openmpt

maintainer andrewlin16 · 16 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads prebuilt portable Windows binaries from the project's official domain, which is a supply-chain risk if compromised, but the binaries are not executed directly on the host and are part of the normal packaging workflow for a Wine-based application.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt portable Windows binaries from the project's official domain, which is a supply-chain risk if compromised, but the binaries are not executed directly on the host and are part of the normal packaging workflow for a Wine-based application.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source_i686=("$pkgname-$pkgver.zip::https://download.openmpt.org/archive/openmpt/$(echo $pkgver | grep -Po '^\d+.\d+')/OpenMPT-$pkgver-portable-x86.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andrew Lin <andrewlin16 at gmail dot com>
    
      2# Contributor: Simon Thorpe <simon at hivetechnology dot com dot au>
    
      3pkgname=openmpt
    
      4pkgver=1.32.11.00
    
      5pkgrel=2
    
      6pkgdesc="Open-source audio module tracker"
    
      7arch=('i686' 'x86_64')
    
      8url="https://openmpt.org/"
    
      9license=('BSD-3-Clause')
    
      10depends=('wine')
    
      11makedepends=('gendesk' 'imagemagick' 'unzip')
    
      12optdepends=(
    
      13  'bash-completion: tab completion support'
    
      14  'ccache: for Wine native host support'
    
      15)
    
      16source=(
    
      17  'openmpt'
    
      18  'openmpt-bash-completion'
    
      19  'x-mptm.xml'
    
      20)
    
      21source_i686=("$pkgname-$pkgver.zip::https://download.openmpt.org/archive/openmpt/$(echo $pkgver | grep -Po '^\d+.\d+')/OpenMPT-$pkgver-portable-x86.zip")
    
      22source_x86_64=("$pkgname-$pkgver.zip::https://download.openmpt.org/archive/openmpt/$(echo $pkgver | grep -Po '^\d+.\d+')/OpenMPT-$pkgver-portable-amd64.zip")
    
      23noextract=("$pkgname-$pkgver.zip")
    
      24sha256sums=(
    
      25  '8b3da74d09640985e324441e459d0ac43f956dd95b89e0003b0ad2df46742685'
    
      26  '602639496997a74fab0914b1cff519dff207524ba0adf516ecc55466a4e83253'
    
      27  '44065d91a46203dae1378d6d99e70d882d28f66e3a584236242937856a9a8d56'
    
      28)
    
      29sha256sums_i686=('25efd4a60c240ed6f1900ff179a415ff7901d14234077d07e0d0983b98396f6c')
    
      30sha256sums_x86_64=('1a0ade86b356effe6be75fe48cca0f5443066fc5ba84cc5e76779e190b615e31')
    
      31
    
      32prepare() {
    
      33  cd "$srcdir"
    
      34  mkdir -p "$pkgname-$pkgver"
    
      35  unzip -o -d "$pkgname-$pkgver" "$pkgname-$pkgver.zip"
    
      36
    
      37  magick "$pkgname-$pkgver/OpenMPT File Icon.ico" "icon.png"
    
      38  gendesk -n -f --pkgname "$pkgname" --pkgdesc "$pkgdesc" \
    
      39    --name='OpenMPT' \
    
      40    --mimetype='audio/x-mod;audio/x-s3m;audio/x-xm;audio/x-it;audio/x-mptm' \
    
      41    --categories 'Audio;Sequencer;Midi;AudioVideoEditing;Music;AudioVideo;'
    
      42}
    
      43
    
      44package() {
    
      45  mkdir -p "$pkgdir/usr/share"
    
      46  cp -r "$srcdir/$pkgname-$pkgver" "$pkgdir/usr/share/openmpt"
    
      47  # Since OpenMPT 1.29, portable installations are identified by the presence of the "OpenMPT.portable" file.
    
      48  # That file is removed here to keep existing installations configured properly.
    
      49  rm "$pkgdir/usr/share/openmpt/OpenMPT.portable"
    
      50  install -Dm755 "$srcdir/openmpt" "$pkgdir/usr/bin/openmpt"
    
      51  install -Dm644 "$srcdir/icon-2.png" "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      52  install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      53  install -Dm644 "$srcdir/x-mptm.xml" "$pkgdir/usr/share/mime/application/x-mptm.xml"
    
      54  install -Dm644 "$srcdir/openmpt-bash-completion" "$pkgdir/usr/share/bash-completion/completions/openmpt"
    
      55}
    
      56
    
      57# vim:set ts=2 sts=2 sw=2 et:
    
      58

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,12 +1,12 @@
 # Maintainer: Andrew Lin <andrewlin16 at gmail dot com>
 # Contributor: Simon Thorpe <simon at hivetechnology dot com dot au>
 pkgname=openmpt
-pkgver=1.32.10.00
-pkgrel=1
+pkgver=1.32.11.00
+pkgrel=2
 pkgdesc="Open-source audio module tracker"
 arch=('i686' 'x86_64')
 url="https://openmpt.org/"
-license=('BSD')
+license=('BSD-3-Clause')
 depends=('wine')
 makedepends=('gendesk' 'imagemagick' 'unzip')
 optdepends=(
@@ -26,8 +26,8 @@
   '602639496997a74fab0914b1cff519dff207524ba0adf516ecc55466a4e83253'
   '44065d91a46203dae1378d6d99e70d882d28f66e3a584236242937856a9a8d56'
 )
-sha256sums_i686=('a88e10e658b2125c074036c6031241d13e98199591d70afe0c81248880709d80')
-sha256sums_x86_64=('1532986ff3a2eaad32c8ac2f281c6831ec627904f051869b0f719d6c051c51ec')
+sha256sums_i686=('25efd4a60c240ed6f1900ff179a415ff7901d14234077d07e0d0983b98396f6c')
+sha256sums_x86_64=('1a0ade86b356effe6be75fe48cca0f5443066fc5ba84cc5e76779e190b615e31')
 
 prepare() {
   cd "$srcdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 21:33:47	MEDIUM	1
2026-06-20 16:03:41	CLEAN	2
2026-06-20 00:50:07	MEDIUM	2
2026-06-20 00:18:46	MEDIUM	2
2026-06-19 23:51:18	MEDIUM	2
2026-06-19 19:07:35	LOW	2
2026-06-18 16:11:54	MEDIUM	1