lib32-libvpx

MEDIUM

maintainer groctel 1 votes scanned 2026-08-30 19:44:01.063593

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=(git+https://chromium.googlesource.com/webm/libvpx#tag=${_tag})

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Maxime Gauduin <alucryd@archlinux.org>
    
      2# Contributor: Ionut Biru <ibiru@archlinux.org>
    
      3
    
      4pkgname=lib32-libvpx
    
      5pkgver=1.16.0
    
      6pkgrel=2
    
      7pkgdesc='VP8 and VP9 codec'
    
      8arch=(x86_64)
    
      9url=https://www.webmproject.org/
    
      10license=(custom:BSD)
    
      11depends=(
    
      12  libvpx
    
      13)
    
      14makedepends=(
    
      15  git
    
      16  nasm
    
      17)
    
      18provides=(libvpx.so)
    
      19_tag=04def0a07f8bfa95785e30e6db95036cda17f9b2
    
      20source=(git+https://chromium.googlesource.com/webm/libvpx#tag=${_tag})
    
      21b2sums=('aebe079b448e4c1e0bb084d380266dde054800d0fcff3286e6de09d35365aa99eeeb9068ba22a532184c90abb6e8fa6109719ea48463b5d28d9a57a35f83e0a4')
    
      22
    
      23pkgver() {
    
      24  cd libvpx
    
      25
    
      26  git describe --tags | sed 's/^v//'
    
      27}
    
      28
    
      29prepare() {
    
      30  cd libvpx
    
      31
    
      32  # Backport fix for CVE-2026-1861
    
      33  git cherry-pick -n d5f35ac8d93cba7f7a3f7ddb8f9dc8bd28f785e1
    
      34}
    
      35
    
      36build() {
    
      37  cd libvpx
    
      38
    
      39  export CC='gcc -m32'
    
      40  export CXX='g++ -m32'
    
      41  export PKG_CONFIG=i686-pc-linux-gnu-pkg-config
    
      42
    
      43  ./configure \
    
      44    --prefix=/usr \
    
      45    --libdir=/usr/lib32 \
    
      46    --target=x86-linux-gcc \
    
      47    --disable-install-bins \
    
      48    --disable-install-docs \
    
      49    --disable-install-srcs \
    
      50    --disable-unit-tests \
    
      51    --enable-pic \
    
      52    --enable-postproc \
    
      53    --enable-runtime-cpu-detect \
    
      54    --enable-shared \
    
      55    --enable-vp8 \
    
      56    --enable-vp9 \
    
      57    --enable-vp9-highbitdepth \
    
      58    --enable-vp9-temporal-denoising
    
      59  make
    
      60}
    
      61
    
      62package() {
    
      63  cd libvpx
    
      64
    
      65  make DIST_DIR="${pkgdir}/usr" install
    
      66  rm -rf "${pkgdir}"/usr/include
    
      67
    
      68  install -dm 755 "${pkgdir}"/usr/share/licenses
    
      69  ln -s libvpx "${pkgdir}"/usr/share/licenses/lib32-libvpx
    
      70}
    
      71
    
      72# vim:set sw=2 sts=-1 et:
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-30 19:44:01	Medium	3
2026-08-16 21:36:09	Clean	3
2026-08-16 21:33:47	Medium	2