libvorbis-aotuv-lancer

maintainer neitsab · 11 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code and patches from a non-whitelisted but legitimate project-related domain (freac.org) for building; the patches are applied during prepare() and do not introduce remote code execution or obfuscated payloads, and the base source is from the official Xiph.org release site.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and patches from a non-whitelisted but legitimate project-related domain (freac.org) for building; the patches are applied during prepare() and do not introduce remote code execution or obfuscated payloads, and the base source is from the official Xiph.org release site.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source=("https://downloads.xiph.org/releases/vorbis/${_srcname}-${pkgver}.tar.gz"{,.asc}
PKGBUILD:27 "${_srcname}-${pkgver}-${_aotuv_ver}-${_patch_ver}.patch::https://freac.org/patches/${_srcname}-${pkgver}-${_aotuv_ver}.patch"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Bastien Traverse <neitsab at esrevart dot net>
    
      2# Contributor: Soukyuu <chrno-spheredΘhotmail·com>
    
      3# Contributor: revel <revelΘmuub·net>
    
      4# Contributor: Stephen Caraher <moskvax@gmail.com>
    
      5# Contributor: Uli Armbruster <uli_armbrusterΘweb·de>
    
      6# Contributor: Robert Gregor <gimpΘpop·de>
    
      7
    
      8pkgname=libvorbis-aotuv-lancer
    
      9_srcname="${pkgname%-aotuv-lancer}"
    
      10pkgver=1.3.7
    
      11pkgrel=3
    
      12_aotuv_ver=aotuv-b6.03
    
      13_patch_ver=2021-05-10
    
      14pkgdesc='The Vorbis library with aoTuV and Lancer patches'
    
      15arch=('i686' 'x86_64')
    
      16url='https://hydrogenaud.io/index.php?topic=115774.0'
    
      17license=('BSD')
    
      18depends=('libogg')
    
      19conflicts=('libvorbis' 'libvorbis-aotuv')
    
      20provides=(
    
      21  'libvorbis'
    
      22  'libvorbis.so'
    
      23  'libvorbisenc.so'
    
      24  'libvorbisfile.so'
    
      25)
    
      26source=("https://downloads.xiph.org/releases/vorbis/${_srcname}-${pkgver}.tar.gz"{,.asc}
    
      27        "${_srcname}-${pkgver}-${_aotuv_ver}-${_patch_ver}.patch::https://freac.org/patches/${_srcname}-${pkgver}-${_aotuv_ver}.patch"
    
      28        "${_srcname}-${pkgver}-${_aotuv_ver}-lancer-${_patch_ver}.patch::https://freac.org/patches/${_srcname}-${pkgver}-${_aotuv_ver}-lancer.patch")
    
      29validpgpkeys=(B7B00AEE1F960EEA0FED66FB9259A8F2D2D44C84) # Ralph Giles <giles@thaumas.net>
    
      30sha1sums=('2b415495f89b103138a23da5017a2a00837c6c94'
    
      31          'dc604e62a7e7ad60eb6fae0960cdf390a382258b'
    
      32          '98ab0c044b8e6aaf79d31861c6351b1f611f9fda'
    
      33          '0051b8c61bf74e68d4193cf9e2afbf02a01362e8')
    
      34
    
      35prepare() {
    
      36	cd "${_srcname}-${pkgver}"
    
      37
    
      38	# apply aotuv patch set
    
      39	patch -p1 -i "${srcdir}/${_srcname}-${pkgver}-${_aotuv_ver}-${_patch_ver}.patch"
    
      40	
    
      41	# apply lancer patch set
    
      42	patch -p1 -i "${srcdir}/${_srcname}-${pkgver}-${_aotuv_ver}-lancer-${_patch_ver}.patch"
    
      43}
    
      44
    
      45build() {
    
      46	cd "${_srcname}-${pkgver}"
    
      47	./configure \
    
      48      --prefix=/usr \
    
      49      --disable-static \
    
      50      --enable-shared
    
      51	make
    
      52}
    
      53
    
      54check() {
    
      55	cd "${_srcname}-${pkgver}"
    
      56	make -k check
    
      57}
    
      58
    
      59package() {
    
      60	cd "${_srcname}-${pkgver}"
    
      61	make DESTDIR="$pkgdir" install
    
      62	install -Dm644 COPYING -t "$pkgdir/usr/share/licenses/${pkgname}"
    
      63	install -Dm644 AUTHORS CHANGES aoTuV_technical.txt -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2