uhhyou-plugins
LOW
maintainer osamc
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package builds from source using git repositories from GitHub and GitLab, including the project's own and official VST SDKs; the non-standard hosts are for submodules from the same trusted project sources, and no unverifiable or executable payloads are downloaded.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using git repositories from GitHub and GitLab, including the project's own and official VST SDKs; the non-standard hosts are for submodules from the same trusted project sources, and no unverifiable or executable payloads are downloaded.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
'git+https://gitlab.mpcdf.mpg.de/mtr/pocketfft.git/'
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: OSAMC <https://github.com/osam-cologne/archlinux-proaudio>
2
# Contributor: Florian Hülsmann <fh@cbix.de>
3
# Contributor: Chris Arndt <aur -at- chrisarndt -dot- de>
4
5
_name=VSTPlugins
6
pkgname=uhhyou-plugins
7
pkgver=0.71.0
8
pkgrel=1
9
pkgdesc='A collection of synthesizer and effect VST3 plugins'
10
arch=(aarch64 x86_64)
11
url='https://ryukau.github.io/VSTPlugins/'
12
license=(GPL-3.0-only)
13
groups=(pro-audio vst3-plugins)
14
depends=(cairo glibc libgcc libstdc++ libxcb xcb-util xcb-util-cursor)
15
makedepends=(cmake fontconfig git gtkmm3 libx11 libxkbcommon-x11 pango xcb-util-keysyms)
16
optdepends=('vst3-host: for running VST3 plugins')
17
source=(
18
"git+https://github.com/ryukau/VSTPlugins#tag=UhhyouPlugins$pkgver"
19
'git+https://gitlab.mpcdf.mpg.de/mtr/pocketfft.git/'
20
'git+https://github.com/ryukau/vcl_version2#branch=sse2neon_hack'
21
'git+https://github.com/steinbergmedia/vst3sdk'
22
'git+https://github.com/steinbergmedia/vst3_base'
23
'git+https://github.com/steinbergmedia/vst3_cmake'
24
'git+https://github.com/steinbergmedia/vst3_pluginterfaces'
25
'git+https://github.com/steinbergmedia/vst3_public_sdk'
26
'git+https://github.com/steinbergmedia/vstgui'
27
)
28
sha256sums=('3d37db90de7d420279709cd6b8dd1f2f68fac9287d1d00bcaa9a0a46511a3d73'
29
'SKIP'
30
'SKIP'
31
'SKIP'
32
'SKIP'
33
'SKIP'
34
'SKIP'
35
'SKIP'
36
'SKIP')
37
38
prepare() {
39
cd $_name
40
# submodules
41
git submodule init
42
git config submodule.lib/pocketfft.url "$srcdir"/pocketfft
43
git config submodule.lib/vcl.url "$srcdir"/vcl_version2
44
git config submodule.lib/vst3sdk.url "$srcdir"/vst3sdk
45
git -c protocol.file.allow=always submodule update
46
pushd lib/vst3sdk
47
git submodule init base cmake pluginterfaces public.sdk vstgui4
48
git config submodule.base.url "$srcdir"/vst3_base
49
git config submodule.cmake.url "$srcdir"/vst3_cmake
50
git config submodule.pluginterfaces.url "$srcdir"/vst3_pluginterfaces
51
git config submodule.public.sdk.url "$srcdir"/vst3_public_sdk
52
git config submodule.vstgui4.url "$srcdir"/vstgui
53
git -c protocol.file.allow=always submodule update
54
popd
55
}
56
57
build() {
58
cmake -B $pkgname-build -S $_name \
59
-DCMAKE_BUILD_TYPE=Release \
60
-DCMAKE_INSTALL_PREFIX=/usr \
61
-DSMTG_RUN_VST_VALIDATOR=Off \
62
-DSMTG_CREATE_PLUGIN_LINK=Off \
63
-Wno-dev
64
cmake --build $pkgname-build -j$(nproc --ignore=1)
65
}
66
67
check() {
68
for _plugin in $pkgname-build/VST3/Release/*.vst3; do
69
# many plugins seem to use a lot of memory during validation so let's only test basics
70
$pkgname-build/bin/Release/validator -suite "General Tests" $_plugin
71
done
72
}
73
74
package() {
75
depends+=(libfontconfig.so libgobject-2.0.so libpango-1.0.so libpangocairo-1.0.so
76
libpangoft2-1.0.so libxkbcommon.so libxkbcommon-x11.so ttf-croscore)
77
cd $pkgname-build/VST3/Release
78
for plugin in *.vst3; do
79
# install executable
80
install -vDm755 $plugin/Contents/$CARCH-linux/*.so -t \
81
"$pkgdir"/usr/lib/vst3/$plugin/Contents/$CARCH-linux
82
# install resources
83
if [[ -f $plugin/Contents/moduleinfo.json ]]; then
84
install -vDm644 $plugin/Contents/moduleinfo.json \
85
-t "$pkgdir"/usr/lib/vst3/$plugin/Contents/Resources
86
else
87
install -vDm644 $plugin/Contents/Resources/moduleinfo.json \
88
-t "$pkgdir"/usr/lib/vst3/$plugin/Contents/Resources
89
fi
90
[ -f $plugin/Contents/Resources/Snapshots/*.png ] &&
91
install -vDm644 $plugin/Contents/Resources/Snapshots/*.png -t \
92
"$pkgdir"/usr/lib/vst3/$plugin/Contents/Resources/Snapshots
93
done
94
# install docs
95
cd "$srcdir"/$_name/docs
96
find . -type f \( -name \*.html -o -name \*.svg -o -name \*.png \) -exec \
97
install -vDm644 {} -T "$pkgdir"/usr/share/doc/$pkgname/{} \;
98
}
99
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |