lib32-libcanberra

maintainer orphaned · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package clones libcanberra from git.0pointer.net, which is the project's own official hosting (Lennart Poettering's server, the original author of libcanberra); this is a legitimate upstream source, not a suspicious third-party host. The SKIP checksum on the git source is normal for VCS sources. The bundled patch has a proper checksum. No obfuscation, no remote code execution, no exfiltration — this is a standard 32-bit library build.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The package clones libcanberra from git.0pointer.net, which is the project's own official hosting (Lennart Poettering's server, the original author of libcanberra); this is a legitimate upstream source, not a suspicious third-party host. The SKIP checksum on the git source is normal for VCS sources. The bundled patch has a proper checksum. No obfuscation, no remote code execution, no exfiltration — this is a standard 32-bit library build.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("git+https://git.0pointer.net/clone/libcanberra.git#commit=$_commit"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
    
      2# Contributor: Florian Pritz <flo@xssn.at>
    
      3# Contributor: Jan de Groot <jgc@archlinux.org>
    
      4
    
      5pkgname=lib32-libcanberra
    
      6pkgver=0.30+r2+gc0620e4
    
      7pkgrel=4
    
      8epoch=1
    
      9pkgdesc="A small and lightweight implementation of the XDG Sound Theme Specification (32-bit)"
    
      10url="https://0pointer.net/lennart/projects/libcanberra/"
    
      11arch=(x86_64)
    
      12license=(LGPL-2.1-or-later)
    
      13depends=(lib32-libvorbis lib32-libltdl lib32-alsa-lib lib32-libpulse lib32-tdb
    
      14         libcanberra)
    
      15makedepends=(gtk-doc lib32-gtk3 git)
    
      16provides=(lib32-libcanberra-pulse libcanberra{,-gtk3}.so)
    
      17replaces=("lib32-libcanberra-pulse<0.30+2+gc0620e4-4")
    
      18options=(libtool)
    
      19_commit=c0620e432650e81062c1967cc669829dbd29b310  # master
    
      20source=("git+https://git.0pointer.net/clone/libcanberra.git#commit=$_commit"
    
      21        libcanberra-multi-backend.patch)
    
      22sha256sums=('SKIP'
    
      23            'de146cae3e40a16b38c8edb4f1a3a423c64eb9c5000e36c316b677e9909c9b06')
    
      24
    
      25pkgver() {
    
      26  cd libcanberra
    
      27  git describe --tags | sed 's/^v//;s/[^-]*-g/r&/;s/-/+/g'
    
      28}
    
      29
    
      30prepare() {
    
      31  cd libcanberra
    
      32
    
      33  # https://bugs.archlinux.org/task/71341
    
      34  # https://bugs.freedesktop.org/show_bug.cgi?id=51662
    
      35  git apply -3 ../libcanberra-multi-backend.patch
    
      36
    
      37  ./autogen.sh
    
      38}
    
      39
    
      40build() {
    
      41  cd libcanberra
    
      42
    
      43  export CC="gcc -m32"
    
      44  export CXX="g++ -m32"
    
      45  export PKG_CONFIG=i686-pc-linux-gnu-pkg-config
    
      46
    
      47  ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var \
    
      48      --libdir=/usr/lib32 \
    
      49      --disable-static --with-builtin=dso --enable-null --disable-oss \
    
      50      --enable-alsa --enable-pulse \
    
      51      --with-systemdsystemunitdir=/usr/lib/systemd/system --enable-gtk-doc
    
      52  sed -i -e 's/ -shared / -Wl,-O1,--as-needed\0/g' libtool
    
      53  make
    
      54}
    
      55
    
      56package() {
    
      57  cd libcanberra
    
      58
    
      59  make -j1 DESTDIR="$pkgdir" install
    
      60
    
      61  rm "$pkgdir"/usr/lib32/*.la
    
      62  rm "$pkgdir"/usr/lib32/gtk-3.0/modules/*.la
    
      63
    
      64  rm -r "$pkgdir"/usr/{include,share,bin,lib,lib32/gnome-settings-daemon-3.0}
    
      65}
    
      66
    
      67# vim:set sw=2 sts=-1 et:
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 19:35:37	LOW	3
2026-08-16 19:33:38	MEDIUM	2