libshout-idjc-git (MEDIUM)

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=('libshout-idjc::git+https://git.code.sf.net/p/idjc/libshoutidjc/code'
PKGBUILD:17 'icecast-m4::git+https://gitlab.xiph.org/xiph/icecast-m4.git'

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: robertfoster
    
      2
    
      3pkgname=libshout-idjc-git
    
      4epoch=1
    
      5pkgver=r771.74990fe
    
      6pkgrel=1
    
      7pkgdesc="Library for accessing a shoutcast/icecast server (with IDJC customizations)"
    
      8arch=('x86_64')
    
      9url="https://idjc.sourceforge.io/"
    
      10license=('LGPL-2.0-or-later')
    
      11depends=('libvorbis' 'libtheora' 'speex' 'openssl')
    
      12makedepends=('git' 'autoconf' 'automake' 'libtool' 'pkgconf')
    
      13provides=("libshout-idjc=${pkgver}")
    
      14conflicts=('libshout-idjc')
    
      15options=('!emptydirs')
    
      16source=('libshout-idjc::git+https://git.code.sf.net/p/idjc/libshoutidjc/code'
    
      17        'icecast-m4::git+https://gitlab.xiph.org/xiph/icecast-m4.git'
    
      18        'icecast-common::git+https://gitlab.xiph.org/xiph/icecast-common.git')
    
      19sha256sums=('SKIP'
    
      20            'SKIP'
    
      21            'SKIP')
    
      22
    
      23pkgver() {
    
      24  cd libshout-idjc
    
      25  echo "r$(git rev-list --count HEAD).$(git rev-parse --short HEAD)"
    
      26}
    
      27
    
      28prepare() {
    
      29  cd libshout-idjc
    
      30  # Submodules are declared with relative URLs that do not resolve on
    
      31  # SourceForge; point them at the upstream Xiph repositories instead.
    
      32  git submodule init
    
      33  git config submodule.m4.url "${srcdir}/icecast-m4"
    
      34  git config submodule.src/common.url "${srcdir}/icecast-common"
    
      35  git -c protocol.file.allow=always submodule update
    
      36  ./autogen.sh
    
      37}
    
      38
    
      39build() {
    
      40  cd libshout-idjc
    
      41  ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --disable-static
    
      42  make
    
      43}
    
      44
    
      45package() {
    
      46  cd libshout-idjc
    
      47  make DESTDIR="${pkgdir}" install
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-06-19 23:51
+++ PKGBUILD @ 2026-08-25 13:26
@@ -1,42 +1,49 @@
 # Maintainer: robertfoster
 
 pkgname=libshout-idjc-git
-pkgver=898.4b1539c
+epoch=1
+pkgver=r771.74990fe
 pkgrel=1
-pkgdesc="Libshout library plus some extensions for IDJC."
-arch=(i686 x86_64)
-url="http://idjc.sourceforge.net/"
-depends=('libvorbis' 'libtheora' 'speex' 'openssl' 'twolame')
-makedepends=('git')
-replaces=('libshout')
+pkgdesc="Library for accessing a shoutcast/icecast server (with IDJC customizations)"
+arch=('x86_64')
+url="https://idjc.sourceforge.io/"
+license=('LGPL-2.0-or-later')
+depends=('libvorbis' 'libtheora' 'speex' 'openssl')
+makedepends=('git' 'autoconf' 'automake' 'libtool' 'pkgconf')
+provides=("libshout-idjc=${pkgver}")
 conflicts=('libshout-idjc')
 options=('!emptydirs')
-source=('libshout-idjc::git+https://git.code.sf.net/p/idjc/code')
-license=('LGPL')
+source=('libshout-idjc::git+https://git.code.sf.net/p/idjc/libshoutidjc/code'
+        'icecast-m4::git+https://gitlab.xiph.org/xiph/icecast-m4.git'
+        'icecast-common::git+https://gitlab.xiph.org/xiph/icecast-common.git')
+sha256sums=('SKIP'
+            'SKIP'
+            'SKIP')
+
+pkgver() {
+  cd libshout-idjc
+  echo "r$(git rev-list --count HEAD).$(git rev-parse --short HEAD)"
+}
 
 prepare() {
-  cd $srcdir/libshout-idjc/libshout-idjc
-  sed -e 's/SSLeay_add_all_algorithms/OpenSSL_add_all_algorithms/g' -i src/tls.c
+  cd libshout-idjc
+  # Submodules are declared with relative URLs that do not resolve on
+  # SourceForge; point them at the upstream Xiph repositories instead.
+  git submodule init
+  git config submodule.m4.url "${srcdir}/icecast-m4"
+  git config submodule.src/common.url "${srcdir}/icecast-common"
+  git -c protocol.file.allow=always submodule update
+  ./autogen.sh
 }
 
-build(){
-  cd $srcdir/libshout-idjc
-  ./bootstrap
+build() {
   cd libshout-idjc
-  ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
+  ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --disable-static
   make
 }
 
 package() {
-  cd $srcdir/libshout-idjc/libshout-idjc
+  cd libshout-idjc
   make DESTDIR="${pkgdir}" install
-  make DESTDIR="${pkgdir}" uninstall-m4dataDATA
 }
 
-pkgver() {
-  cd libshout-idjc
-  echo $(git rev-list --count master).$(git rev-parse --short master)
-}
-
-md5sums=('SKIP')
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-25 13:26:42	Medium	1
2026-06-19 23:51:18	Clean	2
2026-06-18 16:11:54	Medium	1