svp-bin

maintainer C0rn3j · 59 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from the project's official and plausibly owned domains (svp-team.com, cdn.svp-team.com), which is normal for AUR packages; the non-whitelisted hosts are subdomains of the official project, so the risk is low despite the static analyzer flag.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official and plausibly owned domains (svp-team.com, cdn.svp-team.com), which is normal for AUR packages; the non-whitelisted hosts are subdomains of the official project, so the risk is low despite the static analyzer flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 "https://www.svp-team.com/files/svp4-linux.${_pkgver}.tar.bz2"
PKGBUILD:41 "svp-${pkgver}_core.full_4.7.0.305-4libs.7z::http://cdn.svp-team.com/repo/full-lin64/core.full/4.7.0.305-4libs.7z"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Martin Rys <rys.rs/contact>
    
      2# Maintainer: phiresky <phireskyde+git@gmail.com>
    
      3_pkgname=svp
    
      4pkgname=svp-bin
    
      5pkgver=4.7.305
    
      6_pkgver=${pkgver}-1
    
      7pkgrel=2
    
      8epoch=
    
      9pkgdesc="SmoothVideo Project 4 (SVP4)"
    
      10arch=('x86_64')
    
      11url="https://www.svp-team.com/wiki/SVP:Linux"
    
      12license=('LicenseRef-custom')
    
      13depends=(
    
      14	libmediainfo
    
      15	libusb
    
      16	lsof
    
      17	vapoursynth
    
      18	qt6-svg
    
      19	#qt5-script
    
      20	#qt5-declarative
    
      21	xdg-utils
    
      22)
    
      23makedepends=(p7zip)
    
      24# Youtube-dl is bundled with SVP in extensions directory
    
      25optdepends=(
    
      26	'mpv: Video player'
    
      27	'ocl-icd: for GPU acceleration'
    
      28	'python38: SVPTube extension - Basic support'
    
      29	'python-certifi: youtube-dl extension - Basic support'
    
      30	'python-pycryptodomex: youtube-dl extension - For decrypting AES-128 HLS streams and various other data'
    
      31	'python-websockets: youtube-dl extension - For downloading over websocket'
    
      32	'vlc: Video player'
    
      33)
    
      34provides=('svp')
    
      35conflicts=('svp')
    
      36options=(!strip)
    
      37install=${pkgname}.install
    
      38#source=("https://gist.githubusercontent.com/phiresky/1e2cbd30bed4e5978771af232d11afd1/raw/svp4-linux.$pkgver.tar.bz2")
    
      39source=(
    
      40	"https://www.svp-team.com/files/svp4-linux.${_pkgver}.tar.bz2"
    
      41	"svp-${pkgver}_core.full_4.7.0.305-4libs.7z::http://cdn.svp-team.com/repo/full-lin64/core.full/4.7.0.305-4libs.7z"
    
      42	"svp-${pkgver}_core.full_4.7.0.305-4licenses.7z::http://cdn.svp-team.com/repo/full-lin64/core.full/4.7.0.305-4licenses.7z"
    
      43	"svp-${pkgver}_core.full_4.7.0.305-4content.7z::http://cdn.svp-team.com/repo/full-lin64/core.full/4.7.0.305-4content.7z"
    
      44)
    
      45# I am rehosting the binaries taken from
    
      46# http://www.svp-team.com/files/svp4-linux-64.tbz2
    
      47# at https://gist.github.com/phiresky/1e2cbd30bed4e5978771af232d11afd1
    
      48# so they are correctly versioned and old versions still exist
    
      49# update 2019-10-06: svp-team.com now uses versioned file names.
    
      50# I'll keep rehosting them for now since i don't trust them to actually keep old versions.
    
