mpd-youtube-dl

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source URL for the patch points to GitHub, a standard and trusted development platform, and the patch is applied to the official MPD source code; the build process is transparent and uses standard AUR practices, so the non-whitelisted host flag is a false positive.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source URL for the patch points to GitHub, a standard and trusted development platform, and the patch is applied to the official MPD source code; the build process is transparent and uses standard AUR practices, so the non-whitelisted host flag is a false positive.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("https://www.musicpd.org/download/${_pkgbase}/${pkgver%.*}/${_pkgbase}-${pkgver}.tar.xz"{,.sig}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gaetan Bisson <bisson@archlinux.org>
    
      2# Contributor: Angel Velasquez <angvp@archlinux.org>
    
      3# Contributor: Andrea Scarpino <andrea@archlinux.org>
    
      4# Contributor: Damir Perisa <damir.perisa@bluewin.ch>
    
      5# Contributor: Ben <ben@benmazer.net>
    
      6
    
      7_pkgbase=mpd
    
      8pkgname=${_pkgbase}-youtube-dl
    
      9pkgver=0.21.16
    
      10pkgrel=1
    
      11pkgdesc='mpd fork with youtube support'
    
      12url='https://github.com/MusicPlayerDaemon/MPD/pull/223'
    
      13conflicts=('mpd')
    
      14license=('GPL')
    
      15arch=('x86_64')
    
      16depends=('audiofile' 'avahi' 'curl' 'faad2' 'ffmpeg' 'fluidsynth' 'icu' 'jack'
    
      17         'libao' 'libcdio-paranoia' 'libgme' 'libid3tag' 'libmad' 'libmikmod'
    
      18         'libmms' 'libmodplug' 'libmpcdec' 'libmpdclient' 'libnfs'
    
      19         'libsamplerate' 'libshout' 'libsoxr' 'libsystemd' 'libupnp' 'mpg123'
    
      20         'openal' 'smbclient' 'sqlite' 'twolame' 'wavpack' 'wildmidi' 'yajl'
    
      21         'zziplib')
    
      22optdepends=('youtube-dl: youtube and other streaming site support')
    
      23makedepends=('boost' 'meson' 'python-sphinx')
    
      24validpgpkeys=('0392335A78083894A4301C43236E8A58C6DB4512')
    
      25source=("https://www.musicpd.org/download/${_pkgbase}/${pkgver%.*}/${_pkgbase}-${pkgver}.tar.xz"{,.sig}
    
      26        'tmpfiles.d'
    
      27        'sysusers.d'
    
      28        'conf'
    
      29        "youtube-dl-$pkgver.patch::https://github.com/MusicPlayerDaemon/MPD/compare/v$pkgver...arcnmx:ytdl-$pkgver.patch")
    
      30backup=('etc/mpd.conf')
    
      31
    
      32prepare() {
    
      33	cd "${srcdir}/${_pkgbase}-${pkgver}"
    
      34	rm -fr build
    
      35	install -d build
    
      36	patch -Np1 < "${srcdir}/youtube-dl-$pkgver.patch"
    
      37}
    
      38
    
      39build() {
    
      40	cd "${srcdir}/${_pkgbase}-${pkgver}/build"
    
      41	_opts=('-Ddocumentation=true'
    
      42	       '-Dchromaprint=disabled' # appears not to be used for anything
    
      43	       '-Dsidplay=disabled' # unclear why but disabled in the past
    
      44	       '-Dadplug=disabled' # not in an official repo
    
      45	       '-Dsndio=disabled' # interferes with detection of alsa devices
    
      46	       '-Dshine=disabled' # not in an official repo
    
      47	       '-Dtremor=disabled' # not in an official repo
    
      48	)
    
      49	arch-meson .. ${_opts[@]}
    
      50	ninja
    
      51}
    
      52
    
      53package() {
    
      54	cd "${srcdir}/${_pkgbase}-${pkgver}/build"
    
      55	DESTDIR="${pkgdir}" ninja install
    
      56	install -Dm644 ../doc/mpdconf.example "${pkgdir}"/usr/share/doc/mpd/mpdconf.example
    
      57	install -Dm644 ../doc/mpd.conf.5 "${pkgdir}"/usr/share/man/man5/mpd.conf.5
    
      58	install -Dm644 ../doc/mpd.1 "${pkgdir}"/usr/share/man/man1/mpd.1
    
      59
    
      60	install -Dm644 ../../tmpfiles.d "${pkgdir}"/usr/lib/tmpfiles.d/mpd.conf
    
      61	install -Dm644 ../../sysusers.d "${pkgdir}"/usr/lib/sysusers.d/mpd.conf
    
      62	install -Dm644 ../../conf "${pkgdir}"/etc/mpd.conf
    
      63
    
      64	sed \
    
      65		-e '/\[Service\]/a User=mpd' \
    
      66		-e '/WantedBy=/c WantedBy=default.target' \
    
      67		-i "${pkgdir}"/usr/lib/systemd/system/mpd.service
    
      68}
    
      69
    
      70# makepkg -g >> PKGBUILD
    
      71sha256sums=('30cf1bddf7d7388487276745ad3515f134e07f0c57f9f97cb2b5d3befd4a4d92'
    
      72            'SKIP'
    
      73            '2faa85c12449a5b3ca422ff1c1fa06d057c7e262a74bfa6298c914a92d6f2e7a'
    
      74            '0b74c6e5db08daab3091dc15a6b0c75210ba2f9e98fa074f6cfd605a461056b6'
    
      75            'f40f68205834ca53cea3372e930bfe6c2f9ecc9df3b1605df2fec63a658b2e03'
    
      76            'a07aa2e6094e656005502ee0fca3985091a876590404688a16b7e73bbb2c3c92')
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2