mingw-w64-libwebp
maintainer patlefort
· 5 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a legitimate upstream tarball from Google's official release host (downloads.webmproject.org), which is not whitelisted but is the project's official distribution point; building from official source is normal AUR practice and poses low risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a legitimate upstream tarball from Google's official release host (downloads.webmproject.org), which is not whitelisted but is the project's official distribution point; building from official source is normal AUR practice and poses low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
source=("https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-$pkgver.tar.gz"{,.asc})
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Patrick Northon <northon_patrick3@yahoo.ca>
2
# Contributor: drakkan <nicola.murino at gmail dot com>
3
4
_pkgname=libwebp
5
pkgname=mingw-w64-${_pkgname}
6
pkgver=1.6.0
7
pkgrel=2
8
pkgdesc="WebP library and conversion tools (mingw-w64)"
9
arch=(any)
10
url="https://developers.google.com/speed/webp/"
11
license=('BSD-3-Clause')
12
makedepends=(mingw-w64-cmake ninja)
13
depends=(mingw-w64-crt)
14
options=(staticlibs !strip !buildflags)
15
source=("https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-$pkgver.tar.gz"{,.asc})
16
sha256sums=('e4ab7009bf0629fd11982d4c2aa83964cf244cffba7347ecd39019a9e38c4564'
17
'SKIP')
18
19
validpgpkeys=('6B0E6B70976DE303EDF2F601F9C3D6BDB8232B5D') # WebP release signing key
20
21
_srcdir="${_pkgname}-${pkgver}"
22
_architectures="i686-w64-mingw32 x86_64-w64-mingw32"
23
_flags=(
24
-Wno-dev -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_FLAGS_RELEASE='-DNDEBUG'
25
-DWEBP_ENABLE_SWAP_16BIT_CSP=ON )
26
27
build() {
28
for _arch in ${_architectures}; do
29
${_arch}-cmake -G Ninja -S "${_srcdir}" -B "build-${_arch}-static" "${_flags[@]}" \
30
-DBUILD_SHARED_LIBS=OFF \
31
-DCMAKE_INSTALL_PREFIX="/usr/${_arch}/static" \
32
-DCMAKE_FIND_NO_INSTALL_PREFIX=ON
33
cmake --build "build-${_arch}-static"
34
35
${_arch}-cmake -G Ninja -S "${_srcdir}" -B "build-${_arch}" "${_flags[@]}"
36
cmake --build "build-${_arch}"
37
done
38
}
39
40
package() {
41
for _arch in ${_architectures}; do
42
DESTDIR="${pkgdir}" cmake --install "build-${_arch}-static"
43
rm -rf "$pkgdir"/usr/${_arch}/static/share
44
${_arch}-strip -g "$pkgdir"/usr/${_arch}/static/lib/*.a
45
46
DESTDIR="${pkgdir}" cmake --install "build-${_arch}"
47
${_arch}-strip "$pkgdir"/usr/${_arch}/bin/*.exe
48
${_arch}-strip --strip-unneeded "$pkgdir"/usr/${_arch}/bin/*.dll
49
${_arch}-strip -g "$pkgdir"/usr/${_arch}/lib/*.a
50
done
51
}
52
53
# vim: ts=2 sw=2 et:
54
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |