kodi-stable-git-dev

LOW
maintainer graysky 1 votes base kodi-stable-git scanned 2026-09-25 00:03:36.779685
View on AUR
Why flagged

The package builds Kodi from its official GitHub repository and uses additional sources from GitHub and kodi.tv mirrors, which are legitimate project-related hosts; the non-whitelisted mirror (mirrors.kodi.tv) is an official Kodi infrastructure, making the source trustworthy despite the static analysis flag.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds Kodi from its official GitHub repository and uses additional sources from GitHub and kodi.tv mirrors, which are legitimate project-related hosts; the non-whitelisted mirror (mirrors.kodi.tv) is an official Kodi infrastructure, making the source trustworthy despite the static analysis flag.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:72 "https://mirrors.kodi.tv/build-deps/sources/crossguid-$_crossguid_version.tar.gz"

PKGBUILD

1 offending line(s) highlighted
1# vim:set ts=2 sw=2 et:
2# Maintainer graysky <therealgraysky AT protonmail DOT com>
3# Contributor: BlackIkeEagle < ike DOT devolder AT gmail DOT com >
4# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
5# Contributor: DonVla <donvla@users.sourceforge.net>
6# Contributor: Ulf Winkelvos <ulf [at] winkelvos [dot] de>
7# Contributor: Ralf Barth <archlinux dot org at haggy dot org>
8# Contributor: B & monty - Thanks for your hints :)
9# Contributor: marzoul
10# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
11# Contributor: Brad Fanella <bradfanella@archlinux.us>
12# Contributor: [vEX] <niechift.dot.vex.at.gmail.dot.com>
13# Contributor: Zeqadious <zeqadious.at.gmail.dot.com>
14# Contributor: Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
15# Contributor: Maxime Gauduin <alucryd@gmail.com>
16#
17# Original credits go to Edgar Hucek <gimli at dark-green dot com>
18# for his xbmc-vdpau-vdr PKGBUILD at https://archvdr.svn.sourceforge.net/svnroot/archvdr/trunk/archvdr/xbmc-vdpau-vdr/PKGBUILD
19
20# set this to anything to build with clang rather than with gcc
21_clangbuild=
22
23# define the applicaton render system, valid values are either 'gl' or 'gles'
24_renderer=gles
25
26pkgbase=kodi-stable-git
27pkgname=("$pkgbase" "$pkgbase-eventclients" "$pkgbase-tools-texturepacker" "$pkgbase-dev")
28pkgver=r65987.f8815ee40f4
29pkgrel=1
30arch=('x86_64')
31url="https://kodi.tv"
32license=('GPL-2.0-or-later')
33makedepends=(
34 'bluez-libs' 'cmake' 'curl' 'dav1d' 'doxygen' 'git' 'glew'
35 'gperf' 'hicolor-icon-theme' 'java-runtime<21' 'fmt' 'libass'
36 'libbluray' 'libcdio' 'libcec' 'libgl' 'mariadb-libs' 'libmicrohttpd'
37 'libmodplug' 'libmpeg2' 'libnfs' 'libpulse' 'libva'
38 'libvdpau' 'libxrandr' 'libxslt' 'lirc' 'lzo' 'mesa' 'nasm'
39 'pipewire' 'python-pycryptodomex' 'python-pillow' 'python-pybluez'
40 'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'taglib'
41 'tinyxml' 'swig' 'upower' 'giflib' 'rapidjson' 'ghostscript' 'meson' 'gtest'
42 'graphviz' 'pcre2' 'tinyxml2' 'libdisplay-info'
43 # cmake/scripts/linux/Install.cmake calls distutils
44 # python 3.12 does no longer come with distutils on board
45 'python-setuptools'
46 # wayland
47 'wayland-protocols' 'waylandpp' 'libxkbcommon'
48 # gbm
49 'libinput'
50)
51options=(!lto)
52
53[[ -n "$_clangbuild" ]] && makedepends+=('clang' 'lld' 'llvm')
54
55_gitname=xbmc
56_codename=Omega
57
58_libdvdcss_version="1.4.3-Next-Nexus-Alpha2-2"
59_libdvdnav_version="6.1.1-Next-Nexus-Alpha2-2"
60_libdvdread_version="6.1.3-Next-Nexus-Alpha2-2"
61_ffmpeg_version="6.0.1"
62_crossguid_version="ca1bf4b810e2d188d04cb6286f957008ee1b7681"
63_fstrcmp_version="0.7.D001"
64_flatbuffers_version="23.3.3"
65_libudfread_version="1.1.2"
66source=(
67 "git+https://github.com/xbmc/xbmc.git#branch=$_codename"
68 "libdvdcss-$_libdvdcss_version.tar.gz::https://github.com/xbmc/libdvdcss/archive/$_libdvdcss_version.tar.gz"
69 "libdvdnav-$_libdvdnav_version.tar.gz::https://github.com/xbmc/libdvdnav/archive/$_libdvdnav_version.tar.gz"
70 "libdvdread-$_libdvdread_version.tar.gz::https://github.com/xbmc/libdvdread/archive/$_libdvdread_version.tar.gz"
71 "https://ffmpeg.org/releases/ffmpeg-$_ffmpeg_version.tar.gz"
72 "https://mirrors.kodi.tv/build-deps/sources/crossguid-$_crossguid_version.tar.gz"
73 "https://mirrors.kodi.tv/build-deps/sources/fstrcmp-$_fstrcmp_version.tar.gz"
74 "https://mirrors.kodi.tv/build-deps/sources/flatbuffers-$_flatbuffers_version.tar.gz"
75 "https://mirrors.kodi.tv/build-deps/sources/libudfread-$_libudfread_version.tar.gz"
76 "https://github.com/xbmc/xbmc/pull/28016.patch"
77 "kodi-21.3-pcre2.patch"
78 "kodi-21.3-gbm-atomic-modeset.patch"
79)
80noextract=(
81 "libdvdcss-$_libdvdcss_version.tar.gz"
82 "libdvdnav-$_libdvdnav_version.tar.gz"
83 "libdvdread-$_libdvdread_version.tar.gz"
84 "ffmpeg-$_ffmpeg_version.tar.gz"
85 "crossguid-$_crossguid_version.tar.gz"
86 "fstrcmp-$_fstrcmp_version.tar.gz"
87 "flatbuffers-$_flatbuffers_version.tar.gz"
88 "libudfread-$_libudfread_version.tar.gz"
89)
90b2sums=('SKIP'
91 '2f503d3ab767094958f7ec10b4ad11ffd02665deee571c8f3c739bef5fc7e2ff84babc5a3fdee638dc095f896b72fe3ce65e6b688674cb5f7b7b77190992688c'
92 'db4d05836d8fbb3637ae50bdbfc0e4b612ee6b3be24addfea94ce772c3bf28d58b63a3f252d6f9f016f72f8cbb841cc1820b091226b136f4c4664385a32da73c'
93 'c94feb5a03a12efa5b7767965118d2500a088299ea36f3b82e46d157e45893e6b04503cb50f179ca681bac914457607fab26acfa6e304752b355c407578572d1'
94 '6424e30c6d354abbbea8a807822ae61589413189e9c4ba7aa51c307179287506b9072626e9745861fe83753c0015b50d179f9b4f298fe9abf74bee13936639af'
95 '0f78a8ab5a420297f666b3b8156d499a9141ec25c049d4d2bb2ba594dc585abe211a149b83c605cce4f5530207231a065d5f3a87a0c969781de8c6381afa2527'
96 'a8b68fcb8613f0d30e5ff7b862b37408472162585ca71cdff328e3299ff50476fd265467bbd77b352b22bb88c590969044f74d91c5468475504568fd269fa69e'
97 'be5e3c8ea81ce4b6f2e2c1b2f22e1172434c435f096fa7dade060578c506cff0310e3e2ef0627e26ce2be44f740652eb9a8e1b63578c18f430f7925820f04e66'
98 '1801d84a0ca38410a78f23e7d44f37e6d53346753c853df2e7380d259ce1ae7f0c712825b95a5753ad0bc6360cfffe1888b9e7bc30da8b84549e0f1198248f61'
99 '6ff64fa3028dca88b1ae6e898218149811a995e13053dd6e25abcf3cacbfeac8e31a02d04592f3b5fee432d007cebda8fee5c87f673f7cdc3410855b43f5a2ee'
100 'd5b5b6b9e9863f277ebe6c427f240b1ed8d1c7ba83b52cbda38fa1d0b0e5e14f39fb3cd9a5fdf125614a54156a0c454dae0c4c240dfb58362dacf3d1bc94ad7a'
101 'dd2f3d494bd3d283df676c08be2fdab2cda49da4037c6b2e711d1b1a11ccfa9d96785f935f400ce7efef45afef4ca16e9f0b088ee336637450d4b656d82cd810')
102
103pkgver() {
104 cd "$_gitname"
105 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
106}
107
108prepare() {
109 [[ -d kodi-build ]] && rm -rf kodi-build
110 mkdir "$srcdir/kodi-build"
111
112 cd "$_gitname"
113
114 # TexturePacker will not build with giflib-6.1.2
115 # https://github.com/xbmc/xbmc/pull/28016
116 patch -p1 -i "$srcdir/28016.patch"
117 # PCRE2 support from Debian https://sources.debian.org/patches/kodi/2:21.3+dfsg-1.1/workarounds/0003-pcre2.patch/
118 patch -p1 -i "$srcdir/kodi-21.3-pcre2.patch"
119 # gbm screen refresh rate crash: https://gitlab.archlinux.org/archlinux/packaging/packages/kodi/-/work_items/20
120 # patch extracted from https://github.com/xbmc/xbmc/pull/28246/changes/2530a9be035f4b369dcccaff7ba4bb22ce5b3289
121 patch -p1 -i "$srcdir/kodi-21.3-gbm-atomic-modeset.patch"
122
123 rm -rf system/certs # remove not needed cacert
124
125 if [[ -n "$_clangbuild" ]]; then
126 msg "Building with clang"
127 export CC=clang CXX=clang++
128 fi
129}
130
131build() {
132 cd "$srcdir/kodi-build"
133 # disable https://rfc.archlinux.page/0023-pack-relative-relocs/
134 export LDFLAGS=${LDFLAGS/-Wl,-z,pack-relative-relocs}
135
136 _args=(
137 -DCMAKE_BUILD_TYPE=Release
138 -DCMAKE_INSTALL_PREFIX=/usr
139 -DCMAKE_INSTALL_LIBDIR=/usr/lib
140 -DENABLE_SSE=ON
141 -DENABLE_SSE2=ON
142 -DENABLE_SSE3=ON
143 -DENABLE_SSSE3=ON
144 -DENABLE_SSE4_1=ON
145 -DENABLE_SSE4_2=ON
146 -DENABLE_AVX=ON
147 -DENABLE_AVX2=ON
148 -DUSE_LTO=$(nproc)
149 -DENABLE_LDGOLD=OFF
150 -DENABLE_AIRTUNES=OFF
151 -DENABLE_PLIST=OFF
152 -DENABLE_AVAHI=ON
153 -DENABLE_BLURAY=ON
154 -DENABLE_CEC=ON
155 -DENABLE_DBUS=ON
156 -DENABLE_DVDCSS=ON
157 -DENABLE_EGL=ON
158 -DENABLE_EVENTCLIENTS=ON
159 -DENABLE_MICROHTTPD=ON
160 -DENABLE_MYSQLCLIENT=ON
161 -DENABLE_NFS=ON
162 -DENABLE_OPTICAL=ON
163 -DENABLE_SMBCLIENT=ON
164 -DENABLE_UDEV=ON
165 -DENABLE_UPNP=ON
166 -DENABLE_VAAPI=ON
167 -DENABLE_VDPAU=ON
168 -DENABLE_XSLT=ON
169 -DENABLE_LIRCCLIENT=ON
170 -DENABLE_INTERNAL_RapidJSON=OFF
171 -DENABLE_INTERNAL_FFMPEG=ON
172 -DENABLE_INTERNAL_CROSSGUID=ON
173 -DENABLE_INTERNAL_FSTRCMP=ON
174 -DENABLE_INTERNAL_FLATBUFFERS=ON
175 -DENABLE_INTERNAL_UDFREAD=ON
176 -Dlibdvdcss_URL="$srcdir/libdvdcss-$_libdvdcss_version.tar.gz"
177 -Dlibdvdnav_URL="$srcdir/libdvdnav-$_libdvdnav_version.tar.gz"
178 -Dlibdvdread_URL="$srcdir/libdvdread-$_libdvdread_version.tar.gz"
179 -DFFMPEG_URL="$srcdir/ffmpeg-$_ffmpeg_version.tar.gz"
180 -DCROSSGUID_URL="$srcdir/crossguid-$_crossguid_version.tar.gz"
181 -DFSTRCMP_URL="$srcdir/fstrcmp-$_fstrcmp_version.tar.gz"
182 -DFLATBUFFERS_URL="$srcdir/flatbuffers-$_flatbuffers_version.tar.gz"
183 -DUDFREAD_URL="$srcdir/libudfread-$_libudfread_version.tar.gz"
184 -DAPP_RENDER_SYSTEM=$_renderer
185 )
186
187 echo "building kodi"
188 cmake "${_args[@]}" ../"$_gitname"
189 make
190}
191
192# kodi
193# components: kodi
194package_kodi-stable-git() {
195 pkgdesc="A software media player and entertainment hub for digital media (Omega branch, $_renderer renderer)"
196 depends=(
197 'bluez-libs' 'curl' 'dav1d' 'desktop-file-utils' 'hicolor-icon-theme' 'fmt'
198 'lcms2' 'libass' 'libbluray' 'libcdio' 'libcec' 'libmicrohttpd' 'libnfs'
199 'libpulse' 'libva' 'libvdpau' 'libxslt' 'lirc' 'lzo'
200 'mariadb-libs' 'mesa' 'libpipewire' 'python-pillow' 'python-pycryptodomex'
201 'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'sqlite'
202 'tinyxml' 'taglib' 'libxrandr' 'libxkbcommon' 'waylandpp' 'libinput'
203 'pcre' 'tinyxml2' 'libdisplay-info'
204)
205 [[ -n "$_clangbuild" ]] && depends+=('glu')
206
207 optdepends=(
208 'bluez: Blutooth support'
209 'python-pybluez: Bluetooth support'
210 'pulseaudio: PulseAudio support'
211 'pipewire: PipeWire support'
212 'upower: Display battery level'
213 )
214 provides=("kodi-common=${pkgver}" 'kodi-x11' 'kodi-wayland' 'kodi-gbm')
215 conflicts=('kodi' 'kodi-gles' 'kodi-x11' 'kodi-wayland' 'kodi-gbm')
216
217 _components=(
218 'kodi'
219 'kodi-bin'
220 )
221
222 cd kodi-build
223 for _cmp in ${_components[@]}; do
224 DESTDIR="$pkgdir" /usr/bin/cmake \
225 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
226 -P cmake_install.cmake
227 done
228
229 # avoid error <general>: GetDirectory - Error getting /usr/lib/kodi/addons
230 # https://bugs.archlinux.org/task/77366
231 mkdir -p "$pkgdir"/usr/lib/kodi/addons
232
233 # https://gitlab.archlinux.org/archlinux/packaging/packages/kodi/-/issues/2
234 mkdir -p "$pkgdir"/usr/share/kodi/system/certs
235 ln -s /etc/ssl/cert.pem "$pkgdir"/usr/share/kodi/system/certs/cacert.pem
236
237}
238
239# kodi-eventclients
240# components: kodi-eventclients-common kodi-eventclients-ps3 kodi-eventclients-kodi-send
241package_kodi-stable-git-eventclients() {
242 pkgdesc="Kodi Event Clients (Omega branch)"
243 provides=("kodi-eventclients=${pkgver}")
244 conflicts=('kodi-eventclients')
245 optdepends=(
246 'kodi: local machine eventclient use'
247 'python: most eventclients are implemented in python'
248 )
249
250 _components=(
251 'kodi-eventclients-common'
252 'kodi-eventclients-ps3'
253 'kodi-eventclients-kodi-send'
254 )
255
256 cd kodi-build
257 for _cmp in ${_components[@]}; do
258 DESTDIR="$pkgdir" /usr/bin/cmake \
259 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
260 -P cmake_install.cmake
261 done
262}
263
264# kodi-tools-texturepacker
265# components: kodi-tools-texturepacker
266package_kodi-stable-git-tools-texturepacker() {
267 pkgdesc="Kodi Texturepacker tool (Omega branch)"
268 provides=("kodi-tools-texturepacker=${pkgver}")
269 conflicts=('kodi-tools-texturepacker')
270 depends=('libpng' 'giflib' 'libjpeg-turbo' 'lzo')
271
272 _components=(
273 'kodi-tools-texturepacker'
274 )
275
276 cd kodi-build
277 for _cmp in ${_components[@]}; do
278 DESTDIR="$pkgdir" /usr/bin/cmake \
279 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
280 -P cmake_install.cmake
281 done
282}
283
284# kodi-dev
285# components: kodi-addon-dev kodi-eventclients-dev
286package_kodi-stable-git-dev() {
287 pkgdesc="Kodi dev files (Omega branch)"
288 depends=('kodi-stable-git')
289 provides=("kodi-dev=${pkgver}")
290 conflicts=('kodi-dev')
291
292 _components=(
293 'kodi-addon-dev'
294 'kodi-eventclients-dev'
295 )
296
297 cd kodi-build
298 for _cmp in ${_components[@]}; do
299 DESTDIR="$pkgdir" /usr/bin/cmake \
300 -DCMAKE_INSTALL_COMPONENT="$_cmp" \
301 -P cmake_install.cmake
302 done
303}
304

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-09-25 00:03
@@ -25,7 +25,7 @@
pkgbase=kodi-stable-git
pkgname=("$pkgbase" "$pkgbase-eventclients" "$pkgbase-tools-texturepacker" "$pkgbase-dev")
-pkgver=r65983.8d8341a79c7
+pkgver=r65987.f8815ee40f4
pkgrel=1
arch=('x86_64')
url="https://kodi.tv"
@@ -39,7 +39,7 @@
'pipewire' 'python-pycryptodomex' 'python-pillow' 'python-pybluez'
'python-simplejson' 'smbclient' 'sndio' 'spdlog' 'taglib'
'tinyxml' 'swig' 'upower' 'giflib' 'rapidjson' 'ghostscript' 'meson' 'gtest'
- 'graphviz' 'pcre' 'tinyxml2' 'libdisplay-info'
+ 'graphviz' 'pcre2' 'tinyxml2' 'libdisplay-info'
# cmake/scripts/linux/Install.cmake calls distutils
# python 3.12 does no longer come with distutils on board
'python-setuptools'
@@ -55,15 +55,6 @@
_gitname=xbmc
_codename=Omega
-# Found on their respective github release pages. One can check them against
-# what is pulled down when not specifying them in the cmake step.
-# $CHROOT/build/kodi-git/src/kodi-build/build/download
-#
-# https://github.com/xbmc/FFmpeg/tags
-# https://github.com/xbmc/libdvdcss/tags
-# https://github.com/xbmc/libdvdnav/tags
-# https://github.com/xbmc/libdvdread/tags
-#
_libdvdcss_version="1.4.3-Next-Nexus-Alpha2-2"
_libdvdnav_version="6.1.1-Next-Nexus-Alpha2-2"
_libdvdread_version="6.1.3-Next-Nexus-Alpha2-2"
@@ -82,8 +73,9 @@
"https://mirrors.kodi.tv/build-deps/sources/fstrcmp-$_fstrcmp_version.tar.gz"
"https://mirrors.kodi.tv/build-deps/sources/flatbuffers-$_flatbuffers_version.tar.gz"
"https://mirrors.kodi.tv/build-deps/sources/libudfread-$_libudfread_version.tar.gz"
- 0001-Merge-pull-request-28016-from-heitbaum-giflib.patch
- 0002-backport-NFS-replace-nfs_create-with-nfs_open2.patch
+ "https://github.com/xbmc/xbmc/pull/28016.patch"
+ "kodi-21.3-pcre2.patch"
+ "kodi-21.3-gbm-atomic-modeset.patch"
)
noextract=(
"libdvdcss-$_libdvdcss_version.tar.gz"
@@ -104,8 +96,9 @@
'a8b68fcb8613f0d30e5ff7b862b37408472162585ca71cdff328e3299ff50476fd265467bbd77b352b22bb88c590969044f74d91c5468475504568fd269fa69e'
'be5e3c8ea81ce4b6f2e2c1b2f22e1172434c435f096fa7dade060578c506cff0310e3e2ef0627e26ce2be44f740652eb9a8e1b63578c18f430f7925820f04e66'
'1801d84a0ca38410a78f23e7d44f37e6d53346753c853df2e7380d259ce1ae7f0c712825b95a5753ad0bc6360cfffe1888b9e7bc30da8b84549e0f1198248f61'
- 'c0c955f886e0ef7f4c98f6119a264318ce9220ada5e0279600b6e9058a7141e5a98176dd3f982058039e2c1e502f2589cb9bfe5b340a99d31d2b1dc481a2ca6f'
- '0ef981f4d062be66c021efd7c264abb48c8efe31a09d64cee052e7ad55af6772e4db8915d12d642f0bca5296f29bdebd2e0f4907ec1ca77726717d3862091454')
+ '6ff64fa3028dca88b1ae6e898218149811a995e13053dd6e25abcf3cacbfeac8e31a02d04592f3b5fee432d007cebda8fee5c87f673f7cdc3410855b43f5a2ee'
+ 'd5b5b6b9e9863f277ebe6c427f240b1ed8d1c7ba83b52cbda38fa1d0b0e5e14f39fb3cd9a5fdf125614a54156a0c454dae0c4c240dfb58362dacf3d1bc94ad7a'
+ 'dd2f3d494bd3d283df676c08be2fdab2cda49da4037c6b2e711d1b1a11ccfa9d96785f935f400ce7efef45afef4ca16e9f0b088ee336637450d4b656d82cd810')
pkgver() {
cd "$_gitname"
@@ -118,8 +111,14 @@
cd "$_gitname"
- patch -p1 -i ../0001-Merge-pull-request-28016-from-heitbaum-giflib.patch
- patch -p1 -i ../0002-backport-NFS-replace-nfs_create-with-nfs_open2.patch
+ # TexturePacker will not build with giflib-6.1.2
+ # https://github.com/xbmc/xbmc/pull/28016
+ patch -p1 -i "$srcdir/28016.patch"
+ # PCRE2 support from Debian https://sources.debian.org/patches/kodi/2:21.3+dfsg-1.1/workarounds/0003-pcre2.patch/
+ patch -p1 -i "$srcdir/kodi-21.3-pcre2.patch"
+ # gbm screen refresh rate crash: https://gitlab.archlinux.org/archlinux/packaging/packages/kodi/-/work_items/20
+ # patch extracted from https://github.com/xbmc/xbmc/pull/28246/changes/2530a9be035f4b369dcccaff7ba4bb22ce5b3289
+ patch -p1 -i "$srcdir/kodi-21.3-gbm-atomic-modeset.patch"
rm -rf system/certs # remove not needed cacert

Scan history

Scanned at (UTC)SeverityRules
2026-09-25 00:03:36 Low 2
2026-09-24 21:44:41 Medium 1
2026-06-19 19:07:35 Clean 2
2026-06-18 16:11:54 Medium 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion