lilypond-devel

LOW

maintainer david_goliath 0 votes scanned 2026-10-24 00:14:55.209548

View on AUR

Why flagged

The source is a development release tarball from the official lilypond.org domain, which is plausibly the project's own infrastructure; building from official project sources, even on a non-whitelisted host, is normal AUR packaging and not inherently dangerous.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a development release tarball from the official lilypond.org domain, which is plausibly the project's own infrastructure; building from official project sources, even on a non-whitelisted host, is normal AUR packaging and not inherently dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 source=("https://lilypond.org/downloads/sources/v${pkgver%.*}/$_pkgname-$pkgver.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: David Seus <cryptointerest at posteo dot de>
    
      2# Contributor: lis
    
      3# Contributor: Robert Kubosz <kubosz.robert@gmail.com>
    
      4# Contributor: David Runge <dvzrv@archlinux.org>
    
      5# Contributor: Evgeniy Alekseev <arcanis at archlinux dot org>
    
      6# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
    
      7# Contributor: Geoffroy Carrier <geoffroy@archlinux.org>
    
      8# Contributor: William Rea <sillywilly@gmail.com>
    
      9# Contributor: Robert Emil Berge <filoktetes@linuxophic.org>
    
      10
    
      11pkgname=lilypond-devel
    
      12_pkgname=lilypond
    
      13pkgver=2.27.4
    
      14pkgrel=1
    
      15pkgdesc="Lilypond music engraving program (development release)"
    
      16arch=('x86_64')
    
      17url="https://lilypond.org"
    
      18license=('FDL1.3' 'GPL3' 'custom:OFL')
    
      19groups=('pro-audio')
    
      20depends=('gcc-libs' 'ghostscript' 'glibc' 'gsfonts' 'guile')
    
      21makedepends=('fontconfig' 'fontforge' 'freetype2' 'glib2' 'imagemagick' 'pango'
    
      22'python' 'rsync' 't1utils' 'texinfo' 'texlive-core' 'tex-gyre-fonts'
    
      23'texlive-langcyrillic' 'texlive-metapost' 'texlive-fontutils'
    
      24'texlive-plaingeneric' 'zip')
    
      25optdepends=(
    
      26  'python: for lilypond-book and other scripts'
    
      27  'tex-gyre-fonts: for extra fonts'
    
      28  'ttf-dejavu: for extra fonts'
    
      29)
    
      30provides=('lilypond=${pkgver}')
    
      31conflicts=('lilypond')
    
      32source=("https://lilypond.org/downloads/sources/v${pkgver%.*}/$_pkgname-$pkgver.tar.gz")
    
      33sha512sums=('aee7b38dcaf5f0d50f5fa39d08eba8d965bef6a7159f3b79ebc754b4da95eacefcb280881a75cd2525ae210d8e47f3391db91c0b2c704b1e15b1c70e7af67c2a')
    
      34b2sums=('fef8f36e5cf24e4b7fbc5a657fe79d613ab7659d8eab9b458c27c306ab00678b1a7f9d77febe491580fd4e725721197e4f8f4d8d8d0a54f2875e13c9aaef8624')
    
      35
    
      36prepare() {
    
      37  cd "$_pkgname-$pkgver"
    
      38  autoconf --force --verbose
    
      39}
    
      40
    
      41build() {
    
      42  cd "$_pkgname-$pkgver"
    
      43  ./configure --prefix=/usr \
    
      44              GUILE_FLAVOR=guile-3.0
    
      45  make -j3
    
      46  make -j3 bytecode
    
      47}
    
      48
    
      49package() {
    
      50  depends+=('libfontconfig.so' 'libfreetype.so' 'libglib-2.0.so'
    
      51  'libgobject-2.0.so' 'libpangoft2-1.0.so' 'libpango-1.0.so')
    
      52  cd "$_pkgname-$pkgver"
    
      53  make DESTDIR="$pkgdir" install-bytecode
    
      54  make DESTDIR="$pkgdir" vimdir="/usr/share/vim/vimfiles" install
    
      55  install -vDm 644 LICENSE.OFL -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      56  install -vDm 644 {AUTHORS,NEWS}.txt README.md \
    
      57    -t "${pkgdir}/usr/share/doc/${pkgname}/"
    
      58  # delete copied fonts, they are relied upon as optdepends
    
      59  # rm "${pkgdir}/usr/share/lilypond/${pkgver}/fonts/otf/"{C059,Nimbus,texgyre}*.otf
    
      60}
    
      61

Changes since previous scan

--- PKGBUILD @ 2026-09-14 00:27
+++ PKGBUILD @ 2026-10-24 00:14
@@ -10,7 +10,7 @@
 
 pkgname=lilypond-devel
 _pkgname=lilypond
-pkgver=2.27.3
+pkgver=2.27.4
 pkgrel=1
 pkgdesc="Lilypond music engraving program (development release)"
 arch=('x86_64')
@@ -30,8 +30,8 @@
 provides=('lilypond=${pkgver}')
 conflicts=('lilypond')
 source=("https://lilypond.org/downloads/sources/v${pkgver%.*}/$_pkgname-$pkgver.tar.gz")
-sha512sums=('889b9921ed60555df9022653466ee3f87860f15fa1ca5f94ccdb471d31f6aaad2932f352c1c39292041637fad63ffa40700bbcb3f61e20b23b85d76852f0d829')
-b2sums=('26c7a3ec62383d56973d1865d8eabf94d9253ac7823f35bb1cf7da4bf79fea08f9f648d0ffc0a3fd8692a5b1641b97dbdbf4a6f7f71efa207293f8466918fcc8')
+sha512sums=('aee7b38dcaf5f0d50f5fa39d08eba8d965bef6a7159f3b79ebc754b4da95eacefcb280881a75cd2525ae210d8e47f3391db91c0b2c704b1e15b1c70e7af67c2a')
+b2sums=('fef8f36e5cf24e4b7fbc5a657fe79d613ab7659d8eab9b458c27c306ab00678b1a7f9d77febe491580fd4e725721197e4f8f4d8d8d0a54f2875e13c9aaef8624')
 
 prepare() {
   cd "$_pkgname-$pkgver"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 00:14:55	Low	2
2026-10-23 23:38:30	Medium	1
2026-09-14 00:27:57	Clean	2
2026-09-13 23:15:25	Medium	1
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2