mingw-w64-libwebp

maintainer patlefort · 5 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The source is a legitimate upstream tarball from Google's official release host (downloads.webmproject.org), which is not whitelisted but is the project's official distribution point; building from official source is normal AUR practice and poses low risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a legitimate upstream tarball from Google's official release host (downloads.webmproject.org), which is not whitelisted but is the project's official distribution point; building from official source is normal AUR practice and poses low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:15 source=("https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-$pkgver.tar.gz"{,.asc})

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Patrick Northon <northon_patrick3@yahoo.ca>
2# Contributor: drakkan <nicola.murino at gmail dot com>
3
4_pkgname=libwebp
5pkgname=mingw-w64-${_pkgname}
6pkgver=1.6.0
7pkgrel=2
8pkgdesc="WebP library and conversion tools (mingw-w64)"
9arch=(any)
10url="https://developers.google.com/speed/webp/"
11license=('BSD-3-Clause')
12makedepends=(mingw-w64-cmake ninja)
13depends=(mingw-w64-crt)
14options=(staticlibs !strip !buildflags)
15source=("https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-$pkgver.tar.gz"{,.asc})
16sha256sums=('e4ab7009bf0629fd11982d4c2aa83964cf244cffba7347ecd39019a9e38c4564'
17 'SKIP')
18
19validpgpkeys=('6B0E6B70976DE303EDF2F601F9C3D6BDB8232B5D') # WebP release signing key
20
21_srcdir="${_pkgname}-${pkgver}"
22_architectures="i686-w64-mingw32 x86_64-w64-mingw32"
23_flags=(
24 -Wno-dev -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_FLAGS_RELEASE='-DNDEBUG'
25 -DWEBP_ENABLE_SWAP_16BIT_CSP=ON )
26
27build() {
28 for _arch in ${_architectures}; do
29 ${_arch}-cmake -G Ninja -S "${_srcdir}" -B "build-${_arch}-static" "${_flags[@]}" \
30 -DBUILD_SHARED_LIBS=OFF \
31 -DCMAKE_INSTALL_PREFIX="/usr/${_arch}/static" \
32 -DCMAKE_FIND_NO_INSTALL_PREFIX=ON
33 cmake --build "build-${_arch}-static"
34
35 ${_arch}-cmake -G Ninja -S "${_srcdir}" -B "build-${_arch}" "${_flags[@]}"
36 cmake --build "build-${_arch}"
37 done
38}
39
40package() {
41 for _arch in ${_architectures}; do
42 DESTDIR="${pkgdir}" cmake --install "build-${_arch}-static"
43 rm -rf "$pkgdir"/usr/${_arch}/static/share
44 ${_arch}-strip -g "$pkgdir"/usr/${_arch}/static/lib/*.a
45
46 DESTDIR="${pkgdir}" cmake --install "build-${_arch}"
47 ${_arch}-strip "$pkgdir"/usr/${_arch}/bin/*.exe
48 ${_arch}-strip --strip-unneeded "$pkgdir"/usr/${_arch}/bin/*.dll
49 ${_arch}-strip -g "$pkgdir"/usr/${_arch}/lib/*.a
50 done
51}
52
53# vim: ts=2 sw=2 et:
54

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion