qmmp-svn

LOW

maintainer sl1pkn07 27 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source uses a Subversion checkout from a plausible project-owned SourceForge host, which is normal for development versions;虽非标准主机 but not inherently dangerous as it builds from source and the host is project-associated.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source uses a Subversion checkout from a plausible project-owned SourceForge host, which is normal for development versions;虽非标准主机 but not inherently dangerous as it builds from source and the host is project-associated.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:104 'qmmp::svn+http://svn.code.sf.net/p/qmmp-dev/code/trunk/qmmp'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gustavo Alvarez <sl1pkn07@gmail.com>
    
      2# Contributor: Reiser <metal@pop3.ru>
    
      3# Contributor: Andrew Panchenko <panchenkoac at gmail>
    
      4
    
      5pkgname=qmmp-svn
    
      6pkgver=2.3.0.svn.r12155
    
      7pkgrel=1
    
      8pkgdesc="A Qt based audio-player. (SVN Version)"
    
      9arch=('x86_64')
    
      10url='http://qmmp.ylsoftware.com'
    
      11license=('GPL')
    
      12depends=(
    
'gcc-libs' # 'libgcc_s.so' 'libstdc++.so'
    
'glibc' # 'libc.so' 'libm.so'
    
'libglvnd' 'libGL.so'
    
'libx11' # 'libX11.so'
    
'curl' 'libcurl.so'
    
'hicolor-icon-theme'
    
'qt6-base' # 'libQt6Core.so' 'libQt6DBus.so' 'libQt6Gui.so' 'libQt6Network.so' 'libQt6OpenGLWidgets.so' 'libQt6Sql.so' 'libQt6Widgets.so'
    
'taglib' # 'libtag.so'
    
'bash'
    
      22)
    
      23makedepends=(
    
'subversion'
    
'cmake'
    
'flac'
    
'jack'
    
'libmpcdec'
    
'libpulse'
    
'ffmpeg'
    
'libcdio-paranoia'
    
'libcdio'
    
'libcddb'
    
'enca'
    
'wildmidi'
    
'libgme'
    
'libmad'
    
'libvorbis'
    
'libogg'
    
'libmms'
    
'libsamplerate'
    
'libmodplug'
    
'libsndfile'
    
'wavpack'
    
'projectm'
    
'mesa'
    
'libsidplayfp'
    
'opusfile'
    
'faad2'
    
'libbs2b'
    
'taglib'
    
'alsa-lib'
    
'qt6-multimedia'
    
'qt6-tools'
    
'libarchive'
    
'libshout'
    
'mpg123'
    
'librcd'
    
'libxmp'
    
'libpipewire'
    
'libsoxr'
    
      62)
    
      63optdepends=(
    
'qmmp-plugin-pack-svn: for mpg123, ffap and qtui plugin'
    
'flac: native FLAC support'
    
'jack: JACK sound output'
    
'libmpcdec: Musepack support'
    
'alsa-lib: ALSA output suppport'
    
'libpulse: PulseAudio output support'
    
'libcdio-paranoia: Compact Disc input and control support'
    
'libcddb: CDDB server support'
    
'libmms: MMS stream protocol support'
    
'libmodplug: MOD playing library support'
    
'libsndfile: sampled sound support'
    
'projectm: visual efects support'
    
'ffmpeg: FFmpeg engine (include lot of audio formats) support'
    
'librcd: Used by FFmpeg plugin'
    
'mplayer: Mplayer engine (include lot of audio formats) support'
    
'libsamplerate: audio filter support'
    
'libbs2b: audio filter support'
    
'wavpack: WavPack audio support'
    
'libsidplayfp: SID audio support'
    
'opusfile: OPUS audio support'
    
'enca: CUEsheet audio and text encoding support'
    
'wildmidi: native MIDI audio support'
    
'faad2: native AAC audio support'
    
'libgme: video game music format suppoort'
    
'libmad: MPEG audio decoder support'
    
'libvorbis: Vorbis audio support'
    
'libogg: OGG audio support'
    
'qt6-multimedia: Qt media output support'
    
'libarchive: libarchive input support'
    
'libshout: shoutcast/icecast input support'
    
'mpg123: alternative Mpeg-1-2-3 support'
    
'libxmp: XMP input support'
    
'libpipewire: Pipewire output support'
    
      97)
    
      98provides=(
    
"qmmp=${pkgver}"
    
'libqmmp.so' 'libqmmpui.so'
    
      101)
    
      102conflicts=('qmmp')
    
      103source=(
    
'qmmp::svn+http://svn.code.sf.net/p/qmmp-dev/code/trunk/qmmp'
    
'pkgconfig_fix.diff'
    
      106)
    
      107sha256sums=(
    
'SKIP'
    
'40625618c2ea7aaabbb270f6aa2a464101856e21f5bb056ae520e9a292c62475'
    
      110)
    
      111options=('debug')
    
      112
    
      113pkgver() {
    
cd qmmp
    
_ver="$(cat src/qmmp/qmmp.h | grep -m3 -e "define QMMP_VERSION_MAJOR" -e "define QMMP_VERSION_MINOR" -e "define QMMP_VERSION_PATCH" | grep -o "[[:digit:]]*" | paste -sd'.')"
    
echo "${_ver}.svn.r$(svnversion | tr -d M | tr : .)"
    
      117}
    
      118
    
      119prepare() {
    
patch -d qmmp -p0 -i "${srcdir}/pkgconfig_fix.diff"
    
      121}
    
      122
    
      123build() {
    
cmake -S qmmp -B build \
    
  -DCMAKE_BUILD_TYPE=Release \
    
  -DCMAKE_INSTALL_PREFIX=/usr \
    
  -DUSE_LIBRCD=ON
    
      128
    
cmake --build build
    
      130}
    
      131
    
      132package() {
    
DESTDIR="${pkgdir}" cmake --install build
    
      134}
    
      135

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2