svp-bin
LOW
maintainer C0rn3j
58 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt binaries from the project's official and plausibly owned domains (svp-team.com, cdn.svp-team.com), which is normal for AUR packages; the non-whitelisted hosts are subdomains of the official project, so the risk is low despite the static analyzer flag.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official and plausibly owned domains (svp-team.com, cdn.svp-team.com), which is normal for AUR packages; the non-whitelisted hosts are subdomains of the official project, so the risk is low despite the static analyzer flag.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:40
"https://www.svp-team.com/files/svp4-linux.${_pkgver}.tar.bz2" -
PKGBUILD:41
"svp-${pkgver}_core.full_4.7.0.305-4libs.7z::http://cdn.svp-team.com/repo/full-lin64/core.full/4.7.0.305-4libs.7z"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Martin Rys <rys.rs/contact>
2
# Maintainer: phiresky <phireskyde+git@gmail.com>
3
_pkgname=svp
4
pkgname=svp-bin
5
pkgver=4.7.305
6
_pkgver=${pkgver}-1
7
pkgrel=2
8
epoch=
9
pkgdesc="SmoothVideo Project 4 (SVP4)"
10
arch=('x86_64')
11
url="https://www.svp-team.com/wiki/SVP:Linux"
12
license=('LicenseRef-custom')
13
depends=(
14
libmediainfo
15
libusb
16
lsof
17
vapoursynth
18
qt6-svg
19
#qt5-script
20
#qt5-declarative
21
xdg-utils
22
)
23
makedepends=(p7zip)
24
# Youtube-dl is bundled with SVP in extensions directory
25
optdepends=(
26
'mpv: Video player'
27
'ocl-icd: for GPU acceleration'
28
'python38: SVPTube extension - Basic support'
29
'python-certifi: youtube-dl extension - Basic support'
30
'python-pycryptodomex: youtube-dl extension - For decrypting AES-128 HLS streams and various other data'
31
'python-websockets: youtube-dl extension - For downloading over websocket'
32
'vlc: Video player'
33
)
34
provides=('svp')
35
conflicts=('svp')
36
options=(!strip)
37
install=${pkgname}.install
38
#source=("https://gist.githubusercontent.com/phiresky/1e2cbd30bed4e5978771af232d11afd1/raw/svp4-linux.$pkgver.tar.bz2")
39
source=(
40
"https://www.svp-team.com/files/svp4-linux.${_pkgver}.tar.bz2"
41
"svp-${pkgver}_core.full_4.7.0.305-4libs.7z::http://cdn.svp-team.com/repo/full-lin64/core.full/4.7.0.305-4libs.7z"
42
"svp-${pkgver}_core.full_4.7.0.305-4licenses.7z::http://cdn.svp-team.com/repo/full-lin64/core.full/4.7.0.305-4licenses.7z"
43
"svp-${pkgver}_core.full_4.7.0.305-4content.7z::http://cdn.svp-team.com/repo/full-lin64/core.full/4.7.0.305-4content.7z"
44
)
45
# I am rehosting the binaries taken from
46
# http://www.svp-team.com/files/svp4-linux-64.tbz2
47
# at https://gist.github.com/phiresky/1e2cbd30bed4e5978771af232d11afd1
48
# so they are correctly versioned and old versions still exist
49
# update 2019-10-06: svp-team.com now uses versioned file names.
50
# I'll keep rehosting them for now since i don't trust them to actually keep old versions.
51
sha256sums=('6bd83a03ac43cb1efb0e252d12bc379cb6e8b6037b4b4973017ce977b1b2925e'
52
'0aed687ef7bd42defce26877eeb4cb93832fdb7ca0efb56260bf14c25f0a3bf7'
53
'5dff7f52352a30c2cf4816d156ce802281c0a6e20e1df474bda77942c1202b21'
54
'60af0f39286a9edb37bdaa5ec802e5fd6874060d79ff49880df1c360bf65a401')
55
56
# The installer GUI has an option to install a bunch of packages, which are gotten from here:
57
# http://cdn.svp-team.com/repo/full-lin64/Updates.xml -> https://www.svp-team.com/files/repo/full-lin64/Updates.xml?full=main
58
# http://cdn.svp-team.com/repo/common-lin64/Updates.xml -> https://www.svp-team.com/files/repo/common-lin64/Updates.xml?full=main
59
60
# The download links then look like this:
61
# http://cdn.svp-team.com/repo/full-lin64/core.vlc/1.1.0.300meta.7z
62
# http://cdn.svp-team.com/repo/common-lin64/deps.python/3.12.11meta.7z
63
64
# Get full component list via `strings svp4-maintenance.dat | grep installer: | sort -u` after running the svp4-maintenance tool
65
# This needs you to run the .run file as it generates the svp-maintenance files, I'm not sure how those would be extracted if it's even feasible
66
67
prepare() {
68
mkdir -p svp_updates
69
70
# Extract each update archive into a single directory
71
7z x "svp-${pkgver}_core.full_4.7.0.305-4libs.7z" -osvp_updates
72
7z x "svp-${pkgver}_core.full_4.7.0.305-4licenses.7z" -osvp_updates
73
7z x "svp-${pkgver}_core.full_4.7.0.305-4content.7z" -osvp_updates
74
75
rm -rf "${srcdir}/installer"
76
mkdir "${srcdir}/installer"
77
echo "Finding 7z archives in installer..."
78
LANG=C grep --only-matching --byte-offset --binary --text $'7z\xBC\xAF\x27\x1C' "${srcdir}/svp4-linux.run" |
79
cut -f1 -d: |
80
while read ofs; do
81
dd if="${srcdir}/svp4-linux.run" bs=1M iflag=skip_bytes status=none skip="${ofs}" of="${srcdir}/installer/bin-${ofs}.7z"
82
done
83
84
echo "Extracting 7z archives from installer..."
85
for f in "${srcdir}/installer/"*.7z; do
86
7z -bd -bb0 -y x -o"${srcdir}/extracted/" "${f}" || true
87
done
88
}
89
90
#pkgver() {
91
# xmllint --xpath '/Updates/PackageUpdate[Name="core.full"]/Version/text()' "$srcdir/installer/metadata/Updates.xml" | tr '-' '.'
92
#}
93
94
package() {
95
mkdir -p "${pkgdir}"/{opt/svp,usr/bin,usr/share/licenses/${pkgname}}
96
if [[ -d "${srcdir}/extracted/licenses" ]]; then
97
mv "${srcdir}/extracted/licenses" "${pkgdir}/usr/share/licenses/${pkgname}"
98
fi
99
mv "${srcdir}/extracted/"* "${pkgdir}/opt/${_pkgname}"
100
# rm "$pkgdir/opt/$pkgname/extensions/libsvpcode.so" # previously this extension caused the whole thing to segfault. lmk if that's still the case
101
ln -s "/opt/${_pkgname}/SVPManager" "${pkgdir}/usr/bin/SVPManager"
102
chmod -R +rX "${pkgdir}/opt/svp" "${pkgdir}/usr/share"
103
104
# Apply updated files
105
cp -a "${srcdir}/svp_updates/"* "${pkgdir}/opt/${_pkgname}/"
106
}
107
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |