pcompress-git

LOW

maintainer bartus 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The non-standard host is wavpack.com, which is the official project site for WavPack; the download is a standard source tarball with a verifiable checksum, used as a legitimate dependency for building the software.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is wavpack.com, which is the official project site for WavPack; the download is a standard source tarball with a verifiable checksum, used as a legitimate dependency for building the software.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "http://wavpack.com/wavpack-${_wavpack_ver}.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1#!/bin/hint/bash
    
      2# Maintainer : bartus <arch-user-repoᘓbartus.33mail.com>
    
      3# Contributor: "UnCO Lin" <trash__box <at> 163.com>
    
      4# Contributor: PLum <plum.michalski <at> gmail.com>
    
      5
    
      6pkgname=pcompress-git
    
      7_pkgname=pcompress
    
      8pkgver=3.1Bugfix.r75.gc6e779c
    
      9_wavpack_ver=4.70.0
    
      10pkgrel=1
    
      11epoch=1
    
      12arch=(x86_64)
    
      13pkgdesc="Utility to do compression/decompression and deduplication in parallel by splitting input data into chunks."
    
      14url="https://moinakg.github.io/pcompress/"
    
      15license=(LGPL3)
    
      16depends=(bzip2 zlib openssl-1.0)
    
      17makedepends=(git yasm)
    
      18options=(!makeflags)
    
      19source=("git+https://github.com/moinakg/${_pkgname}.git"
    
      20        "http://wavpack.com/wavpack-${_wavpack_ver}.tar.bz2"
    
      21        "openssl.patch::https://github.com/moinakg/pcompress/pull/55.patch"
    
      22        "gcc11.patch::https://github.com/moinakg/pcompress/pull/56.patch"
    
      23        "advance_opts.patch")
    
      24sha256sums=('SKIP'
    
      25            '2cade379b0aba99fbc4e442ccc6dac6c609f6212e46516a083e24c8c364430a4'
    
      26            '6138cd04fe61ebfbe8f43ecf81a0f9e986a8ef4d2bffc474ee3622a33088699e'
    
      27            '4e246ab296ccdab436d66dc356b2e41700f334f4ccbe04c914eafd9c2dbaade6'
    
      28            '0dfbad3cb21260e90196ab6bda653480ae38cb01c35eef834242b5cff73eaccb')
    
      29
    
      30pkgver() {
    
      31  cd "$_pkgname"
    
      32  git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      33}
    
      34
    
      35prepare() {
    
      36  cd "$_pkgname"
    
      37  git apply -v "${srcdir}"/{openssl,gcc11,advance_opts}.patch
    
      38}
    
      39
    
      40build() {
    
      41  cd "$_pkgname"
    
      42
    
      43# ./config flags:
    
      44# --prefix=<val>          The installation prefix (default: /usr).
    
      45# --enable-debug          Enable debug mode compilation (default: disabled).
    
      46# --disable-allocator     Disable use of internal memory allocator mechanism (default: enabled).
    
      47# --enable-debug-stats    Enable printing of some verbose debug info (default: disabled).
    
      48# --with-openssl=<path to OpenSSL installation tree> (Default: System)
    
      49# --with-zlib=<path to zlib installation tree> (Default: System)
    
      50# --with-bzlib=<path to Bzip2 library installation tree> (Default: System)
    
      51# --with-external-libbsc=<path to libbsc source tree>
    
      52# --wavpack-dir=<path to WavPack source tree>
    
      53# --disable-wavpack       Disables the WavPack filter.
    
      54# --no-sse-detect         Do NOT attempt to probe the system`s SSE capability for build flags.
    
      55# --no-avx-detect         Do NOT attempt to probe the system's AVX capability for build flags.
    
      56# --no-1.3-archive-compat Disable compatibility with compressed archives created with Pcompress
    
      57# --limit-key128          Limit key length to 128-bit encryption keys.
    
      58
    
      59  if check_option "debug" "y"; then
    
      60    _config_flags+=( --enable-debug{,-stats} )
    
      61  fi
    
      62  ./config --prefix=/usr \
    
      63    --wavpack-dir="$srcdir"/wavpack-${_wavpack_ver} \
    
      64    --with-openssl-incdir="/usr/include/openssl-1.0" \
    
      65    --with-openssl-libdir="/usr/lib/openssl-1.0" \
    
      66    "${_config_flags[@]}"
    
      67  make
    
      68}
    
      69
    
      70package() {
    
      71  cd "$_pkgname"
    
      72  make DESTDIR="${pkgdir}" install
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2