svt-av1-hdr10plus-git

maintainer HMK · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host downloads are PGO training video chunks from a web archive of a GitHub raw content URL, used solely for performance optimization during build; they are not executed code and do not alter the final binary's trustworthiness, which is built from a legitimate project fork.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host downloads are PGO training video chunks from a web archive of a GitHub raw content URL, used solely for performance optimization during build; they are not executed code and do not alter the final binary's trustworthiness, which is built from a legitimate project fork.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 'PGO.mkv.0::https://web.archive.org/web/20260726164329if_/https://raw.githubusercontent.com/Akatmks/build-svt-av1/FoodMarket2/PGO.mkv.0'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer : HMK
    
      2
    
      3pkgname=svt-av1-hdr10plus-git
    
      4pkgver=4.1.0.r19.g8b4b9f562
    
      5pkgrel=2
    
      6pkgdesc='SVT-AV1 with enhancements for SDR and HDR encoding with HDR10+ and DoVi support. PGO.'
    
      7arch=('x86_64')
    
      8url='https://github.com/juliobbv-p/svt-av1-hdr'
    
      9license=('BSD' 'custom: Alliance for Open Media Patent License 1.0')
    
      10depends=('glibc' 'dovi-tool' 'libhdr10plus-rs-git')
    
      11makedepends=('git' 'cmake' 'yasm' 'clang' 'llvm' 'lld' 'ffmpeg')
    
      12provides=('svt-av1' 'svt-av1-git')
    
      13conflicts=('svt-av1' 'svt-av1-git' 'svt-av1-hdr' 'svt-av1-hdr-git' 'svt-av1-psy' 'svt-av1-psy-git' 'svt-av1-hdr-riv19')
    
      14source=('svt-av1-hdr::git+https://github.com/juliobbv-p/svt-av1-hdr.git'
    
      15        'PGO.mkv.0::https://web.archive.org/web/20260726164329if_/https://raw.githubusercontent.com/Akatmks/build-svt-av1/FoodMarket2/PGO.mkv.0'
    
      16        'PGO.mkv.1::https://web.archive.org/web/20260726164637if_/https://raw.githubusercontent.com/Akatmks/build-svt-av1/FoodMarket2/PGO.mkv.1'
    
      17        'PGO.mkv.2::https://web.archive.org/web/20260726164551if_/https://raw.githubusercontent.com/Akatmks/build-svt-av1/FoodMarket2/PGO.mkv.2')
    
      18sha256sums=('SKIP'
    
      19            '0cee120d240e1e67763ec2aae218f0c0d1de1e651cf7ecf5810505c772a05bdd'
    
      20            '71ea528d053be3385396e53acfd928c5b0becbbe699585a4a6e76d861e68c61b'
    
      21            'd6e81d8a702dc91821741a27f93d1232f847387254aeaac87e084425cfa48b64')
    
      22
    
      23_pgo=1
    
      24_pgo_clip_seconds=20
    
      25_pgo_train_params=(--rc 1 --tbr 8000 --tune 5 --preset 2 --film-grain 12)
    
      26_pgo_runs=5
    
      27
    
      28pkgver() {
    
      29    git -C svt-av1-hdr describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/^v//'
    
      30}
    
      31
    
      32_cmake_common=(
    
      33    -DCMAKE_INSTALL_PREFIX=/usr
    
      34    -DENABLE_AVX512=ON
    
      35    -DNATIVE=ON
    
      36    -DBUILD_SHARED_LIBS=ON
    
      37    -DSVT_AV1_LTO=ON
    
      38    -DLIBDOVI_FOUND=1
    
      39    -DLIBHDR10PLUS_RS_FOUND=1
    
      40)
    
      41
    
      42build() {
    
      43    export LDFLAGS+=' -Wl,-z,noexecstack'
    
      44    local _pgo_dir="$srcdir/pgo"
    
      45
    
      46    if [ "$_pgo" != 1 ]; then
    
      47        cmake -B build -S svt-av1-hdr -DCMAKE_BUILD_TYPE=Release "${_cmake_common[@]}"
    
      48        make -C build
    
      49        return
    
      50    fi
    
      51
    
      52    export CC=clang CXX=clang++
    
      53
    
      54    cmake -B build-pgo -S svt-av1-hdr -DCMAKE_BUILD_TYPE=Release "${_cmake_common[@]}" \
    
      55        -DCMAKE_C_FLAGS_RELEASE="-fprofile-generate=$_pgo_dir -ftemporal-profile" \
    
      56        -DCMAKE_CXX_FLAGS_RELEASE="-fprofile-generate=$_pgo_dir -ftemporal-profile" \
    
      57        -DCMAKE_EXE_LINKER_FLAGS_RELEASE="-fprofile-generate=$_pgo_dir" \
    
      58        -DCMAKE_SHARED_LINKER_FLAGS_RELEASE="-fprofile-generate=$_pgo_dir"
    
      59    make -C build-pgo
    
      60
    
      61    rm -rf "$_pgo_dir"; mkdir -p "$_pgo_dir"
    
      62    cat "$srcdir"/PGO.mkv.0 "$srcdir"/PGO.mkv.1 "$srcdir"/PGO.mkv.2 > "$_pgo_dir/PGO.mkv"
    
      63    ffmpeg -y -i "$_pgo_dir/PGO.mkv" -t "$_pgo_clip_seconds" -strict -1 \
    
      64        -f yuv4mpegpipe -pix_fmt yuv420p10le "$_pgo_dir/PGO.y4m"
    
      65    rm -f "$_pgo_dir/PGO.mkv"
    
      66
    
      67    local _bin="svt-av1-hdr/Bin/Release/SvtAv1EncApp"
    
      68    local _libdir="svt-av1-hdr/Bin/Release"
    
      69    for i in $(seq 1 "$_pgo_runs"); do
    
      70        LLVM_PROFILE_FILE="$_pgo_dir/%p_%m.profraw" LD_LIBRARY_PATH="$_libdir" \
    
      71            "$_bin" -i "$_pgo_dir/PGO.y4m" -b /dev/null "${_pgo_train_params[@]}" \
    
      72            --pass 1 --stats "$_pgo_dir/stats.log"
    
      73        LLVM_PROFILE_FILE="$_pgo_dir/%p_%m.profraw" LD_LIBRARY_PATH="$_libdir" \
    
      74            "$_bin" -i "$_pgo_dir/PGO.y4m" -b /dev/null "${_pgo_train_params[@]}" \
    
      75            --pass 2 --stats "$_pgo_dir/stats.log"
    
      76    done
    
      77    llvm-profdata merge -o "$_pgo_dir/default.profdata" "$_pgo_dir"/*.profraw
    
      78
    
      79    rm -rf build-pgo build
    
      80    cmake -B build -S svt-av1-hdr -DCMAKE_BUILD_TYPE=Release "${_cmake_common[@]}" \
    
      81        -DCMAKE_C_FLAGS_RELEASE="-fprofile-use=$_pgo_dir/default.profdata" \
    
      82        -DCMAKE_CXX_FLAGS_RELEASE="-fprofile-use=$_pgo_dir/default.profdata"
    
      83    make -C build
    
      84}
    
      85
    
      86package() {
    
      87    make -C build DESTDIR="$pkgdir" install
    
      88    install -D -m644 svt-av1-hdr/{LICENSE,PATENTS}.md -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      89}
    
      90

Changes since previous scan

--- PKGBUILD @ 2026-07-15 17:49
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,33 +2,84 @@
 
 pkgname=svt-av1-hdr10plus-git
 pkgver=4.1.0.r19.g8b4b9f562
-pkgrel=1
-pkgdesc='SVT-AV1 for with enhancements for SDR and HDR encoding with HDR10+ and DoVi support'
+pkgrel=2
+pkgdesc='SVT-AV1 with enhancements for SDR and HDR encoding with HDR10+ and DoVi support. PGO.'
 arch=('x86_64')
 url='https://github.com/juliobbv-p/svt-av1-hdr'
 license=('BSD' 'custom: Alliance for Open Media Patent License 1.0')
 depends=('glibc' 'dovi-tool' 'libhdr10plus-rs-git')
-makedepends=('git' 'cmake' 'yasm')
+makedepends=('git' 'cmake' 'yasm' 'clang' 'llvm' 'lld' 'ffmpeg')
 provides=('svt-av1' 'svt-av1-git')
 conflicts=('svt-av1' 'svt-av1-git' 'svt-av1-hdr' 'svt-av1-hdr-git' 'svt-av1-psy' 'svt-av1-psy-git' 'svt-av1-hdr-riv19')
-source=('svt-av1-hdr::git+https://github.com/juliobbv-p/svt-av1-hdr.git')
-sha256sums=('SKIP')
+source=('svt-av1-hdr::git+https://github.com/juliobbv-p/svt-av1-hdr.git'
+        'PGO.mkv.0::https://web.archive.org/web/20260726164329if_/https://raw.githubusercontent.com/Akatmks/build-svt-av1/FoodMarket2/PGO.mkv.0'
+        'PGO.mkv.1::https://web.archive.org/web/20260726164637if_/https://raw.githubusercontent.com/Akatmks/build-svt-av1/FoodMarket2/PGO.mkv.1'
+        'PGO.mkv.2::https://web.archive.org/web/20260726164551if_/https://raw.githubusercontent.com/Akatmks/build-svt-av1/FoodMarket2/PGO.mkv.2')
+sha256sums=('SKIP'
+            '0cee120d240e1e67763ec2aae218f0c0d1de1e651cf7ecf5810505c772a05bdd'
+            '71ea528d053be3385396e53acfd928c5b0becbbe699585a4a6e76d861e68c61b'
+            'd6e81d8a702dc91821741a27f93d1232f847387254aeaac87e084425cfa48b64')
+
+_pgo=1
+_pgo_clip_seconds=20
+_pgo_train_params=(--rc 1 --tbr 8000 --tune 5 --preset 2 --film-grain 12)
+_pgo_runs=5
 
 pkgver() {
     git -C svt-av1-hdr describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/^v//'
 }
 
+_cmake_common=(
+    -DCMAKE_INSTALL_PREFIX=/usr
+    -DENABLE_AVX512=ON
+    -DNATIVE=ON
+    -DBUILD_SHARED_LIBS=ON
+    -DSVT_AV1_LTO=ON
+    -DLIBDOVI_FOUND=1
+    -DLIBHDR10PLUS_RS_FOUND=1
+)
+
 build() {
     export LDFLAGS+=' -Wl,-z,noexecstack'
-    cmake -B build -S svt-av1-hdr \
-        -DCMAKE_BUILD_TYPE=Release \
-        -DCMAKE_INSTALL_PREFIX=/usr \
-        -DENABLE_AVX512=ON \
-        -DNATIVE=ON \
-        -DBUILD_SHARED_LIBS=ON \
-        -DSVT_AV1_LTO=ON \
-        -DLIBDOVI_FOUND=1 \
-        -DLIBHDR10PLUS_RS_FOUND=1
+    local _pgo_dir="$srcdir/pgo"
+
+    if [ "$_pgo" != 1 ]; then
+        cmake -B build -S svt-av1-hdr -DCMAKE_BUILD_TYPE=Release "${_cmake_common[@]}"
+        make -C build
+        return
+    fi
+
+    export CC=clang CXX=clang++
+
+    cmake -B build-pgo -S svt-av1-hdr -DCMAKE_BUILD_TYPE=Release "${_cmake_common[@]}" \
+        -DCMAKE_C_FLAGS_RELEASE="-fprofile-generate=$_pgo_dir -ftemporal-profile" \
+        -DCMAKE_CXX_FLAGS_RELEASE="-fprofile-generate=$_pgo_dir -ftemporal-profile" \
+        -DCMAKE_EXE_LINKER_FLAGS_RELEASE="-fprofile-generate=$_pgo_dir" \
+        -DCMAKE_SHARED_LINKER_FLAGS_RELEASE="-fprofile-generate=$_pgo_dir"
+    make -C build-pgo
+
+    rm -rf "$_pgo_dir"; mkdir -p "$_pgo_dir"
+    cat "$srcdir"/PGO.mkv.0 "$srcdir"/PGO.mkv.1 "$srcdir"/PGO.mkv.2 > "$_pgo_dir/PGO.mkv"
+    ffmpeg -y -i "$_pgo_dir/PGO.mkv" -t "$_pgo_clip_seconds" -strict -1 \
+        -f yuv4mpegpipe -pix_fmt yuv420p10le "$_pgo_dir/PGO.y4m"
+    rm -f "$_pgo_dir/PGO.mkv"
+
+    local _bin="svt-av1-hdr/Bin/Release/SvtAv1EncApp"
+    local _libdir="svt-av1-hdr/Bin/Release"
+    for i in $(seq 1 "$_pgo_runs"); do
+        LLVM_PROFILE_FILE="$_pgo_dir/%p_%m.profraw" LD_LIBRARY_PATH="$_libdir" \
+            "$_bin" -i "$_pgo_dir/PGO.y4m" -b /dev/null "${_pgo_train_params[@]}" \
+            --pass 1 --stats "$_pgo_dir/stats.log"
+        LLVM_PROFILE_FILE="$_pgo_dir/%p_%m.profraw" LD_LIBRARY_PATH="$_libdir" \
+            "$_bin" -i "$_pgo_dir/PGO.y4m" -b /dev/null "${_pgo_train_params[@]}" \
+            --pass 2 --stats "$_pgo_dir/stats.log"
+    done
+    llvm-profdata merge -o "$_pgo_dir/default.profdata" "$_pgo_dir"/*.profraw
+
+    rm -rf build-pgo build
+    cmake -B build -S svt-av1-hdr -DCMAKE_BUILD_TYPE=Release "${_cmake_common[@]}" \
+        -DCMAKE_C_FLAGS_RELEASE="-fprofile-use=$_pgo_dir/default.profdata" \
+        -DCMAKE_CXX_FLAGS_RELEASE="-fprofile-use=$_pgo_dir/default.profdata"
     make -C build
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 19:33:02	MEDIUM	1
2026-07-15 17:49:21	CLEAN	0
2026-07-12 01:38:23	CLEAN	0
2026-06-18 16:11:54	CLEAN	0