bddb13b46402563dd02d69a05e90c0ddbb085f0'
    
          '5a2f1c5fa9189d56eaf7e05024071c57e11f92b4eeb68b4bb0555c1fdd66c890'
    
          '36a2b3c0ec76fd6511fa0679a1d4fd15ab50edc5618992cc0f18ac822a355d32'
    
          'd3b7377d5b194fa54514656230dc25ab67b07a2769830e5de69519649be9d091')
    
      87
    
      88prepare() {
    
[[ -d "$srcdir/kodi-build" ]] && rm -rf "$srcdir/kodi-build"
    
mkdir "$srcdir/kodi-build"
    
cd "xbmc-$_commit"
    
      92
    
rm -rf system/certs # remove not needed cacert
    
      94
    
# honor LTO settings when building ffmpeg
    
patch -p1 -i ../0001-ffmpeg-build-with-lto-when-duse-lto.patch
    
      97
    
# backports to fix build
    
patch -p1 -i ../0001-Merge-pull-request-28016-from-heitbaum-giflib.patch
    
patch -p1 -i ../0002-backport-NFS-replace-nfs_create-with-nfs_open2.patch
    
      101}
    
      102
    
      103build() {
    
# disable https://rfc.archlinux.page/0023-pack-relative-relocs/
    
export LDFLAGS=${LDFLAGS/-Wl,-z,pack-relative-relocs}
    
      106
    
cd kodi-build
    
      108
    
_args=(
    
  -DCMAKE_BUILD_TYPE=Release
    
  -DCMAKE_INSTALL_PREFIX=/usr
    
  -DCMAKE_INSTALL_LIBDIR=/usr/lib
    
  -DVERBOSE=ON
    
  -DUSE_LTO=ON
    
  -DENABLE_LDGOLD=OFF
    
  -DENABLE_AIRTUNES=OFF
    
  -DENABLE_PLIST=OFF
    
  -DENABLE_AVAHI=ON
    
  -DENABLE_BLURAY=ON
    
  -DENABLE_CEC=ON
    
  -DENABLE_DBUS=ON
    
  -DENABLE_DVDCSS=ON
    
  -DENABLE_EGL=ON
    
  -DENABLE_EVENTCLIENTS=ON
    
  -DENABLE_MICROHTTPD=ON
    
  -DENABLE_MYSQLCLIENT=ON
    
  -DENABLE_NFS=ON
    
  -DENABLE_OPTICAL=ON
    
  -DENABLE_SMBCLIENT=ON
    
  -DENABLE_UDEV=ON
    
  -DENABLE_UPNP=ON
    
  -DENABLE_VAAPI=OFF
    
  -DENABLE_VDPAU=OFF
    
  -DENABLE_XSLT=ON
    
  -DENABLE_LIRCCLIENT=ON
    
  -DENABLE_INTERNAL_RapidJSON=OFF
    
  -DENABLE_INTERNAL_FFMPEG=ON
    
  -DENABLE_INTERNAL_CROSSGUID=ON
    
  -DENABLE_INTERNAL_FSTRCMP=ON
    
  -DENABLE_INTERNAL_FLATBUFFERS=ON
    
  -DENABLE_INTERNAL_UDFREAD=ON
    
  -Dlibdvdcss_URL="$srcdir/libdvdcss-$_libdvdcss_version.tar.gz"
    
  -Dlibdvdnav_URL="$srcdir/libdvdnav-$_libdvdnav_version.tar.gz"
    
  -Dlibdvdread_URL="$srcdir/libdvdread-$_libdvdread_version.tar.gz"
    
  -DFFMPEG_URL="$srcdir/ffmpeg-$_ffmpeg_version.tar.gz"
    
  -DCROSSGUID_URL="$srcdir/crossguid-$_crossguid_version.tar.gz"
    
  -DFSTRCMP_URL="$srcdir/fstrcmp-$_fstrcmp_version.tar.gz"
    
  -DFLATBUFFERS_URL="$srcdir/flatbuffers-$_flatbuffers_version.tar.gz"
    
  -DUDFREAD_URL="$srcdir/libudfread-$_libudfread_version.tar.gz"
    
  -DAPP_RENDER_SYSTEM=gles
    
  -DCORE_PLATFORM_NAME="x11 gbm"
    
)
    
      153
    
echo "building kodi"
    
cmake "${_args[@]}" ../"xbmc-$_commit"
    
make
    
      157}
    
      158
    
      159package_kodi-rpi() {
    
pkgdesc="Media player and entertainment hub with hw accel for RPi5, gbm_omega fork"
    
depends=(
    
  'bluez-libs' 'curl' 'dav1d' 'desktop-file-utils' 'hicolor-icon-theme' 'fmt'
    
  'lcms2' 'libass' 'libbluray' 'libcdio' 'libcec' 'libmicrohttpd' 'libnfs'
    
  'libpulse' 'libxslt' 'lirc' 'mariadb-libs' 'taglib'
    
  'mesa' 'libpipewire' 'python-pillow' 'python-pycryptodomex'
    
  'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'sqlite'
    
  'tinyxml' 'libxkbcommon' 'polkit' 'lzo' 'libinput'
    
  'pcre' 'libdisplay-info' 'tinyxml2' 'linux-rpi5'
    
