libjxl-metrics-git

LOW

maintainer damian101 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package builds from source using git repositories hosted on legitimate project forges (GitHub, skia.googlesource.com), which are plausibly the official project sources; the non-standard host (skia.googlesource.com) is Google's official Skia infrastructure, and the sources are used as dependencies, not executed remotely; SKIP'd checksums reduce verifiability but do not imply malicious content in this context.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using git repositories hosted on legitimate project forges (GitHub, skia.googlesource.com), which are plausibly the official project sources; the non-standard host (skia.googlesource.com) is Google's official Skia infrastructure, and the sources are used as dependencies, not executed remotely; SKIP'd checksums reduce verifiability but do not imply malicious content in this context.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:53 git+https://skia.googlesource.com/skcms.git

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Damian Höster <damian.hoester@posteo.de>
    
      2# Contributor: Joshua Holmer <jholmer.in@gmail.com>
    
      3
    
      4_pkgname=libjxl
    
      5pkgname=$_pkgname-metrics-git
    
      6pkgver=0.12.snapshot.r2.196a43d9
    
      7pkgrel=1
    
      8pkgdesc='JPEG XL image format reference implementation with butteraugli, ssimulacra, and ssimulacra2 metrics (git version)'
    
      9arch=(x86_64)
    
      10url=https://jpeg.org/jpegxl/
    
      11license=(BSD-3-Clause)
    
      12depends=(
    
      13  brotli
    
      14  highway
    
      15  libpng
    
      16  libjpeg.so
    
      17  giflib
    
      18  openexr
    
      19  gperftools
    
      20)
    
      21makedepends=(
    
      22  git
    
      23  cmake
    
      24  clang
    
      25  lld
    
      26  python
    
      27  asciidoc
    
      28  # plugins disabled for now because https://github.com/libjxl/libjxl/issues/4037
    
      29  #gdk-pixbuf2 # for building gdk-pixbuf loader
    
      30  #gimp # for building GIMP plugin
    
      31  #java-environment # for building JNI bindings
    
      32)
    
      33provides=(
    
      34  $_pkgname
    
      35  libjxl.so
    
      36  libjxl_cms.so
    
      37  libjxl_threads.so
    
      38  butteraugli
    
      39  ssimulacra
    
      40  ssimulacra2
    
      41)
    
      42conflicts=(
    
      43  $_pkgname
    
      44  butteraugli
    
      45  ssimulacra
    
      46  ssimulacra2
    
      47)
    
      48optdepends=(
    
      49  'libjxl-doc: for documentation'
    
      50)
    
      51source=(
    
      52  git+https://github.com/libjxl/$_pkgname.git
    
      53  git+https://skia.googlesource.com/skcms.git
    
      54  git+https://github.com/webmproject/sjpeg.git
    
      55)
    
      56sha256sums=(
    
      57  SKIP
    
      58  SKIP
    
      59  SKIP
    
      60)
    
      61
    
      62prepare() {
    
      63  git -C $_pkgname submodule init third_party/{skcms,sjpeg}
    
      64  git -C $_pkgname config submodule.third_party/skcms.url "$srcdir"/skcms
    
      65  git -C $_pkgname config submodule.third_party/sjpeg.url "$srcdir"/sjpeg
    
      66  git -C $_pkgname -c protocol.file.allow=always submodule update
    
      67}
    
      68
    
      69pkgver() {
    
      70  git -C $_pkgname describe --long --tags |
    
      71    sed -E 's/^v//; s/-([^-]*)-g([^-]*)$/.r\1.\2/; s/-/./g'
    
      72}
    
      73
    
      74build() {
    
      75  export CC=clang CXX=clang++
    
      76  export LDFLAGS+=' -fuse-ld=lld'
    
      77  cmake -S $_pkgname -B build \
    
      78    -DBUILD_TESTING=OFF \
    
      79    -DCMAKE_INSTALL_PREFIX=/usr \
    
      80    -DJPEGXL_ENABLE_DEVTOOLS=ON \
    
      81    -DJPEGXL_ENABLE_DOXYGEN=OFF \
    
      82    -DJPEGXL_ENABLE_EXAMPLES=OFF \
    
      83    -DJPEGXL_ENABLE_PLUGINS=OFF \
    
      84    -DJPEGXL_FORCE_SYSTEM_BROTLI=ON \
    
      85    -DJPEGXL_FORCE_SYSTEM_HWY=ON
    
      86  make -C build
    
      87}
    
      88
    
      89package() {
    
      90  DESTDIR="$pkgdir" make -C build install
    
      91  install -Dm644 $_pkgname/{LICENSE,PATENTS} \
    
      92    -t "$pkgdir"/usr/share/licenses/$pkgname
    
      93  ln -s /usr/bin/butteraugli_main "$pkgdir"/usr/bin/butteraugli
    
      94  ln -s /usr/bin/ssimulacra_main "$pkgdir"/usr/bin/ssimulacra
    
      95}
    
      96

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2