oss-nonfree

maintainer alexdw · 15 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from the project's official domain (4front-tech.com) to build and install non-free OSS components; the host is not whitelisted but is plausibly legitimate, and the build process is transparent with verifiable checksums.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from the project's official domain (4front-tech.com) to build and install non-free OSS components; the host is not whitelisted but is plausibly legitimate, and the build process is transparent with verifiable checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("http://www.4front-tech.com/release/oss-linux-v${pkgver/_*}-${pkgver/*_}-$_pkgarch.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alex Wiggins <alex.d.wiggins@gmail.com>
    
      2# Contributer: Kyle Keen <keenerd@gmail.com>
    
      3# Contributor: Florian Pritz <bluewind@xinu.at>
    
      4# Contributor: Paulo Matias <matiasΘarchlinux-br·org>
    
      5# Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
    
      6# Contributor: Sebastian Schwarz <seschwar@gmail.com>
    
      7
    
      8pkgbase=oss-nonfree
    
      9pkgname=oss-nonfree
    
      10true && pkgname=(oss-nonfree libflashsupport-oss-nonfree)
    
      11pkgver=4.2_2020
    
      12pkgrel=1
    
      13arch=(i686 x86_64)
    
      14url="http://www.opensound.com/oss.html"
    
      15license=('custom:4Front Commercial License')
    
      16if [[ "$CARCH" == i686 ]]; then
    
      17    _pkgarch="i386"
    
      18else
    
      19    _pkgarch="amd64"
    
      20fi
    
      21source=("http://www.4front-tech.com/release/oss-linux-v${pkgver/_*}-${pkgver/*_}-$_pkgarch.tar.bz2"
    
      22        LICENSE
    
      23        oss.service
    
      24        remove-hal.patch
    
      25        rm-init-scripts.patch
    
      26        soundon.patch)
    
      27noextract=("oss-linux-v${pkgver/_*}-${pkgver/*_}-$_pkgarch.tar.bz2")
    
      28sha512sums=('3161f86a85c5eb1d30400a11351ff8e88defd65a1f6eab6e7b0f63fa6efe8f66f641239df681de6430e83aea901cd2b6c1c1d887fb5073838662875431f06aab'
    
      29            '75632fd1052834ccef32c72a30b2d2fd97448332ac1152962f6aaa29eac98a53b354dd2c3336312b760d88070d5165fef0f7f8e3ee3b8a2a3634d6fc5f56c995'
    
      30            '355e1380432947c0e9caa21114b2c3debeb162fb5abcf845125ec281ce52b437ad1ee1db04d37e9b7a5ac79816c4dcbc21b4ed4cf8191f71218d99acd7bab70e'
    
      31            '6956e5e2e9323b568bb18e80bbee591b0e5ffd3d4612a50df09879941b2733c31d6b3178dc9a46c283bd1629f76b7ff5e2b54893a42a47f6379eaee4731fd9be'
    
      32            '64e6d9d8eb5320f737d3a0698a245da2b2d141b68cfb2f02e448144d1c610aa8b8a6c38b56fcca364d63171a49afe93161a00545cdb90086b5328997b3096690'
    
      33            '5b91a4f3477db1bdbc40c891aaa8bc384f5a690e8290bc4db7bdb4a715a858b2f42780bfeb14281560a0e1a73d1cd4022ed738f01b74c26456dcf0b9952981b5')
    
      34if [[ "$CARCH" == i686 ]]; then
    
      35    sha512sums[0]='0f649e8851ec12b3cde4dc65ebf593dcdeba724356c5eac1f96cbb52713db2e9574efb9c3ac843514e3b6754c94a2b139b9d07cb4aefb4acf78646fb77616cde'
    
      36else
    
      37    sha512sums[0]='3161f86a85c5eb1d30400a11351ff8e88defd65a1f6eab6e7b0f63fa6efe8f66f641239df681de6430e83aea901cd2b6c1c1d887fb5073838662875431f06aab'
    
      38fi
    
      39
    
      40build() {
    
      41    bsdtar xf "oss-linux-v${pkgver/_*}-${pkgver/*_}-$_pkgarch.tar.bz2" \
    
      42            usr/lib/oss/lib/flashsupport.c
    
      43    gcc $CFLAGS -shared -fPIC -Wall -Werror \
    
      44            usr/lib/oss/lib/flashsupport.c -o libflashsupport.so
    
      45}
    
      46
    
      47package_libflashsupport-oss-nonfree() {
    
      48    pkgdesc="Adobe flash plugin support lib (OSSv4)"
    
      49    conflicts=(libflashsupport libflashsupport-oss libflashsupport-oss-git libflashsupport-pulse)
    
      50    depends=(oss)
    
      51
    
      52    install -dm755 "$pkgdir/usr/lib"
    
      53    ln -s oss/lib/libflashsupport.so "$pkgdir/usr/lib/libflashsupport.so"
    
      54}
    
      55
    
      56package_oss-nonfree() {
    
      57    pkgdesc="Open Sound System UNIX audio architecture (including nonfree drivers)"
    
      58    depends=(linux-headers)
    
      59    optdepends=('gtk2: for graphical mixer (ossxmix)'
    
      60                'libflashsupport-oss: Adobe flash plugin support')
    
      61    provides=(oss)
    
      62    conflicts=(oss oss-git libflashsupport-oss libflashsupport-oss-git)
    
      63    backup=(usr/lib/oss/soundon.user)
    
      64    install=oss.install
    
      65
    
      66    cd "$pkgdir"
    
      67    bsdtar xf "$srcdir/oss-linux-v${pkgver/_*}-${pkgver/*_}-$_pkgarch.tar.bz2"
    
      68    
    
      69    # remove outdated stuff
    
      70    patch -p0 < "$srcdir/rm-init-scripts.patch"
    
      71    rm usr/lib/oss/etc/S89oss
    
      72    patch -p0 < "$srcdir/remove-hal.patch"
    
      73    rm usr/lib/oss/scripts/*oss_usb-create-device*
    
      74    patch -p0 < "$srcdir/soundon.patch"
    
      75
    
      76    # usr-move fixes
    
      77    mv usr/sbin/* usr/bin
    
      78    rmdir usr/sbin
    
      79    grep -IlrZ '\<s\?bin\>' . \
    
      80            | xargs -0 sed -i 's,\<\(usr/\)\?s\?bin\>,usr/bin,g' --
    
      81        grep -IlrZ '\<lib/modules\>' . \
    
      82            | xargs -0 sed -i 's,\<\(usr/\)\?lib/modules\>,usr/&,g' --
    
      83
    
      84    # make OSS install its modules to /usr/lib/modules/$KERNEL/extramodules/oss
    
      85    # grep -IlrZ '\<usr/lib/modules/[^/]\+/kernel/oss\>' . \
    
      86    #        | xargs -0 sed -i 's,\<usr/lib/modules/\([^/]\+\)/kernel/oss\>,usr/lib/modules/\1/extramodules/oss,g' --
    
      87
    
      88    chmod -R a+rX .  # FS#13815
    
      89    install -Dm755 "$srcdir/libflashsupport.so" \
    
      90            usr/lib/oss/lib/libflashsupport.so
    
      91    install -Dm644 "$srcdir/LICENSE" "usr/share/licenses/$pkgname/LICENSE"
    
      92    install -Dm644 "$srcdir/oss.service" usr/lib/systemd/system/oss.service
    
      93}
    
      94

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2