      51sha256sums=('6bd83a03ac43cb1efb0e252d12bc379cb6e8b6037b4b4973017ce977b1b2925e'
    
      52            '0aed687ef7bd42defce26877eeb4cb93832fdb7ca0efb56260bf14c25f0a3bf7'
    
      53            '5dff7f52352a30c2cf4816d156ce802281c0a6e20e1df474bda77942c1202b21'
    
      54            '60af0f39286a9edb37bdaa5ec802e5fd6874060d79ff49880df1c360bf65a401')
    
      55
    
      56# The installer GUI has an option to install a bunch of packages, which are gotten from here:
    
      57# http://cdn.svp-team.com/repo/full-lin64/Updates.xml   -> https://www.svp-team.com/files/repo/full-lin64/Updates.xml?full=main
    
      58# http://cdn.svp-team.com/repo/common-lin64/Updates.xml -> https://www.svp-team.com/files/repo/common-lin64/Updates.xml?full=main
    
      59
    
      60# The download links then look like this:
    
      61# http://cdn.svp-team.com/repo/full-lin64/core.vlc/1.1.0.300meta.7z
    
      62# http://cdn.svp-team.com/repo/common-lin64/deps.python/3.12.11meta.7z
    
      63
    
      64# Get full component list via `strings svp4-maintenance.dat | grep installer: | sort -u` after running the svp4-maintenance tool
    
      65# This needs you to run the .run file as it generates the svp-maintenance files, I'm not sure how those would be extracted if it's even feasible
    
      66
    
      67prepare() {
    
      68	mkdir -p svp_updates
    
      69
    
      70	# Extract each update archive into a single directory
    
      71	7z x "svp-${pkgver}_core.full_4.7.0.305-4libs.7z"     -osvp_updates
    
      72	7z x "svp-${pkgver}_core.full_4.7.0.305-4licenses.7z" -osvp_updates
    
      73	7z x "svp-${pkgver}_core.full_4.7.0.305-4content.7z"  -osvp_updates
    
      74
    
      75	rm -rf "${srcdir}/installer"
    
      76	mkdir "${srcdir}/installer"
    
      77	echo "Finding 7z archives in installer..."
    
      78	LANG=C grep --only-matching --byte-offset --binary --text $'7z\xBC\xAF\x27\x1C' "${srcdir}/svp4-linux.run" |
    
      79		cut -f1 -d: |
    
      80		while read ofs; do
    
      81			dd if="${srcdir}/svp4-linux.run" bs=1M iflag=skip_bytes status=none skip="${ofs}" of="${srcdir}/installer/bin-${ofs}.7z"
    
      82		done
    
      83
    
      84	echo "Extracting 7z archives from installer..."
    
      85	for f in "${srcdir}/installer/"*.7z; do
    
      86		7z -bd -bb0 -y x -o"${srcdir}/extracted/" "${f}" || true
    
      87	done
    
      88}
    
      89
    
      90#pkgver() {
    
      91#	xmllint --xpath '/Updates/PackageUpdate[Name="core.full"]/Version/text()' "$srcdir/installer/metadata/Updates.xml" | tr '-' '.'
    
      92#}
    
      93
    
      94package() {
    
      95	mkdir -p "${pkgdir}"/{opt/svp,usr/bin,usr/share/licenses/${pkgname}}
    
      96	if [[ -d "${srcdir}/extracted/licenses" ]]; then
    
      97		mv "${srcdir}/extracted/licenses" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      98	fi
    
      99	mv "${srcdir}/extracted/"* "${pkgdir}/opt/${_pkgname}"
    
      100	# rm "$pkgdir/opt/$pkgname/extensions/libsvpcode.so" # previously this extension caused the whole thing to segfault. lmk if that's still the case
    
      101	ln -s "/opt/${_pkgname}/SVPManager" "${pkgdir}/usr/bin/SVPManager"
    
      102	chmod -R +rX "${pkgdir}/opt/svp" "${pkgdir}/usr/share"
    
      103
    
      104	# Apply updated files
    
      105	cp -a "${srcdir}/svp_updates/"* "${pkgdir}/opt/${_pkgname}/"
    
      106}
    
      107

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2