moony-lv2-git

maintainer milkii · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The source is a git repository from a personal domain not on a standard forge, but it is the upstream project's own host, and the package builds from source without executing untrusted prebuilt binaries, making the risk low despite the unverifiable checksum.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from a personal domain not on a standard forge, but it is the upstream project's own host, and the package builds from source without executing untrusted prebuilt binaries, making the risk low despite the unverifiable checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("git+https://git.ventosus.ch/~hp/moony.lv2")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Milk Brewster (milk on freenode)
    
      2
    
      3_pkgname=moony.lv2
    
      4pkgname=moony-lv2-git
    
      5pkgver=0.41.255.r2825.32288d84
    
      6pkgrel=1
    
      7pkgdesc="Realtime Lua as programmable glue in LV2 - git master"
    
      8arch=('i686' 'x86_64')
    
      9url='https://git.open-music-kontrollers.ch/~hp/moony.lv2'
    
      10license=('Artistic2.0')
    
      11groups=('lv2-plugins' 'pro-audio')
    
      12depends=('cairo' 'fontconfig' 'libgl' 'libvterm' 'pixman')
    
      13makedepends=('git' 'lv2' 'meson' 'sord' 'fontconfig' 'pixman' 'libvterm' 'cairo')
    
      14provides=("${_pkgname}")
    
      15conflicts=('moony-lv2' "${_pkgname}")
    
      16source=("git+https://git.ventosus.ch/~hp/moony.lv2")
    
      17sha256sums=('SKIP')
    
      18
    
      19pkgver() {
    
      20  cd "${srcdir}/${_pkgname}"
    
      21
    
      22  printf "%s.r%s.%s" "$(grep -oP "^option\('version'.*value\s*:\s*'\K[^']+" meson_options.txt)" \
    
      23    "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      24}
    
      25
    
      26build() {
    
      27  cd "${srcdir}/${_pkgname}"
    
      28
    
      29  arch-meson --buildtype=release build
    
      30  cd build
    
      31  ninja -j4
    
      32}
    
      33
    
      34check() {
    
      35  cd "${srcdir}/${_pkgname}"
    
      36
    
      37  meson test -C build || msg "lv2_validate currently known to fail on the plugin"
    
      38}
    
      39
    
      40package() {
    
      41  cd "${srcdir}/${_pkgname}"
    
      42
    
      43  DESTDIR="${pkgdir}" meson install -C build
    
      44  # docs
    
      45  install -vDm 644 ChangeLog README.md build/manual.html build/moony_logo.png \
    
      46    -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      47}
    
      48
    
      49# vim:set ts=2 sw=2 et:
    
      50

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,24 +2,25 @@
 
 _pkgname=moony.lv2
 pkgname=moony-lv2-git
-pkgver=0.29.1.r2493.54f6d76
+pkgver=0.41.255.r2825.32288d84
 pkgrel=1
 pkgdesc="Realtime Lua as programmable glue in LV2 - git master"
 arch=('i686' 'x86_64')
-url='http://open-music-kontrollers.ch/lv2/moony/'
+url='https://git.open-music-kontrollers.ch/~hp/moony.lv2'
 license=('Artistic2.0')
 groups=('lv2-plugins' 'pro-audio')
-depends=('libgl')
-makedepends=('git' 'lv2' 'meson' 'sord')
+depends=('cairo' 'fontconfig' 'libgl' 'libvterm' 'pixman')
+makedepends=('git' 'lv2' 'meson' 'sord' 'fontconfig' 'pixman' 'libvterm' 'cairo')
 provides=("${_pkgname}")
 conflicts=('moony-lv2' "${_pkgname}")
-source=("git+https://github.com/OpenMusicKontrollers/moony.lv2")
+source=("git+https://git.ventosus.ch/~hp/moony.lv2")
 sha256sums=('SKIP')
 
 pkgver() {
   cd "${srcdir}/${_pkgname}"
 
-  printf "%s.r%s.%s" $(tail -n 1 VERSION) "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+  printf "%s.r%s.%s" "$(grep -oP "^option\('version'.*value\s*:\s*'\K[^']+" meson_options.txt)" \
+    "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
 }
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 19:31:13	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0