smpeg0

maintainer YuriK7 · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is pulled from svn.icculus.org, which hosts the project's own upstream repository; building from a non-whitelisted but project-owned host with a SKIP'd checksum is a common AUR practice and poses low risk as it's the project's official source.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is pulled from svn.icculus.org, which hosts the project's own upstream repository; building from a non-whitelisted but project-owned host with a SKIP'd checksum is a common AUR practice and poses low risk as it's the project's official source.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("$pkgname-$pkgver::svn://svn.icculus.org/smpeg/tags/release_${pkgver//./_}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: yuri_k7 <riyu12383@gmail.com>
    
      2# Co-Maintainer Darren Ng <`base64 -d <<<aGMwbWV1QG5hdmVyLmNvbQo=`>
    
      3
    
      4# https://gitlab.archlinux.org/archlinux/packaging/packages/smpeg/-/blob/e9366f6f4b4026368b9cbc651d694d138437b9ea/PKGBUILD
    
      5# Contributor: Jan Alexander Steffens (heftig) <jan.steffens@gmail.com>
    
      6# Contributor: Eric Belanger <eric@archlinux.org>
    
      7# Contributor: Jan de Groot <jgc@archlinux.org>
    
      8
    
      9pkgname=smpeg0
    
      10pkgver=0.4.5
    
      11pkgrel=9
    
      12pkgdesc="SDL MPEG Player Library - Legacy version 0.4.5"
    
      13arch=($CARCH)
    
      14url=https://icculus.org/smpeg/
    
      15license=(LGPL-2.0-only)
    
      16makedepends=(subversion)
    
      17depends=(
    
      18	sh # smpeg-config
    
      19	"sdl>=1:1" "sdl<1:2" # provided by sdl12-compat over sdl2-compat over sdl3
    
      20	gcc-libs glibc glu libglvnd
    
      21)
    
      22source=("$pkgname-$pkgver::svn://svn.icculus.org/smpeg/tags/release_${pkgver//./_}")
    
      23sha256sums=(SKIP)
    
      24
    
      25prepare(){
    
      26
    
      27	cd $pkgname-$pkgver
    
      28
    
      29	# configure
    
      30	./autogen.sh
    
      31	local _C=(
    
      32	 ./configure
    
      33	 --prefix=/usr
    
      34	 --disable-gtk-player
    
      35	 --disable-gtktest
    
      36	 --enable-opengl-player
    
      37	 --with-x
    
      38	)
    
      39	"${_C[@]}"
    
      40
    
      41	# configure script is broken
    
      42	# configure script ignores flags
    
      43	# manually append flags
    
      44	export CFLAGS="$CFLAGS -std=c11"
    
      45	export CXXFLAGS="$CXXFLAGS -std=c++11 -Wno-error=narrowing"
    
      46	sed Makefile -i -e "/^CPPFLAGS/ s|$| $CPPFLAGS |g" # preprocessor
    
      47	sed Makefile -i -e "/^CFLAGS/   s|$| $CFLAGS   |g"
    
      48	sed Makefile -i -e "/^CXXFLAGS/ s|$| $CXXFLAGS |g"
    
      49	sed Makefile -i -e "/^LDFLAGS/  s|$| $LDFLAGS  |g"
    
      50
    
      51	# smpeg0 /usr/bin/plaympeg in conflict with smpeg
    
      52	sed plaympeg.1 -i -e "s/plaympeg/plaympeg0/g" -e "s/PLAYMPEG/PLAYMPEG0/g"
    
      53
    
      54}
    
      55
    
      56build() {
    
      57	make -C $pkgname-$pkgver
    
      58}
    
      59
    
      60package(){
    
      61
    
      62	make -C $pkgname-$pkgver DESTDIR="$pkgdir" install
    
      63
    
      64	cd "$pkgdir"/usr
    
      65	mv bin/plaympeg{,0}
    
      66
    
      67	cd share/man/man1
    
      68	rm gtv.1
    
      69	#sh
    
      70	mv plaympeg{,0}.1
    
      71
    
      72}
    
      73
    
      74# vim: set ai nosi noet ts=2 sts=2 sw=2:
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2