moc-development

LOW
maintainer PiterDeVries 0 votes scanned 2026-09-03 05:54:12.107496
View on AUR
Why flagged

All sources are from plausible official/project-owned hosts (ftp.daper.net for MOC itself, GitHub for the fluidsynth plugin), checksums are provided for all sources including the two local bundled files (pulse.c/pulse.h), and the build process is straightforward compilation with patches; no obfuscation, remote code execution, or exfiltration is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): All sources are from plausible official/project-owned hosts (ftp.daper.net for MOC itself, GitHub for the fluidsynth plugin), checksums are provided for all sources including the two local bundled files (pulse.c/pulse.h), and the build process is straightforward compilation with patches; no obfuscation, remote code execution, or exfiltration is present.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:23 source=("https://ftp.daper.net/pub/soft/${_pkgname}/unstable/${_pkgname}-${_pkgver}.tar.xz"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: PiterDeVries <https://aur.archlinux.org/account/PiterDeVries>
2
3pkgname='moc-development'
4_pkgname='moc'
5pkgver='2.6_alpha3'
6_pkgver='2.6-alpha3'
7pkgrel=1
8pkgdesc='Music On Console is an ncurses-based console audio player - latest version with patches to support PulseAudio and FluidSynth plugin (midi files)'
9arch=('x86_64')
10url="https://moc.daper.net/"
11license=('GPL-2.0-or-later')
12depends=('popt' 'libmad' 'libid3tag' 'jack' 'curl' 'libltdl' 'file' 'sndio' 'fluidsynth' 'libsmf')
13makedepends=('speex' 'ffmpeg4.4' 'taglib' 'libmpcdec' 'wavpack' 'libmodplug' 'faad2')
14optdepends=('speex: for using the speex plugin'
15 'ffmpeg4.4: for using the ffmpeg plugin'
16 'taglib: for using the musepack plugin'
17 'libmpcdec: for using the musepack plugin'
18 'wavpack: for using the wavpack plugin'
19 'faad2: for using the aac plugin'
20 'libmodplug: for using the modplug plugin')
21provides=('moc')
22conflicts=('moc' 'moc-pulse' 'moc-git' 'moc-unstable' 'moc-fluidsynth-plugin')
23source=("https://ftp.daper.net/pub/soft/${_pkgname}/unstable/${_pkgname}-${_pkgver}.tar.xz"
24 "moc-fluidsynth-plugin-0.6.6.tar.gz::https://github.com/joanbm/moc-fluidsynth-plugin/archive/refs/tags/v0.0.6.tar.gz"
25 "pulse.c"
26 "pulse.h")
27sha256sums=('a27b8888984cf8dbcd758584961529ddf48c237caa9b40b67423fbfbb88323b1'
28 '5585d541c6bc92103a71a044d096f16d872ac260a078d7d91b005f60939aefb4'
29 '84cbc24e9c81f0ea699438bdb8827f1519c107fb963a8b59baf50e3a21f70252'
30 '93e89cc4f4025f30a9b1b0c4c2603ca35950cf237dc0fc15f09759438232bc33')
31install="moc-development.install"
32
33prepare() {
34 cd "${_pkgname}-${_pkgver}"
35
36 ## 1. fix the compilation (i.e. fix all errors):
37
38 # first patch for FFmpeg 4.4 in the file: decoder_plugins/ffmpeg/ffmpeg.c
39 sed -i '700 s/CODEC_CAP_EXPERIMENTAL/AV_CODEC_CAP_EXPERIMENTAL/' "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins/ffmpeg/ffmpeg.c"
40 sed -i '708 s/CODEC_CAP_TRUNCATED/AV_CODEC_CAP_TRUNCATED/' "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins/ffmpeg/ffmpeg.c"
41 sed -i '709 s/CODEC_FLAG_TRUNCATED/AV_CODEC_FLAG_TRUNCATED/' "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins/ffmpeg/ffmpeg.c"
42 sed -i '728 s/CODEC_CAP_DELA/AV_CODEC_CAP_DELA/' "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins/ffmpeg/ffmpeg.c"
43
44 # fixing an error in the file: tags_cache.c
45 sed -i '129 s/db_strerror/bdb_strerror/' "$srcdir/${_pkgname}-${_pkgver}/tags_cache.c"
46
47 # add support for https in the file: files.c
48 sed -i '87a\ || !strncasecmp (str, "https://", sizeof ("https://") - 1)' "$srcdir/${_pkgname}-${_pkgver}/files.c"
49
50 # fix warning about file configure.in (should be named configue.ac):
51 mv "$srcdir/${_pkgname}-${_pkgver}/configure.in" "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
52
53
54
55 ## 2. add the PulseAudio support:
56 # (Note: PulseAudio support based on the AUR/moc-pulse package)
57
58 # copy files pulse.c and pulse.h into the main directory:
59 cp ../pulse.c "$srcdir/${_pkgname}-${_pkgver}/"
60 cp ../pulse.h "$srcdir/${_pkgname}-${_pkgver}/"
61
62 # include the pulse.h header into the file: audio.c
63 sed -i '34a\#ifdef HAVE_PULSE' "$srcdir/${_pkgname}-${_pkgver}/audio.c"
64 sed -i '35a\# include "pulse.h"' "$srcdir/${_pkgname}-${_pkgver}/audio.c"
65 sed -i '36a\#endif"' "$srcdir/${_pkgname}-${_pkgver}/audio.c"
66
67 # add "PulseAudio" as an option in the main configuration file - modify the file: options.c
68 sed -i '578 s/CHECK_DISCRETE(5), "SNDIO", "Jack", "ALSA", "OSS", "null");/CHECK_DISCRETE(5), "SNDIO", "PulseAudio", "Jack", "ALSA", "OSS", "null");/' \
69 "$srcdir/${_pkgname}-${_pkgver}/options.c"
70 sed -i '581 s/CHECK_DISCRETE(5), "SNDIO", "Jack", "ALSA", "OSS", "null");/CHECK_DISCRETE(5), "SNDIO", "PulseAudio", "Jack", "ALSA", "OSS", "null");/' \
71 "$srcdir/${_pkgname}-${_pkgver}/options.c"
72
73 # finally, modify the main configuration file to add another option - file: configure.ac
74 sed -i '159a\if test "x$with_pulse" != "xno"' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
75 sed -i '160a\then' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
76 sed -i '161a\ PKG_CHECK_MODULES(PULSE, [libpulse],' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
77 sed -i '162a\ [SOUND_DRIVERS="$SOUND_DRIVERS PULSE"' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
78 sed -i '163a\ EXTRA_OBJS="$EXTRA_OBJS pulse.o"' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
79 sed -i '164a\ AC_DEFINE([HAVE_PULSE], 1, [Define if you have PulseAudio.])' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
80 sed -i '165a\ EXTRA_LIBS="$EXTRA_LIBS $PULSE_LIBS"' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
81 sed -i '166a\ CFLAGS="$CFLAGS $PULSE_CFLAGS"],' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
82 sed -i '167a\ [true])' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
83 sed -i '168a\fi' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
84 sed -i '169a\' "$srcdir/${_pkgname}-${_pkgver}/configure.ac"
85
86
87
88 ## 3. add the FluidSynth support (made by Joan Bruguera Micó)
89 # Note: for some reason, it can't be included directly (can only be compiled as shared library)
90 # ...probably because the moc-fulidsynth-plugin adds specific steps for compiling the libfluidsynth_decoder.so (as a standalone plugin)
91 # - that makes some of the following steps kind of redundant
92 # (will needs to compile the libfluidsynth_decoder.so manually later - see the build() and package() sections)
93
94 # copy the 'fluidsynth' decoder plugin from the moc-fluidsynth-plugin project:
95 cp -r ../moc-fluidsynth-plugin-0.0.6/moc/decoder_plugins/fluidsynth "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins"
96
97 # add the 'fluidsynth' right after 'timidity' in the decoder list - the file: decoders.m4
98 sed -i '26a\m4_include(decoder_plugins/fluidsynth/fluidsynth.m4)' "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins/decoders.m4"
99
100 # ... and to the file: decoder_plugins/Makefile.am
101 sed -i '38a\if BUILD_fluidsynth' "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins/Makefile.am"
102 sed -i '39a\ SUBDIRS += fluidsynth' "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins/Makefile.am"
103 sed -i '40a\endif' "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins/Makefile.am"
104 sed -i '41a\' "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins/Makefile.am"
105
106 # also add 'fluidsynth' to the file: tools/md5check.sh
107 sed -i '244 s/timidity/timidity|fluidsynth/' "$srcdir/${_pkgname}-${_pkgver}/tools/md5check.sh"
108
109 # and list it with the main makefile - the file: Makefile.in
110 sed -i '69a\ $(top_srcdir)/decoder_plugins/fluidsynth/fluidsynth.m4 \' "$srcdir/${_pkgname}-${_pkgver}/decoder_plugins/Makefile.in"
111
112 # add notion about the FluidSynth support to the default example config file - the file: config.example.in
113 sed -i '639a\# Self-describing FluidSynth audio characteristic options.' "$srcdir/${_pkgname}-${_pkgver}/config.example.in"
114 sed -i '640a\#FluidSynth_SoundFont = /usr/share/soundfonts/default.sf2' "$srcdir/${_pkgname}-${_pkgver}/config.example.in"
115 sed -i '641a\#FluidSynth_Rate = 44100 # Between 8000 and 96000' "$srcdir/${_pkgname}-${_pkgver}/config.example.in"
116 sed -i '642a\' "$srcdir/${_pkgname}-${_pkgver}/config.example.in"
117
118 # and finally: give credit to the author of the moc-fluidsynth-plugin - add him to the file: THANKS
119 sed -i '16a\Joan Bruguera:' "$srcdir/${_pkgname}-${_pkgver}/THANKS"
120 sed -i '17a\ * Added FluidSynth decoder for MIDI.' "$srcdir/${_pkgname}-${_pkgver}/THANKS"
121 sed -i '18a\' "$srcdir/${_pkgname}-${_pkgver}/THANKS"
122
123
124
125 ## 4. final step - reconfigure the build system:
126 autoreconf -i -f
127}
128
129build() {
130 cd "${_pkgname}-${_pkgver}"
131
132 export PKG_CONFIG_PATH='/usr/lib/ffmpeg4.4/pkgconfig'
133
134 ./configure --prefix=/usr \
135 --without-rcc \
136 --with-pulse \
137 --with-oss \
138 --with-alsa \
139 --with-jack \
140 --with-aac \
141 --with-mp3 \
142 --with-musepack \
143 --with-vorbis \
144 --with-flac \
145 --with-wavpack \
146 --with-sndfile \
147 --with-modplug \
148 --with-ffmpeg \
149 --with-speex \
150 --with-samplerate \
151 --with-curl \
152 --with-fluidsynth \
153 --disable-cache \
154 --disable-debug
155 make
156
157 ## Since the FluidSynth plugin can't be included directly (requires specific additional make parameters),
158 ## we will now create a new Makefile and build the file libfluidsynth_decoder.so
159 ## note that this is kind of a weird hack:
160
161 # create the new Makefile in the $srcdir
162 cd "${srcdir}"
163 touch "Makefile"
164
165 # fill the new Makefile - based on the content of Makefile from the moc-fluidsynth-plugin:
166 echo 'CC := gcc' >> "$srcdir/Makefile"
167 echo 'SMF_FLAGS = $(shell pkg-config --exists smf && pkg-config --cflags --libs smf && echo "-DHAVE_SMF")' >> "$srcdir/Makefile"
168 echo 'libfluidsynth_decoder.so: moc/decoder_plugins/fluidsynth/fluidsynth.c' >> "$srcdir/Makefile"
169 echo ' $(CC) -Wall -Wextra -fPIC -DSTANDALONE -Imoc -shared moc/decoder_plugins/fluidsynth/fluidsynth.c \' >> "$srcdir/Makefile"
170 echo ' $(shell pkg-config --cflags --libs fluidsynth) $(SMF_FLAGS) -o libfluidsynth_decoder.so' >> "$srcdir/Makefile"
171
172 # create a symbolic link called 'moc' in $srcdir - this mirrors the directory structure from the moc-fluidsynth plugin:
173 ln -s "${_pkgname}-${_pkgver}" "${srcdir}/${_pkgname}"
174
175 # and of course make the libfluidsynth_decoder.so library:
176 make libfluidsynth_decoder.so
177}
178
179package() {
180 cd ${_pkgname}-${_pkgver}
181 make DESTDIR="${pkgdir}" install
182
183 # now all that remains to do is to replace the libfluidsynth_decoder.so with the one from "$srcdir":
184 rm "${pkgdir}/usr/lib/moc/decoder_plugins/libfluidsynth_decoder.so"
185 cp "${srcdir}/libfluidsynth_decoder.so" "${pkgdir}/usr/lib/moc/decoder_plugins/"
186}
187
188# vim: ts=2 sw=2
189

Scan history

Scanned at (UTC)SeverityRules
2026-09-03 05:54:12 Low 3
2026-09-03 05:52:26 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion