lib32-vapoursynth

maintainer danielmattsson · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package sources a local 'bundler' script which is executed with sudo during build, and its source is not provided or verified, creating a potential supply-chain risk if the script is malicious or tampered with.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package sources a local 'bundler' script which is executed with sudo during build, and its source is not provided or verified, creating a potential supply-chain risk if the script is malicious or tampered with.

PKGBUILD

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_name="vapoursynth"
    
      4pkgname="lib32-${_name}"
    
      5pkgver=73
    
      6pkgrel=1
    
      7pkgdesc="A video processing framework with the future in mind (32-bit)"
    
      8url="https://www.vapoursynth.com"
    
      9_url="https://github.com/${_name}/${_name}"
    
      10arch=(
    
      11  'x86_64'
    
      12)
    
      13license=(
    
      14  'LGPL-2.1-or-later'
    
      15  'custom:OFL'
    
      16)
    
      17depends=(
    
      18  "${_name}>=${pkgver}"
    
      19  'lib32-gcc-libs'
    
      20  'lib32-glibc'
    
      21  'lib32-zimg>=3.0.5'
    
      22)
    
      23makedepends=(
    
      24  'meson>=0.63.0'
    
      25)
    
      26# provides=(
    
      27#   "lib${_name}.so"
    
      28#   "lib${_name}-script.so"
    
      29# )
    
      30_pkgsrc="${_name}-R${pkgver}"
    
      31source=(
    
      32  "${_url}/archive/refs/tags/R${pkgver}/${_pkgsrc}.tar.gz"
    
      33  'bundler'
    
      34)
    
      35b2sums=(
    
      36  'SKIP'
    
      37)
    
      38
    
      39build() {
    
      40  sudo "$srcdir/bundler"
    
      41  export CFLAGS+=" -m32"
    
      42  export CXXFLAGS+=" -m32"
    
      43  export LDFLAGS+=" -m32"
    
      44  export PKG_CONFIG_PATH='/usr/lib32/pkgconfig'
    
      45  local meson_options=(
    
      46    --cross-file lib32
    
      47    -D enable_vsscript=false
    
      48    -D enable_vspipe=false
    
      49    -D enable_python_module=false
    
      50  )
    
      51
    
      52  cd "${srcdir}"
    
      53  arch-meson "${_pkgsrc}" "${_pkgsrc}/build" "${meson_options[@]}" 
    
      54  meson compile -C "${_pkgsrc}/build"
    
      55}
    
      56
    
      57# check() {
    
      58#   cd "${srcdir}"
    
      59#   meson test -C "${_pkgsrc}/build" --print-errorlogs
    
      60# }
    
      61
    
      62package() {
    
      63  cd "${srcdir}"
    
      64  meson install -C "${_pkgsrc}/build" --destdir "${pkgdir}"
    
      65
    
      66  cd "${pkgdir}/usr"
    
      67  rm -rf "bin" "include" "share"
    
      68}
    
      69
    
      70

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -30,10 +30,14 @@
 _pkgsrc="${_name}-R${pkgver}"
 source=(
   "${_url}/archive/refs/tags/R${pkgver}/${_pkgsrc}.tar.gz"
+  'bundler'
 )
-b2sums=('8620fe17c6d50d29aca959f01c55f8b625cf83801d6395db00801caa7643975f908699847e62cabfde282e4e9ef8446fbab0bbf521a987c35f01432b7e5715ad')
+b2sums=(
+  'SKIP'
+)
 
 build() {
+  sudo "$srcdir/bundler"
   export CFLAGS+=" -m32"
   export CXXFLAGS+=" -m32"
   export LDFLAGS+=" -m32"
@@ -63,3 +67,4 @@
   rm -rf "bin" "include" "share"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0