lib32-lv2
LOW
maintainer gverm
8 votes
scanned 2026-10-04 00:18:08.092502
Why flagged
The source is a tarball from the project's official domain (lv2plug.in), building its own code, which is normal for AUR packages; the non-whitelisted host is the project's own site, and the package installs only legitimate build artifacts.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is a tarball from the project's official domain (lv2plug.in), building its own code, which is normal for AUR packages; the non-whitelisted host is the project's own site, and the package installs only legitimate build artifacts.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:28
source=(https://lv2plug.in/spec/$_pkgbase-$pkgver.tar.xz{,.sig})
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Gijs Vermeulen <gijsvrm at gmail dot com>
2
# Contributor: Rodrigo Bezerra <rodrigobezerra21 at gmail dot com>
3
# Contributor: Lorenzo Ferrillo <lorenzofer@live.it>
4
# Contributor: Ray Rashif <schiv@archlinux.org>
5
6
_pkgbase=lv2
7
pkgname=lib32-lv2
8
pkgver=1.18.10
9
pkgrel=3
10
pkgdesc="Plugin standard for audio systems (32-bit)"
11
arch=(x86_64)
12
url="https://lv2plug.in/"
13
license=(ISC)
14
depends=(
15
lv2 # for the headers, which are not duplicated in this package
16
)
17
makedepends=(
18
codespell
19
flake8
20
lib32-gcc-libs
21
meson
22
python-black
23
python-pylint
24
python-rdflib
25
serd
26
sord
27
)
28
source=(https://lv2plug.in/spec/$_pkgbase-$pkgver.tar.xz{,.sig})
29
sha512sums=('ab4bcf593f633b1ed16c0eb6aa4525458a00655ef9c87619bf85eaa966f8fd094a8e871b825f679e0d97923f8bbbf11841ff467022390ca2f1a5b5f66ccd5d1b'
30
'SKIP')
31
b2sums=('72f9bc50ebac5d71279e0616bb1eb3c2a6748a28ff68988294135b18c7adc68c46a52b4698faf79f633768bf850d5052128a9f84b90aa9b5f9a56721acaf04c3'
32
'SKIP')
33
validpgpkeys=('907D226E7E13FA337F014A083672782A9BF368F3') # David Robillard <d@drobilla.net>
34
35
build() {
36
export CC='gcc -m32'
37
export CXX='g++ -m32'
38
export PKG_CONFIG='/usr/bin/i686-pc-linux-gnu-pkg-config'
39
40
arch-meson $_pkgbase-$pkgver build \
41
--libdir='/usr/lib32' \
42
-Ddocs=disabled \
43
-Dplugins=disabled
44
45
meson compile -C build
46
}
47
48
check() {
49
meson test -C build || : # syntax and codespell tests fail
50
}
51
52
package() {
53
meson install -C build --destdir "$pkgdir"
54
55
install -vDm 644 $_pkgbase-$pkgver/COPYING -t "$pkgdir/usr/share/licenses/$pkgname/"
56
install -vDm 644 $_pkgbase-$pkgver/{NEWS,README.md} -t "$pkgdir/usr/share/doc/$pkgname/"
57
58
cd "$pkgdir/usr"
59
60
rm -r bin include
61
}
62
63
# vim:set ts=2 sw=2 et:
64
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 3 |
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |