shadps4-git

maintainer abouvier · 15 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package clones source code from GitHub and other public repositories to build the emulator from source; these are the project's own dependencies, and building from git is normal for -git AUR packages, so the non-standard hosts (like android.googlesource.com) are legitimate sources for upstream code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package clones source code from GitHub and other public repositories to build the emulator from source; these are the project's own dependencies, and building from git is normal for -git AUR packages, so the non-standard hosts (like android.googlesource.com) are legitimate sources for upstream code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:70 "aac::git+https://android.googlesource.com/platform/external/aac.git"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alexandre Bouvier <contact@amb.tf>
    
      2_pkgname=shadps4
    
      3pkgname=$_pkgname-git
    
      4pkgver=0.17.0.r5.g65c9463
    
      5pkgrel=1
    
      6pkgdesc="Sony PlayStation 4 emulator (CLI)"
    
      7arch=('aarch64' 'x86_64')
    
      8url="https://shadps4.net/"
    
      9license=('GPL-2.0-or-later')
    
      10depends=(
    
'abseil-cpp' # protobuf dependency
    
'glibc'
    
'glslang>=15'
    
'miniz>=3.1'
    
'pugixml>=1.14'
    
'sdl3>=3.3.5'
    
      17)
    
      18makedepends=(
    
'boost>=1.84'
    
'cli11>=2.6.1'
    
'cmake>=3.16.3'
    
'ffmpeg>=2:5.1.2'
    
'fmt>=12'
    
'freetype2>=2.14.1'
    
'git'
    
'half>=1.12'
    
'libgcc'
    
'libpng>=1.6'
    
'libstdc++'
    
'magic_enum>=0.9.7'
    
'miniupnpc>=2.3.3'
    
'nlohmann-json>=3.12'
    
'openal'
    
'openssl'
    
'rapidjson'
    
'renderdoc'
    
'robin-map>=1.3'
    
'spirv-headers' # sirit dependency
    
'stb'
    
'systemd-libs'
    
'toml11>=4.2'
    
'util-linux-libs'
    
'vulkan-headers>=1:1.4.330'
    
'vulkan-memory-allocator>=3.1'
    
'xbyak>=7.07'
    
'xxhash>=0.8.2'
    
'zarchive>=0.1.2'
    
'zlib'
    
'zycore-c' # zydis dependency
    
      50)
    
      51optdepends=(
    
'renderdoc: for graphics debugging'
    
'shadps4-qtlauncher: for official Qt GUI'
    
'vulkan-validation-layers: for vulkan debugging'
    
      55)
    
      56provides=("$_pkgname=$pkgver")
    
      57conflicts=("$_pkgname")
    
      58source=(
    
"$_pkgname::git+https://github.com/shadps4-emu/shadPS4.git"
    
"$_pkgname-cpp-httplib::git+https://github.com/shadexternals/cpp-httplib.git"
    
"$_pkgname-discord-rpc::git+https://github.com/shadps4-emu/ext-discord-rpc.git"
    
"$_pkgname-hwinfo::git+https://github.com/shadps4-emu/ext-hwinfo.git"
    
"$_pkgname-imgui::git+https://github.com/shadps4-emu/ext-imgui.git"
    
"$_pkgname-imguifiledialog::git+https://github.com/shadexternals/ImGuiFileDialog.git"
    
"$_pkgname-libatrac9::git+https://github.com/shadps4-emu/ext-LibAtrac9.git"
    
"$_pkgname-libusb::git+https://github.com/shadexternals/libusb.git"
    
"$_pkgname-protobuf::git+https://github.com/shadexternals/protobuf.git"
    
"$_pkgname-sirit::git+https://github.com/shadps4-emu/sirit.git"
    
"$_pkgname-tracy::git+https://github.com/shadps4-emu/tracy.git"
    
"aac::git+https://android.googlesource.com/platform/external/aac.git"
    
"minimp3::git+https://github.com/lieff/minimp3.git"
    
"spdlog::git+https://github.com/gabime/spdlog.git"
    
"zydis::git+https://github.com/zyantific/zydis.git"
    
      74)
    
      75b2sums=('SKIP'{,,,,,,,,,,,,,,})
    
      76
    
      77pkgver() {
    
cd $_pkgname
    
git describe --long --abbrev=7 | sed 's/^v\.\?//;s/[^-]*-g/r&/;s/-/./g'
    
      80}
    
      81
    
      82prepare() {
    
cd $_pkgname
    
git config submodule.externals/aacdec/fdk-aac.url ../aac
    
git config submodule.externals/cpp-httplib.url ../$_pkgname-cpp-httplib
    
git config submodule.externals/dear_imgui.url ../$_pkgname-imgui
    
git config submodule.externals/discord-rpc.url ../$_pkgname-discord-rpc
    
git config submodule.externals/hwinfo.url ../$_pkgname-hwinfo
    
git config submodule.externals/ImGuiFileDialog.url ../$_pkgname-imguifiledialog
    
git config submodule.externals/LibAtrac9.url ../$_pkgname-libatrac9
    
git config submodule.externals/libusb.url ../$_pkgname-libusb
    
git config submodule.externals/minimp3.url ../minimp3
    
git config submodule.externals/protobuf.url ../$_pkgname-protobuf
    
git config submodule.externals/sirit.url ../$_pkgname-sirit
    
git config submodule.externals/spdlog.url ../spdlog
    
git config submodule.externals/tracy.url ../$_pkgname-tracy
    
git config submodule.externals/zydis.url ../zydis
    
git -c protocol.file.allow=always submodule update
    
# use makepkg.conf flags
    
sed -i '/-march=/d' CMakeLists.txt
    
# use system abseil-cpp
    
sed -i '/protobuf/s/FORCE_FETCH_DEPENDENCIES/LOCAL_DEPENDENCIES_ONLY/' externals/CMakeLists.txt
    
