lib32-taglib

LOW

maintainer orphaned 1 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The source is a release tarball from taglib.github.io (the project's own GitHub Pages release host), which is a plausible official distribution point; the non-standard host flag is a false positive, and the package simply builds a 32-bit library with no obfuscation or remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The source is a release tarball from taglib.github.io (the project's own GitHub Pages release host), which is a plausible official distribution point; the non-standard host flag is a false positive, and the package simply builds a 32-bit library with no obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://taglib.github.io/releases/$_pkgname-$pkgver.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Felix Yan <felixonmars@archlinux.org>
    
      2# Contributor: GordonGR <gordongr@freemail.gr>
    
      3# Contributor: Tom Gundersen <teg@jklm.no>
    
      4# Contributor: Ike Devolder <ike.devolder@gmail.com>
    
      5# Contributor: Andrea Scarpino <andrea@archlinux.org>
    
      6# Contributor: Tobias Powalowski <tpowa@archlinux.org>
    
      7
    
      8_pkgname=taglib
    
      9pkgname=lib32-taglib
    
      10pkgver=2.3.1
    
      11pkgrel=1
    
      12pkgdesc="A Library for reading and editing the meta-data of several popular audio formats (32 bit)"
    
      13arch=('x86_64')
    
      14url="https://developer.kde.org/~wheeler/taglib.html"
    
      15license=('LGPL' 'MPL')
    
      16depends=($_pkgname 'lib32-zlib' 'lib32-gcc-libs')
    
      17makedepends=('cmake' 'utf8cpp')
    
      18source=("https://taglib.github.io/releases/$_pkgname-$pkgver.tar.gz")
    
      19md5sums=('b189dcfcf284179c04b97a89887e0ce6')
    
      20sha256sums=('a19d90e6fd41d09a0281ec0fe762d51491d7a6ccffc923c4f7868c5e647ca230')
    
      21
    
      22build() {
    
      23  export CC='gcc -m32'
    
      24  export CXX='g++ -m32'
    
      25  export PKG_CONFIG_PATH='/usr/lib32/pkgconfig'
    
      26
    
      27  cmake -B build -S ${_pkgname}-${pkgver} \
    
      28    -DCMAKE_INSTALL_PREFIX=/usr \
    
      29    -DCMAKE_INSTALL_LIBDIR=lib32 \
    
      30    -DBUILD_SHARED_LIBS=ON
    
      31  cmake --build build
    
      32}
    
      33
    
      34package() {
    
      35  DESTDIR="${pkgdir}" cmake --install build
    
      36
    
      37  cd "$pkgdir/usr"
    
      38  rm -rf {include,share}/
    
      39  mv bin/taglib-config{,-32}
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2