mpvz-git

maintainer misternegative · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a public GitHub repository with a SKIP'd checksum, but the source is the project's own code, and no untrusted executables or payloads are downloaded or executed.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a public GitHub repository with a SKIP'd checksum, but the source is the project's own code, and no untrusted executables or payloads are downloaded or executed.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Abhishek Sharma >
    
      2
    
      3_pkgname=mpvz
    
      4_github="MatsyaOs${_pkgname}"
    
      5pkgname=${_pkgname}-git
    
      6pkgver=0.r190.g89208b7
    
      7pkgrel=1
    
      8pkgdesc='Qt6/QML based GUI for libmpv. Based on the Tethys theme for Bomi.'
    
      9url="https://github.com/${_github}"
    
      10conflicts=("${_pkgname}")
    
      11provides=("${_pkgname}")
    
      12arch=('i686' 'x86_64')
    
      13license=('GPL2')
    
      14makedepends=('git')
    
      15depends=('qt6-wayland' 'qt6-quickcontrols2' 'mpv')
    
      16source=("${_pkgname}::git+https://github.com/${_github}")
    
      17sha256sums=('SKIP')
    
      18
    
      19pkgver() {
    
      20	cd "${srcdir}/${_pkgname}"
    
      21    printf '0.r%s.g%s' \
    
      22        "$(git rev-list --count master)" \
    
      23        "$(git log -1 --format='%h')"
    
      24}
    
      25
    
      26prepare() {
    
      27    mkdir -p "${srcdir}/${_pkgname}/build"
    
      28}
    
      29
    
      30build() {
    
      31	cd "${srcdir}/${_pkgname}/build"
    
      32    qmake ..
    
      33    make
    
      34}
    
      35
    
      36package() {
    
      37	cd "${srcdir}/${_pkgname}/build"
    
      38    make INSTALL_ROOT="${pkgdir}/" install
    
      39}
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,18 +1,18 @@
-# Maintainer: Andy Kluger <https://t.me/andykluger>
+# Maintainer: Abhishek Sharma >
 
 _pkgname=mpvz
-_github="Zren/${_pkgname}"
+_github="MatsyaOs${_pkgname}"
 pkgname=${_pkgname}-git
 pkgver=0.r190.g89208b7
 pkgrel=1
-pkgdesc='Qt5/QML based GUI for libmpv. Based on the Tethys theme for Bomi.'
+pkgdesc='Qt6/QML based GUI for libmpv. Based on the Tethys theme for Bomi.'
 url="https://github.com/${_github}"
 conflicts=("${_pkgname}")
 provides=("${_pkgname}")
 arch=('i686' 'x86_64')
 license=('GPL2')
 makedepends=('git')
-depends=('qt5-x11extras' 'qt5-quickcontrols' 'mpv')
+depends=('qt6-wayland' 'qt6-quickcontrols2' 'mpv')
 source=("${_pkgname}::git+https://github.com/${_github}")
 sha256sums=('SKIP')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 21:16:48	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0