moc-stable-complete
LOW
maintainer PiterDeVries
0 votes
scanned 2026-09-12 03:12:35.601558
Why flagged
All sources are from plausible official/project hosts (ftp.daper.net for MOC, GitHub for moc-fluidsynth-plugin) with SHA256 checksums; bundled local files (pulse.c, pulse.h, ffmpeg.c.patch) also have checksums; the build applies patches and compiles from source with no remote code execution or exfiltration concerns, though the package is complex and low-vote.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): All sources are from plausible official/project hosts (ftp.daper.net for MOC, GitHub for moc-fluidsynth-plugin) with SHA256 checksums; bundled local files (pulse.c, pulse.h, ffmpeg.c.patch) also have checksums; the build applies patches and compiles from source with no remote code execution or exfiltration concerns, though the package is complex and low-vote.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
source=("https://ftp.daper.net/pub/soft/${_pkgname}/stable/${_pkgname}-${pkgver}.tar.bz2"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: PiterDeVries <https://aur.archlinux.org/account/PiterDeVries>
2
3
pkgname='moc-stable-complete'
4
_pkgname='moc'
5
pkgver='2.5.2'
6
pkgrel=2
7
pkgdesc='Music On Console is an ncurses-based console audio player - stable version with patches that support PulseAudio and FluidSynth, compiled against current FFmpeg'
8
arch=('x86_64')
9
url="https://moc.daper.net/"
10
license=('GPL-2.0-or-later')
11
depends=('popt' 'libmad' 'libid3tag' 'jack' 'curl' 'libltdl' 'file' 'sndio' 'fluidsynth' 'libsmf')
12
makedepends=('speex' 'ffmpeg>=5.1' 'taglib' 'libmpcdec' 'wavpack' 'libmodplug' 'faad2')
13
optdepends=('speex: for using the speex plugin'
14
'ffmpeg>=5.1: for using the ffmpeg plugin'
15
'taglib: for using the musepack plugin'
16
'libmpcdec: for using the musepack plugin'
17
'wavpack: for using the wavpack plugin'
18
'faad2: for using the aac plugin'
19
'libmodplug: for using the modplug plugin')
20
provides=('moc')
21
conflicts=('moc' 'moc-pulse' 'moc-git' 'moc-unstable' 'moc-stable' 'moc-development' 'moc-fluidsynth-plugin')
22
source=("https://ftp.daper.net/pub/soft/${_pkgname}/stable/${_pkgname}-${pkgver}.tar.bz2"
23
"moc-fluidsynth-plugin-0.6.6.tar.gz::https://github.com/joanbm/moc-fluidsynth-plugin/archive/refs/tags/v0.0.6.tar.gz"
24
"pulse.c"
25
"pulse.h"
26
"ffmpeg.c.patch")
27
sha256sums=('f3a68115602a4788b7cfa9bbe9397a9d5e24c68cb61a57695d1c2c3ecf49db08'
28
'5585d541c6bc92103a71a044d096f16d872ac260a078d7d91b005f60939aefb4'
29
'84cbc24e9c81f0ea699438bdb8827f1519c107fb963a8b59baf50e3a21f70252'
30
'93e89cc4f4025f30a9b1b0c4c2603ca35950cf237dc0fc15f09759438232bc33'
31
'1c80e716ff774a7bb5f07cb938663aac596c12f6302f64b389504519778de5d0')
32
install="moc-stable-complete.install"
33
34
prepare() {
35
cd "${_pkgname}-${pkgver}"
36
37
### The rest of the build() section will be divided into several subsections:
38
### necessary patches(1), PulseAudio support(2), FluidSynth plugin(3), patches for FFmpeg plugin compatibility with
39
### FFmpeg versions>5.0 (4) and updating the configuration files (5).
40
41
42
## 1. Fix the compilation (fix all current errors):
43
44
# add support for https in the file: 'files.c'
45
sed -i '95a\ || !strncasecmp (str, "https://", sizeof ("https://") - 1)' "$srcdir/${_pkgname}-${pkgver}/files.c"
46
47
# fix warning about the file 'configure.in' (should be named 'configue.ac'):
48
mv "$srcdir/${_pkgname}-${pkgver}/configure.in" "$srcdir/${_pkgname}-${pkgver}/configure.ac"
49
50
51
52
## 2. Add the PulseAudio support:
53
# (Note: PulseAudio support based on the AUR/moc-pulse package)
54
55
# copy files 'pulse.c' and 'pulse.h' into the main directory:
56
cp ../pulse.c "$srcdir/${_pkgname}-${pkgver}/"
57
cp ../pulse.h "$srcdir/${_pkgname}-${pkgver}/"
58
59
# include the 'pulse.h' header into the file: 'audio.c'
60
sed -i '34a\#ifdef HAVE_PULSE' "$srcdir/${_pkgname}-${pkgver}/audio.c"
61
sed -i '35a\# include "pulse.h"' "$srcdir/${_pkgname}-${pkgver}/audio.c"
62
sed -i '36a\#endif"' "$srcdir/${_pkgname}-${pkgver}/audio.c"
63
64
# add "PulseAudio" as an option in the main configuration file - modify the file: 'options.c'
65
sed -i '575 s/CHECK_DISCRETE(5), "SNDIO", "Jack", "ALSA", "OSS", "null");/CHECK_DISCRETE(5), "SNDIO", "PulseAudio", "Jack", "ALSA", "OSS", "null");/' \
66
"$srcdir/${_pkgname}-${pkgver}/options.c"
67
sed -i '578 s/CHECK_DISCRETE(5), "SNDIO", "Jack", "ALSA", "OSS", "null");/CHECK_DISCRETE(5), "SNDIO", "PulseAudio", "Jack", "ALSA", "OSS", "null");/' \
68
"$srcdir/${_pkgname}-${pkgver}/options.c"
69
70
# finally, modify the main configuration file to add another option - file: 'configure.ac'
71
sed -i '190a\if test "x$with_pulse" != "xno"' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
72
sed -i '191a\then' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
73
sed -i '192a\ PKG_CHECK_MODULES(PULSE, [libpulse],' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
74
sed -i '193a\ [SOUND_DRIVERS="$SOUND_DRIVERS PULSE"' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
75
sed -i '194a\ EXTRA_OBJS="$EXTRA_OBJS pulse.o"' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
76
sed -i '195a\ AC_DEFINE([HAVE_PULSE], 1, [Define if you have PulseAudio.])' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
77
sed -i '196a\ EXTRA_LIBS="$EXTRA_LIBS $PULSE_LIBS"' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
78
sed -i '197a\ CFLAGS="$CFLAGS $PULSE_CFLAGS"],' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
79
sed -i '198a\ [true])' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
80
sed -i '199a\fi' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
81
sed -i '200a\' "$srcdir/${_pkgname}-${pkgver}/configure.ac"
82
83
# last tiny detail: add "PULSEAUDIO" into the "SoundDriver" section in the example config file 'config.example.in'
84
sed -i '124 s/ALSA, JACK,/ALSA, JACK, PULSEAUDIO,/' "$srcdir/${_pkgname}-${pkgver}/config.example.in"
85
86
87
88
## 3. Add the FluidSynth support (made by Joan Bruguera Micó)
89
# Note: for some reason, it can't be included directly (can only be compiled separately as a shared library)
90
# ...probably because the moc-fulidsynth-plugin adds specific steps for compiling the libfluidsynth_decoder.so (as a standalone plugin)
91
# - that makes some of the following steps kind of redundant
92
# (will needs to compile the libfluidsynth_decoder.so directly later - see the build() and package() sections)
93
94
# copy the 'fluidsynth' decoder plugin from the moc-fluidsynth-plugin project:
95
cp -r ../moc-fluidsynth-plugin-0.0.6/moc/decoder_plugins/fluidsynth "$srcdir/${_pkgname}-${pkgver}/decoder_plugins"
96
97
# add the 'fluidsynth' right after 'timidity' in the decoder list - the file: 'decoders.m4'
98
sed -i '26a\m4_include(decoder_plugins/fluidsynth/fluidsynth.m4)' "$srcdir/${_pkgname}-${pkgver}/decoder_plugins/decoders.m4"
99
100
# ... and to the file: 'decoder_plugins/Makefile.am'
101
sed -i '38a\if BUILD_fluidsynth' "$srcdir/${_pkgname}-${pkgver}/decoder_plugins/Makefile.am"
102
sed -i '39a\ SUBDIRS += fluidsynth' "$srcdir/${_pkgname}-${pkgver}/decoder_plugins/Makefile.am"
103
sed -i '40a\endif' "$srcdir/${_pkgname}-${pkgver}/decoder_plugins/Makefile.am"
104
sed -i '41a\' "$srcdir/${_pkgname}-${pkgver}/decoder_plugins/Makefile.am"
105
106
# also add 'fluidsynth' to the file: 'tools/md5check.sh'
107
sed -i '240 s/timidity/timidity|fluidsynth/' "$srcdir/${_pkgname}-${pkgver}/tools/md5check.sh"
108
109
# and list it in the main makefile: 'Makefile.in'
110
sed -i '69a\ $(top_srcdir)/decoder_plugins/fluidsynth/fluidsynth.m4 \' "$srcdir/${_pkgname}-${pkgver}/decoder_plugins/Makefile.in"
111
112
# add notion about the FluidSynth support to the default example config file: 'config.example.in'
113
sed -i '625a\# Self-describing FluidSynth audio characteristic options.' "$srcdir/${_pkgname}-${pkgver}/config.example.in"
114
sed -i '626a\#FluidSynth_SoundFont = /usr/share/soundfonts/default.sf2' "$srcdir/${_pkgname}-${pkgver}/config.example.in"
115
sed -i '627a\#FluidSynth_Rate = 44100 # Between 8000 and 96000' "$srcdir/${_pkgname}-${pkgver}/config.example.in"
116
sed -i '628a\' "$srcdir/${_pkgname}-${pkgver}/config.example.in"
117
118
# and finally: give credit to the author of the moc-fluidsynth-plugin - add him to the file: 'THANKS'
119
sed -i '16a\Joan Bruguera:' "$srcdir/${_pkgname}-${pkgver}/THANKS"
120
sed -i '17a\ * Added FluidSynth decoder for MIDI.' "$srcdir/${_pkgname}-${pkgver}/THANKS"
121
sed -i '18a\' "$srcdir/${_pkgname}-${pkgver}/THANKS"
122
123
124
125
## 4. Patch the FFmpeg decoder plugin so that its compatible with current version of FFmpeg:
126
127
# apply patch to the file 'decoder_plugins/ffmpeg/ffmpeg.c' - this is the core change,
128
# as it fixes the breaking API changes that happened between FFmpeg 4.4->5.1
129
patch < ../ffmpeg.c.patch "$srcdir/${_pkgname}-${pkgver}/decoder_plugins/ffmpeg/ffmpeg.c"
130
131
# modify the FFmpeg plugin's makefile 'decoder_plugins/ffmpeg/ffmpeg.m4' - ensure that MOC compiles
132
# against FFmpeg version>=5.1 (API-wise, this means libavcodec 59.24.100):
133
sed -i '36 s/--atleast-version 54.59.100 libavcodec/--atleast-version 59.24.100 libavcodec/' "$srcdir/${_pkgname}-${pkgver}/decoder_plugins/ffmpeg/ffmpeg.m4"
134
135
136
137
## 5. final step - reconfigure the configuration system:
138
autoreconf -i -f
139
}
140
141
build() {
142
cd "${_pkgname}-${pkgver}"
143
144
./configure --prefix=/usr \
145
--without-rcc \
146
--with-pulse \
147
--with-oss \
148
--with-alsa \
149
--with-jack \
150
--with-aac \
151
--with-mp3 \
152
--with-musepack \
153
--with-vorbis \
154
--with-flac \
155
--with-wavpack \
156
--with-sndfile \
157
--with-modplug \
158
--with-ffmpeg \
159
--with-speex \
160
--with-samplerate \
161
--with-curl \
162
--with-fluidsynth \
163
--disable-cache \
164
--disable-debug
165
make
166
167
## Since the FluidSynth plugin can't be included directly (requires specific additional make parameters),
168
## we will now create a new Makefile and use it to build the file libfluidsynth_decoder.so
169
## Note that as far as packaging goes, this is kind of a weird hack:
170
171
# create the new Makefile in the "$srcdir":
172
cd "${srcdir}"
173
touch "Makefile"
174
175
# fill the new Makefile - based on the content of Makefile from the moc-fluidsynth-plugin:
176
echo 'CC := gcc' >> "$srcdir/Makefile"
177
echo 'SMF_FLAGS = $(shell pkg-config --exists smf && pkg-config --cflags --libs smf && echo "-DHAVE_SMF")' >> "$srcdir/Makefile"
178
echo 'libfluidsynth_decoder.so: moc/decoder_plugins/fluidsynth/fluidsynth.c' >> "$srcdir/Makefile"
179
echo ' $(CC) -Wall -Wextra -fPIC -DSTANDALONE -Imoc -shared moc/decoder_plugins/fluidsynth/fluidsynth.c \' >> "$srcdir/Makefile"
180
echo ' $(shell pkg-config --cflags --libs fluidsynth) $(SMF_FLAGS) -o libfluidsynth_decoder.so' >> "$srcdir/Makefile"
181
182
# create a symbolic link called 'moc' in "$srcdir" - this mirrors the directory structure from the moc-fluidsynth plugin:
183
ln -s "${_pkgname}-${pkgver}" "${srcdir}/${_pkgname}"
184
185
# and of course make the libfluidsynth_decoder.so library itself:
186
make libfluidsynth_decoder.so
187
}
188
189
package() {
190
cd ${_pkgname}-${pkgver}
191
make DESTDIR="${pkgdir}" install
192
193
# now all that remains to do is to replace the libfluidsynth_decoder.so with the one from "$srcdir":
194
rm "${pkgdir}/usr/lib/moc/decoder_plugins/libfluidsynth_decoder.so"
195
cp "${srcdir}/libfluidsynth_decoder.so" "${pkgdir}/usr/lib/moc/decoder_plugins/"
196
}
197
198
# vim: ts=2 sw=2
199
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-12 03:12:35 | Low | 3 |
| 2026-09-12 03:10:21 | Medium | 2 |