lib32-taglib

maintainer orphaned · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The source is a release tarball from taglib.github.io (the project's own GitHub Pages release host), which is a plausible official distribution point; the non-standard host flag is a false positive, and the package simply builds a 32-bit library with no obfuscation or remote code execution.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The source is a release tarball from taglib.github.io (the project's own GitHub Pages release host), which is a plausible official distribution point; the non-standard host flag is a false positive, and the package simply builds a 32-bit library with no obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://taglib.github.io/releases/$_pkgname-$pkgver.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Felix Yan <felixonmars@archlinux.org>
    
      2# Contributor: GordonGR <gordongr@freemail.gr>
    
      3# Contributor: Tom Gundersen <teg@jklm.no>
    
      4# Contributor: Ike Devolder <ike.devolder@gmail.com>
    
      5# Contributor: Andrea Scarpino <andrea@archlinux.org>
    
      6# Contributor: Tobias Powalowski <tpowa@archlinux.org>
    
      7
    
      8_pkgname=taglib
    
      9pkgname=lib32-taglib
    
      10pkgver=2.3.1
    
      11pkgrel=1
    
      12pkgdesc="A Library for reading and editing the meta-data of several popular audio formats (32 bit)"
    
      13arch=('x86_64')
    
      14url="https://developer.kde.org/~wheeler/taglib.html"
    
      15license=('LGPL' 'MPL')
    
      16depends=($_pkgname 'lib32-zlib' 'lib32-gcc-libs')
    
      17makedepends=('cmake' 'utf8cpp')
    
      18source=("https://taglib.github.io/releases/$_pkgname-$pkgver.tar.gz")
    
      19md5sums=('b189dcfcf284179c04b97a89887e0ce6')
    
      20sha256sums=('a19d90e6fd41d09a0281ec0fe762d51491d7a6ccffc923c4f7868c5e647ca230')
    
      21
    
      22build() {
    
      23  export CC='gcc -m32'
    
      24  export CXX='g++ -m32'
    
      25  export PKG_CONFIG_PATH='/usr/lib32/pkgconfig'
    
      26
    
      27  cmake -B build -S ${_pkgname}-${pkgver} \
    
      28    -DCMAKE_INSTALL_PREFIX=/usr \
    
      29    -DCMAKE_INSTALL_LIBDIR=lib32 \
    
      30    -DBUILD_SHARED_LIBS=ON
    
      31  cmake --build build
    
      32}
    
      33
    
      34package() {
    
      35  DESTDIR="${pkgdir}" cmake --install build
    
      36
    
      37  cd "$pkgdir/usr"
    
      38  rm -rf {include,share}/
    
      39  mv bin/taglib-config{,-32}
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 21:36:09	LOW	3
2026-08-16 21:33:47	MEDIUM	2