lib32-aom
LOW
maintainer vitaliikuzhdin
13 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The source is a tarball from Google Cloud Storage, which hosts official AOMedia releases; building from this source is standard practice and the package does not execute untrusted remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from Google Cloud Storage, which hosts official AOMedia releases; building from this source is standard practice and the package does not execute untrusted remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:30
"https://storage.googleapis.com/aom-releases/${_pkgsrc}.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
2
# Contributor: Rodrigo Bezerra <rodrigobezerra21 at gmail dot com>
3
4
_name="aom"
5
pkgname="lib32-${_name}"
6
pkgver=3.15.1
7
pkgrel=1
8
pkgdesc="Alliance for Open Media video codec (32-bit)"
9
arch=(
10
'x86_64'
11
)
12
url="https://aomedia.org"
13
license=(
14
'BSD-3-Clause'
15
)
16
depends=(
17
"${_name}>=${pkgver}"
18
'lib32-gcc-libs'
19
'lib32-glibc'
20
)
21
makedepends=(
22
'cmake>=3.16'
23
'yasm'
24
)
25
provides=(
26
"lib${_name}.so"
27
)
28
_pkgsrc="lib${_name}-${pkgver}"
29
source=(
30
"https://storage.googleapis.com/aom-releases/${_pkgsrc}.tar.gz"
31
"https://storage.googleapis.com/aom-releases/${_pkgsrc}.tar.gz.asc"
32
)
33
b2sums=('34022872af58c52183f7f371e7518faa47cd87b58387b7ee07ef24acf9af60207cb0f0091a25105a9699a83d4039d3cb4b60221ec48a8b72ab1f95d5af5a4575'
34
'SKIP')
35
validpgpkeys=(
36
'B002F08B74A148DAA01F7123A48E86DB0B830498' # AOMedia release signing key <av1-discuss@aomedia.org>
37
)
38
39
prepare() {
40
cd "${srcdir}/${_pkgsrc}"
41
# Don't require static library
42
sed -i 's/aom aom_static/aom/' cmake/aom_install.cmake
43
}
44
45
build() {
46
export CFLAGS="${CFLAGS/_FORTIFY_SOURCE=?/_FORTIFY_SOURCE=0} -m32"
47
export CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=?/_FORTIFY_SOURCE=0} -m32"
48
export LDFLAGS+=" -m32"
49
export PKG_CONFIG_PATH='/usr/lib32/pkgconfig'
50
local cmake_options=(
51
-B "${_pkgsrc}/build"
52
-S "${_pkgsrc}"
53
-G 'Unix Makefiles'
54
-W no-author
55
# Upstream would like Release, adding -O3 and removing assertions
56
# https://gitlab.archlinux.org/archlinux/packaging/packages/aom/-/issues/1
57
-D CMAKE_BUILD_TYPE:STRING='Release'
58
-D CMAKE_INSTALL_PREFIX:PATH='/usr'
59
-D CMAKE_INSTALL_LIBDIR:PATH='lib32'
60
-D BUILD_SHARED_LIBS:BOOL=ON
61
-D ENABLE_EXAMPLES:BOOL=OFF
62
-D ENABLE_TOOLS:BOOL=OFF
63
-D ENABLE_TESTS:BOOL=OFF
64
-D ENABLE_DOCS:BOOL=OFF
65
)
66
67
cd "${srcdir}"
68
cmake "${cmake_options[@]}"
69
cmake --build "${cmake_options[1]}"
70
}
71
72
package() {
73
cd "${srcdir}"
74
DESTDIR="${pkgdir}" cmake --install "${_pkgsrc}/build"
75
76
cd "${pkgdir}/usr"
77
rm -rf "bin" "include" "share"
78
}
79
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 09:12:50 | Medium | 1 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |