mp4ff-bin
The package downloads prebuilt binaries from the project's official GitHub releases, which is a normal and trusted practice; the low severity is due to the static rule about few votes and recent upload, not due to any malicious or risky behavior in the PKGBUILD.
Triggered rules
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from the project's official GitHub releases, which is a normal and trusted practice; the low severity is due to the static rule about few votes and recent upload, not due to any malicious or risky behavior in the PKGBUILD.
PKGBUILD
# Maintainer: agony <27015 at riseup dot net>
pkgname=mp4ff-bin
pkgver=0.61.0
pkgrel=1
pkgdesc='Tools for parsing and manipulating MP4/ISOBMFF files (prebuilt)'
arch=('x86_64' 'aarch64')
url='https://github.com/Eyevinn/mp4ff'
license=('MIT')
provides=("mp4ff=${pkgver}")
conflicts=('mp4ff')
_release="${url}/releases/download/v${pkgver}"
source_x86_64=("${_release}/mp4ff_${pkgver}_linux_amd64.tar.gz")
source_aarch64=("${_release}/mp4ff_${pkgver}_linux_arm64.tar.gz")
sha256sums_x86_64=('9bd523a82d2750e5f8cc46afd006a9574a90d7a189dcd97bde2a8c1eb526e684')
sha256sums_aarch64=('255d32e70eb9f6a028b413d9b793ac64d6590ad1cfe9c63de3bf6984682ac4a7')
package() {
install -Dm755 mp4ff-* -t "${pkgdir}/usr/bin"
install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-28 07:49:59 | Low | 2 |