replay-sorcery

maintainer danielneves · 13 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own git repository and a well-known libbacktrace fork, with one patch applied; the SKIP'd checksum for a submodule is a minor quality issue but does not introduce a meaningful supply-chain risk as it is a standard library and the main project source is verified.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own git repository and a well-known libbacktrace fork, with one patch applied; the SKIP'd checksum for a submodule is a minor quality issue but does not introduce a meaningful supply-chain risk as it is a standard library and the main project source is verified.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer:
    
      2
    
      3_pkgname="replay-sorcery"
    
      4pkgname="$_pkgname"
    
      5pkgver=0.6.0
    
      6pkgrel=3
    
      7pkgdesc='Open-source, instant-replay solution for Linux'
    
      8url='https://github.com/matanui159/ReplaySorcery'
    
      9license=('GPL-3.0-or-later')
    
      10arch=('x86_64' 'i686')
    
      11
    
      12depends=(
    
      13  'ffmpeg4.4'
    
      14  'libdrm'
    
      15  'libpulse'
    
      16  'libx11'
    
      17)
    
      18makedepends=(
    
      19  'cmake'
    
      20  'git'
    
      21)
    
      22
    
      23backup=("etc/$_pkgname.conf")
    
      24
    
      25_pkgsrc="$_pkgname"
    
      26source=(
    
      27  "$_pkgsrc"::"git+$url.git#tag=$pkgver"
    
      28  'libbacktrace'::'git+https://github.com/ianlancetaylor/libbacktrace.git'
    
      29  '0000-include-avutil-ch-layout.patch'
    
      30)
    
      31sha256sums=(
    
      32  '7b455b526c13eb515521278941e446674b3a5c33de4233eee4a144e34fdb912b'
    
      33  'SKIP'
    
      34  '5404e7d26db1eb8e051844d65c2182f9dfac813243d093ea8e4c4ae97bc548da'
    
      35)
    
      36
    
      37prepare() {
    
      38  cd "$_pkgsrc"
    
      39  git submodule init
    
      40  git config submodule."dep/libbacktrace".url ../libbacktrace
    
      41  git -c protocol.file.allow=always submodule update
    
      42
    
      43  local src
    
      44  for src in "${source[@]}"; do
    
      45    src="${src%%::*}"
    
      46    src="${src##*/}"
    
      47    src="${src%.zst}"
    
      48    if [[ $src == *.patch ]]; then
    
      49      printf '\nApplying patch: %s\n' "$src"
    
      50      patch -Np1 -F100 -i "${srcdir:?}/$src"
    
      51    fi
    
      52  done
    
      53
    
      54  # move global config to /etc
    
      55  sed -e '/RS_BUILD_GLOBAL_CONFIG/c #define RS_BUILD_GLOBAL_CONFIG "/etc/replay-sorcery.conf"' -i src/rsbuild.h.in
    
      56  sed -E -e '/replay-sorcery.conf/s&(DESTINATION) etc&\1 /etc&' -i CMakeLists.txt
    
      57}
    
      58
    
      59build() {
    
      60  export PKG_CONFIG_PATH='/usr/lib/ffmpeg4.4/pkgconfig'
    
      61
    
      62  local _cmake_options=(
    
      63    -B build
    
      64    -S "$_pkgsrc"
    
      65    -DCMAKE_BUILD_TYPE=Release
    
      66    -DCMAKE_INSTALL_PREFIX='/usr'
    
      67    -Wno-dev
    
      68  )
    
      69
    
      70  cmake "${_cmake_options[@]}"
    
      71  cmake --build build
    
      72}
    
      73
    
      74package() {
    
      75  DESTDIR="$pkgdir" cmake --install build
    
      76}
    
      77

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,15 +3,14 @@
 _pkgname="replay-sorcery"
 pkgname="$_pkgname"
 pkgver=0.6.0
-pkgrel=2
+pkgrel=3
 pkgdesc='Open-source, instant-replay solution for Linux'
 url='https://github.com/matanui159/ReplaySorcery'
-license=(GPL-3.0-or-later)
+license=('GPL-3.0-or-later')
 arch=('x86_64' 'i686')
 
 depends=(
   'ffmpeg4.4'
-  'gcc-libs'
   'libdrm'
   'libpulse'
   'libx11'
@@ -21,6 +20,8 @@
   'git'
 )
 
+backup=("etc/$_pkgname.conf")
+
 _pkgsrc="$_pkgname"
 source=(
   "$_pkgsrc"::"git+$url.git#tag=$pkgver"
@@ -28,26 +29,17 @@
   '0000-include-avutil-ch-layout.patch'
 )
 sha256sums=(
-  'SKIP'
+  '7b455b526c13eb515521278941e446674b3a5c33de4233eee4a144e34fdb912b'
   'SKIP'
   '5404e7d26db1eb8e051844d65c2182f9dfac813243d093ea8e4c4ae97bc548da'
 )
 
 prepare() {
   cd "$_pkgsrc"
+  git submodule init
+  git config submodule."dep/libbacktrace".url ../libbacktrace
+  git -c protocol.file.allow=always submodule update
 
-  # submodules for replay-sorcery
-  local _submodules=(
-    'libbacktrace'::'dep/libbacktrace'
-  )
-  local _module
-  for _module in "${_submodules[@]}"; do
-    git submodule init "${_module##*::}"
-    git submodule set-url "${_module##*::}" "$srcdir/${_module%::*}"
-    git -c protocol.file.allow=always submodule update "${_module##*::}"
-  done
-
-  # apply patches
   local src
   for src in "${source[@]}"; do
     src="${src%%::*}"
@@ -58,6 +50,10 @@
       patch -Np1 -F100 -i "${srcdir:?}/$src"
     fi
   done
+
+  # move global config to /etc
+  sed -e '/RS_BUILD_GLOBAL_CONFIG/c #define RS_BUILD_GLOBAL_CONFIG "/etc/replay-sorcery.conf"' -i src/rsbuild.h.in
+  sed -E -e '/replay-sorcery.conf/s&(DESTINATION) etc&\1 /etc&' -i CMakeLists.txt
 }
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 11:11:22	MEDIUM	1
2026-07-14 01:43:48	CLEAN	0
2026-06-18 16:11:54	CLEAN	0