uhhyou-plugins
LOW
maintainer osamc
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from source hosted on GitHub and GitLab, which are standard development platforms; the non-whitelisted GitLab MPG host is plausibly legitimate for the pocketfft library, and all sources are verified with matching checksums, posing no real supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on GitHub and GitLab, which are standard development platforms; the non-whitelisted GitLab MPG host is plausibly legitimate for the pocketfft library, and all sources are verified with matching checksums, posing no real supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
"pocketfft-$_pocketfft_ref.tar.gz::https://gitlab.mpcdf.mpg.de/mtr/pocketfft/-/archive/$_pocketfft_ref/pocketfft-$_pocketfft_ref.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: OSAMC <https://github.com/osam-cologne/archlinux-proaudio>
2
# Contributor: Florian Hülsmann <fh@cbix.de>
3
# Contributor: Chris Arndt <aur -at- chrisarndt -dot- de>
4
5
_name=VSTPlugins-UhhyouPlugins
6
pkgname=uhhyou-plugins
7
pkgver=0.70.0
8
pkgrel=1
9
pkgdesc='A collection of synthesizer and effect VST3 plugins'
10
arch=(aarch64 x86_64)
11
url='https://ryukau.github.io/VSTPlugins/'
12
license=(GPL-3.0-only)
13
groups=(pro-audio vst3-plugins)
14
depends=(cairo gcc-libs glibc libxcb xcb-util xcb-util-cursor)
15
makedepends=(cmake fontconfig git gtkmm3 libx11 libxkbcommon-x11 pango vst3sdk
16
xcb-util-keysyms)
17
optdepends=('vst3-host: for running VST3 plugins')
18
_pocketfft_ref=0fa0ef5
19
_vcl_ref=4c90584
20
source=(
21
"$pkgname-$pkgver.tar.gz::https://github.com/ryukau/VSTPlugins/archive/refs/tags/UhhyouPlugins$pkgver.tar.gz"
22
"pocketfft-$_pocketfft_ref.tar.gz::https://gitlab.mpcdf.mpg.de/mtr/pocketfft/-/archive/$_pocketfft_ref/pocketfft-$_pocketfft_ref.tar.gz"
23
"vcl-$_vcl_ref.tar.gz::https://github.com/vectorclass/version2/archive/$_vcl_ref.tar.gz"
24
)
25
sha256sums=('611cf3cdeeb781b87df46dcbeb5f99cecf0f974ff2d809f666f943e0762916fe'
26
'03f0a020d7815e13acaa9419f94b13977df1902724fb2227bcf800de9b8e5200'
27
'd2a36ccedf4585b33fdba6cb38000aaa022c5b5306efeff2ad58cca52999c827')
28
29
prepare() {
30
cd $_name$pkgver
31
# link submodules
32
rm -r lib/pocketfft && ln -s "$srcdir"/pocketfft-$_pocketfft_ref lib/pocketfft
33
rm -r lib/vcl && ln -s "$srcdir"/version2-$_vcl_ref* lib/vcl
34
# copy and patch vst3sdk
35
rm -rf lib/vst3sdk
36
if [[ -d /usr/src/vst3sdk ]]; then
37
cp -r /usr/src/vst3sdk lib
38
else
39
cp -r /usr/share/vst3sdk lib
40
fi
41
cd lib/vst3sdk/vstgui4
42
git apply ../../../ci/linux_patch/cairographicscontext.patch
43
}
44
45
build() {
46
cmake -B $pkgname-build -S $_name$pkgver \
47
-DCMAKE_BUILD_TYPE=Release \
48
-DCMAKE_INSTALL_PREFIX=/usr \
49
-DSMTG_RUN_VST_VALIDATOR=Off \
50
-DSMTG_CREATE_PLUGIN_LINK=Off \
51
-Wno-dev
52
cmake --build $pkgname-build -j$(nproc --ignore=1)
53
}
54
55
check() {
56
for _plugin in $pkgname-build/VST3/Release/*.vst3; do
57
# many plugins seem to use a lot of memory during validation so let's only test basics
58
$pkgname-build/bin/Release/validator -suite "General Tests" $_plugin
59
done
60
}
61
62
package() {
63
depends+=(libfontconfig.so libgobject-2.0.so libpango-1.0.so libpangocairo-1.0.so
64
libpangoft2-1.0.so libxkbcommon.so libxkbcommon-x11.so ttf-croscore)
65
cd $pkgname-build/VST3/Release
66
for plugin in *.vst3; do
67
# install executable
68
install -vDm755 $plugin/Contents/$CARCH-linux/*.so -t \
69
"$pkgdir"/usr/lib/vst3/$plugin/Contents/$CARCH-linux
70
# install resources
71
if [[ -f $plugin/Contents/moduleinfo.json ]]; then
72
install -vDm644 $plugin/Contents/moduleinfo.json \
73
-t "$pkgdir"/usr/lib/vst3/$plugin/Contents/Resources
74
else
75
install -vDm644 $plugin/Contents/Resources/moduleinfo.json \
76
-t "$pkgdir"/usr/lib/vst3/$plugin/Contents/Resources
77
fi
78
[ -f $plugin/Contents/Resources/Snapshots/*.png ] &&
79
install -vDm644 $plugin/Contents/Resources/Snapshots/*.png -t \
80
"$pkgdir"/usr/lib/vst3/$plugin/Contents/Resources/Snapshots
81
done
82
# install docs
83
cd "$srcdir"/$_name$pkgver/docs
84
find . -type f \( -name \*.html -o -name \*.svg -o -name \*.png \) -exec \
85
install -vDm644 {} -T "$pkgdir"/usr/share/doc/$pkgname/{} \;
86
}
87
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |