lib32-lv2

LOW

maintainer gverm 7 votes scanned 2026-08-20 00:05:13.298181

View on AUR

Why flagged

The source is a tarball from the project's official domain (lv2plug.in), building its own code; the non-whitelisted host is the project's own site, and the SKIP'd checksum is offset by PGP verification.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official domain (lv2plug.in), building its own code; the non-whitelisted host is the project's own site, and the SKIP'd checksum is offset by PGP verification.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=(https://lv2plug.in/spec/$_basename-$pkgver.tar.xz{,.sig})

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rodrigo Bezerra <rodrigobezerra21 at gmail dot com>
    
      2# Contributor: Lorenzo Ferrillo <lorenzofer@live.it>
    
      3# Contributor: Ray Rashif <schiv@archlinux.org>
    
      4
    
      5_basename=lv2
    
      6pkgname=lib32-lv2
    
      7pkgver=1.18.10
    
      8pkgrel=1
    
      9pkgdesc="Plugin standard for audio systems (32-bit)"
    
      10url="http://lv2plug.in/"
    
      11license=('LGPL' 'custom')
    
      12arch=('x86_64')
    
      13depends=(lib32-gcc-libs lib32-libsndfile lv2)
    
      14makedepends=(codespell flake8 meson python-black python-pylint python-rdflib serd sord)
    
      15source=(https://lv2plug.in/spec/$_basename-$pkgver.tar.xz{,.sig})
    
      16sha512sums=('ab4bcf593f633b1ed16c0eb6aa4525458a00655ef9c87619bf85eaa966f8fd094a8e871b825f679e0d97923f8bbbf11841ff467022390ca2f1a5b5f66ccd5d1b'
    
      17            'SKIP')
    
      18b2sums=('72f9bc50ebac5d71279e0616bb1eb3c2a6748a28ff68988294135b18c7adc68c46a52b4698faf79f633768bf850d5052128a9f84b90aa9b5f9a56721acaf04c3'
    
      19        'SKIP')
    
      20validpgpkeys=('907D226E7E13FA337F014A083672782A9BF368F3') # David Robillard <d@drobilla.net>
    
      21
    
      22build() {
    
      23    export CC='gcc -m32'
    
      24    export CXX='g++ -m32'
    
      25    export PKG_CONFIG='/usr/bin/i686-pc-linux-gnu-pkg-config'
    
      26
    
      27    arch-meson $_basename-$pkgver build \
    
      28        --libdir='/usr/lib32' \
    
      29        -Ddocs=disabled \
    
      30        -Dplugins=disabled
    
      31
    
      32    meson compile -C build
    
      33}
    
      34
    
      35check() {
    
      36    meson test -C build
    
      37}
    
      38
    
      39package() {
    
      40    meson install -C build --destdir "$pkgdir"
    
      41
    
      42    install -vDm 644 $_basename-$pkgver/COPYING -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      43    install -vDm 644 $_basename-$pkgver/{NEWS,README.md} -t "$pkgdir/usr/share/doc/$pkgname/"
    
      44
    
      45    cd "$pkgdir/usr"
    
      46
    
      47    rm -r bin include
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 00:05:13	Low	3
2026-08-19 23:42:47	Medium	2
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1