# use system glslang
    
sed -i '/find_package/s/glslang 15/glslang/' CMakeLists.txt
    
# use system openssl
    
sed -i 's/LibreSSL.*MODULE/OpenSSL CONFIG/' CMakeLists.txt
    
      107}
    
      108
    
      109build() {
    
local options=(
    
-B ../build
    
-D CMAKE_BUILD_TYPE=Release
    
-D CMAKE_C_FLAGS_RELEASE="-DNDEBUG"
    
-D CMAKE_CXX_FLAGS_RELEASE="-DNDEBUG"
    
-D CMAKE_INSTALL_PREFIX=/usr
    
-D CMAKE_SKIP_INSTALL_RPATH=ON
    
-D ENABLE_SYSTEM_LIBRARIES=ON
    
-D ENABLE_UPDATER=OFF
    
-D SIRIT_USE_SYSTEM_SPIRV_HEADERS=ON
    
-W no-dev
    
)
    
cd $_pkgname
    
cmake "${options[@]}"
    
cmake --build ../build
    
      125}
    
      126
    
      127package() {
    
depends+=(
    
'libavcodec.so'
    
'libavformat.so'
    
'libavutil.so'
    
'libcrypto.so'
    
'libfmt.so'
    
'libfreetype.so'
    
'libgcc_s.so'
    
'libminiupnpc.so'
    
'libopenal.so'
    
'libpng16.so'
    
'libssl.so'
    
'libstdc++.so'
    
'libswresample.so'
    
'libswscale.so'
    
'libudev.so'
    
'libuuid.so'
    
'libxxhash.so'
    
'libz.so'
    
'libzarchive.so'
    
)
    
      149
    
# shellcheck disable=SC2154
    
DESTDIR="$pkgdir" cmake --install build
    
      152}
    
      153

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Alexandre Bouvier <contact@amb.tf>
 _pkgname=shadps4
 pkgname=$_pkgname-git
-pkgver=0.16.0.r109.gdb43acc
+pkgver=0.17.0.r5.g65c9463
 pkgrel=1
 pkgdesc="Sony PlayStation 4 emulator (CLI)"
 arch=('aarch64' 'x86_64')
@@ -35,7 +35,7 @@
 	'rapidjson'
 	'renderdoc'
 	'robin-map>=1.3'
-	'spirv-headers'
+	'spirv-headers' # sirit dependency
 	'stb'
 	'systemd-libs'
 	'toml11>=4.2'
@@ -44,6 +44,7 @@
 	'vulkan-memory-allocator>=3.1'
 	'xbyak>=7.07'
 	'xxhash>=0.8.2'
+	'zarchive>=0.1.2'
 	'zlib'
 	'zycore-c' # zydis dependency
 )
@@ -56,6 +57,7 @@
 conflicts=("$_pkgname")
 source=(
 	"$_pkgname::git+https://github.com/shadps4-emu/shadPS4.git"
+	"$_pkgname-cpp-httplib::git+https://github.com/shadexternals/cpp-httplib.git"
 	"$_pkgname-discord-rpc::git+https://github.com/shadps4-emu/ext-discord-rpc.git"
 	"$_pkgname-hwinfo::git+https://github.com/shadps4-emu/ext-hwinfo.git"
 	"$_pkgname-imgui::git+https://github.com/shadps4-emu/ext-imgui.git"
@@ -70,7 +72,7 @@
 	"spdlog::git+https://github.com/gabime/spdlog.git"
 	"zydis::git+https://github.com/zyantific/zydis.git"
 )
-b2sums=('SKIP'{,,,,,,,,,,,,,})
+b2sums=('SKIP'{,,,,,,,,,,,,,,})
 
 pkgver() {
 	cd $_pkgname
@@ -80,6 +82,7 @@
 prepare() {
 	cd $_pkgname
 	git config submodule.externals/aacdec/fdk-aac.url ../aac
+	git config submodule.externals/cpp-httplib.url ../$_pkgname-cpp-httplib
 	git config submodule.externals/dear_imgui.url ../$_pkgname-imgui
 	git config submodule.externals/discord-rpc.url ../$_pkgname-discord-rpc
 	git config submodule.externals/hwinfo.url ../$_pkgname-hwinfo
@@ -126,18 +129,22 @@
 		'libavcodec.so'
 		'libavformat.so'
 		'libavutil.so'
+		'libcrypto.so'
 		'libfmt.so'
 		'libfreetype.so'
 		'libgcc_s.so'
 		'libminiupnpc.so'
 		'libopenal.so'
 		'libpng16.so'
+		'libssl.so'
 		'libstdc++.so'
 		'libswresample.so'
 		'libswscale.so'
 		'libudev.so'
 		'libuuid.so'
 		'libxxhash.so'
+		'libz.so'
+		'libzarchive.so'
 	)
 
 	# shellcheck disable=SC2154

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 05:20:08	MEDIUM	1
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2