)
    
[[ -n "$_clangbuild" ]] && depends+=('glu')
    
      171
    
optdepends=(
    
  'bluez: Blutooth support'
    
  'python-pybluez: Bluetooth support'
    
  'pulseaudio: PulseAudio support'
    
  'pipewire: PipeWire support'
    
)
    
install='kodi.install'
    
provides=("kodi=${pkgver}" "kodi-common=${pkgver}")
    
conflicts=('kodi')
    
      181
    
_components=(
    
  'kodi'
    
  'kodi-bin'
    
)
    
      186
    
cd kodi-build
    
for _cmp in ${_components[@]}; do
    
DESTDIR="$pkgdir" /usr/bin/cmake \
    
  -DCMAKE_INSTALL_COMPONENT="$_cmp" \
    
   -P cmake_install.cmake
    
done
    
      193
    
# setup video drivers for kodi-gbm
    
install -Dm0644 "$srcdir/kodi.config.txt" "$pkgdir/boot/kodi.config.txt"
    
      196
    
sed -i 's/@@@/512/' "$pkgdir/boot/kodi.config.txt"
    
      198
    
_initshit="$srcdir/kodi-standalone-service-$_init_version/arm"
    
      200
    
# fix permissions necessary for accelerated video playback
    
install -Dm0644 "$_initshit/udev/99-kodi.rules" "$pkgdir/usr/lib/udev/rules.d/99-kodi.rules"
    
      203
    
# environment vars
    
install -Dm644 "${_initshit/\/arm}"/common/kodi-standalone "$pkgdir/etc/conf.d/kodi-standalone"
    
      206
    
# systemd manages kodi user
    
install -Dm644 "$_initshit"/init/sysusers.conf "$pkgdir/usr/lib/sysusers.d/kodi.conf"
    
install -Dm644 "$_initshit"/init/tmpfiles.conf "$pkgdir/usr/lib/tmpfiles.d/kodi.conf"
    
      210
    
# systemd service and polkit rules
    
install -Dm0644 "$_initshit/init/kodi.service" "$pkgdir/usr/lib/systemd/system/kodi.service"
    
install -Dm0644 "$_initshit/polkit/polkit.rules" "$pkgdir/usr/share/polkit-1/rules.d/10-kodi.rules"
    
chmod 0755 "$pkgdir/usr/share/polkit-1/rules.d/"
    
      215
    
# man page
    
install -Dm0644 "$_initshit/doc/kodi.service.1" "$pkgdir/usr/share/man/man1/kodi.service.1"
    
      218
    
# avoid error <general>: GetDirectory - Error getting /usr/lib/kodi/addons
    
# https://bugs.archlinux.org/task/77366
    
mkdir -p "$pkgdir"/usr/lib/kodi/addons
    
      222
    
# https://archlinux.org/todo/use-system-ca-store/
    
mkdir -p "$pkgdir"/usr/share/kodi/system/certs
    
ln -s /etc/ssl/cert.pem "$pkgdir"/usr/share/kodi/system/certs/cacert.pem
    
      226}
    
      227
    
      228package_kodi-rpi-eventclients() {
    
pkgdesc="Kodi Event Clients"
    
provides=("kodi-eventclients=${pkgver}")
    
conflicts=('kodi-rpi-legacy-eventclients')
    
optdepends=(
    
  'kodi: local machine eventclient use'
    
  'python: most eventclients are implemented in python'
    
)
    
      236
    
_components=(
    
  'kodi-eventclients-common'
    
  'kodi-eventclients-ps3'
    
  'kodi-eventclients-kodi-send'
    
)
    
      242
    
cd kodi-build
    
for _cmp in ${_components[@]}; do
    
  DESTDIR="$pkgdir" /usr/bin/cmake \
    
    -DCMAKE_INSTALL_COMPONENT="$_cmp" \
    
    -P cmake_install.cmake
    
done
    
      249}
    
      250
    
      251package_kodi-rpi-tools-texturepacker() {
    
pkgdesc="Kodi Texturepacker Tool"
    
depends=('libpng' 'giflib' 'libjpeg-turbo' 'lzo')
    
conflicts=('kodi-rpi-legacy-tools-texturepacker')
    
      255
    
_components=(
    
  'kodi-tools-texturepacker'
    
)
    
      259
    
cd kodi-build
    
for _cmp in ${_components[@]}; do
    
  DESTDIR="$pkgdir" /usr/bin/cmake \
    
    -DCMAKE_INSTALL_COMPONENT="$_cmp" \
    
    -P cmake_install.cmake
    
done
    
      266}
    
      267
    
      268package_kodi-rpi-dev() {
    
pkgdesc="Kodi dev files"
    
depends=('kodi')
    
conflicts=('kodi-rpi-legacy-dev')
    
provides=("kodi-dev=${pkgver}")
    
      273
    
_components=(
    
  'kodi-addon-dev'
    
  'kodi-eventclients-dev'
    
)
    
      278
    
cd kodi-build
    
for _cmp in ${_components[@]}; do
    
  DESTDIR="$pkgdir" /usr/bin/cmake \
    
    -DCMAKE_INSTALL_COMPONENT="$_cmp" \
    
    -P cmake_install.cmake
    
done
    
      285}
    
      286

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2