libjxl-metrics-git

maintainer damian101 · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source using git repositories hosted on legitimate project forges (GitHub, skia.googlesource.com), which are plausibly the official project sources; the non-standard host (skia.googlesource.com) is Google's official Skia infrastructure, and the sources are used as dependencies, not executed remotely; SKIP'd checksums reduce verifiability but do not imply malicious content in this context.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using git repositories hosted on legitimate project forges (GitHub, skia.googlesource.com), which are plausibly the official project sources; the non-standard host (skia.googlesource.com) is Google's official Skia infrastructure, and the sources are used as dependencies, not executed remotely; SKIP'd checksums reduce verifiability but do not imply malicious content in this context.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:53 git+https://skia.googlesource.com/skcms.git

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Damian Höster <damian.hoester@posteo.de>
    
      2# Contributor: Joshua Holmer <jholmer.in@gmail.com>
    
      3
    
      4_pkgname=libjxl
    
      5pkgname=$_pkgname-metrics-git
    
      6pkgver=0.12.snapshot.r2.196a43d9
    
      7pkgrel=1
    
      8pkgdesc='JPEG XL image format reference implementation with butteraugli, ssimulacra, and ssimulacra2 metrics (git version)'
    
      9arch=(x86_64)
    
      10url=https://jpeg.org/jpegxl/
    
      11license=(BSD-3-Clause)
    
      12depends=(
    
      13  brotli
    
      14  highway
    
      15  libpng
    
      16  libjpeg.so
    
      17  giflib
    
      18  openexr
    
      19  gperftools
    
      20)
    
      21makedepends=(
    
      22  git
    
      23  cmake
    
      24  clang
    
      25  lld
    
      26  python
    
      27  asciidoc
    
      28  # plugins disabled for now because https://github.com/libjxl/libjxl/issues/4037
    
      29  #gdk-pixbuf2 # for building gdk-pixbuf loader
    
      30  #gimp # for building GIMP plugin
    
      31  #java-environment # for building JNI bindings
    
      32)
    
      33provides=(
    
      34  $_pkgname
    
      35  libjxl.so
    
      36  libjxl_cms.so
    
      37  libjxl_threads.so
    
      38  butteraugli
    
      39  ssimulacra
    
      40  ssimulacra2
    
      41)
    
      42conflicts=(
    
      43  $_pkgname
    
      44  butteraugli
    
      45  ssimulacra
    
      46  ssimulacra2
    
      47)
    
      48optdepends=(
    
      49  'libjxl-doc: for documentation'
    
      50)
    
      51source=(
    
      52  git+https://github.com/libjxl/$_pkgname.git
    
      53  git+https://skia.googlesource.com/skcms.git
    
      54  git+https://github.com/webmproject/sjpeg.git
    
      55)
    
      56sha256sums=(
    
      57  SKIP
    
      58  SKIP
    
      59  SKIP
    
      60)
    
      61
    
      62prepare() {
    
      63  git -C $_pkgname submodule init third_party/{skcms,sjpeg}
    
      64  git -C $_pkgname config submodule.third_party/skcms.url "$srcdir"/skcms
    
      65  git -C $_pkgname config submodule.third_party/sjpeg.url "$srcdir"/sjpeg
    
      66  git -C $_pkgname -c protocol.file.allow=always submodule update
    
      67}
    
      68
    
      69pkgver() {
    
      70  git -C $_pkgname describe --long --tags |
    
      71    sed -E 's/^v//; s/-([^-]*)-g([^-]*)$/.r\1.\2/; s/-/./g'
    
      72}
    
      73
    
      74build() {
    
      75  export CC=clang CXX=clang++
    
      76  export LDFLAGS+=' -fuse-ld=lld'
    
      77  cmake -S $_pkgname -B build \
    
      78    -DBUILD_TESTING=OFF \
    
      79    -DCMAKE_INSTALL_PREFIX=/usr \
    
      80    -DJPEGXL_ENABLE_DEVTOOLS=ON \
    
      81    -DJPEGXL_ENABLE_DOXYGEN=OFF \
    
      82    -DJPEGXL_ENABLE_EXAMPLES=OFF \
    
      83    -DJPEGXL_ENABLE_PLUGINS=OFF \
    
      84    -DJPEGXL_FORCE_SYSTEM_BROTLI=ON \
    
      85    -DJPEGXL_FORCE_SYSTEM_HWY=ON
    
      86  make -C build
    
      87}
    
      88
    
      89package() {
    
      90  DESTDIR="$pkgdir" make -C build install
    
      91  install -Dm644 $_pkgname/{LICENSE,PATENTS} \
    
      92    -t "$pkgdir"/usr/share/licenses/$pkgname
    
      93  ln -s /usr/bin/butteraugli_main "$pkgdir"/usr/bin/butteraugli
    
      94  ln -s /usr/bin/ssimulacra_main "$pkgdir"/usr/bin/ssimulacra
    
      95}
    
      96

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,9 +1,9 @@
 # Maintainer: Damian Höster <damian.hoester@posteo.de>
-# Contributor:  Joshua Holmer <jholmer.in@gmail.com>
+# Contributor: Joshua Holmer <jholmer.in@gmail.com>
 
 _pkgname=libjxl
 pkgname=$_pkgname-metrics-git
-pkgver=0.12.0.r3.196a43d9
+pkgver=0.12.snapshot.r2.196a43d9
 pkgrel=1
 pkgdesc='JPEG XL image format reference implementation with butteraugli, ssimulacra, and ssimulacra2 metrics (git version)'
 arch=(x86_64)
@@ -67,10 +67,8 @@
 }
 
 pkgver() {
-  local _tag=$(git -C $_pkgname tag --list --sort=-v:refname 'v[[:digit:]]*' |
-    sed 's/^v//;/[[:alpha:]]/d' | head -n1)
-  printf $_tag.r%s.%s $(git -C $_pkgname rev-list --count v$_tag..HEAD) \
-    $(git -C $_pkgname rev-parse --short HEAD)
+  git -C $_pkgname describe --long --tags |
+    sed -E 's/^v//; s/-([^-]*)-g([^-]*)$/.r\1.\2/; s/-/./g'
 }
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 11:14:12	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2