vapoursynth-plugin-julek-git

maintainer damian101 · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package builds from source using git repositories hosted on official and well-known development platforms (GitHub, skia.googlesource.com); the non-standard host flag is a false positive as these are legitimate project sources, not untrusted or swappable binary downloads.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using git repositories hosted on official and well-known development platforms (GitHub, skia.googlesource.com); the non-standard host flag is a false positive as these are legitimate project sources, not untrusted or swappable binary downloads.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:35 git+https://skia.googlesource.com/skcms.git

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Damian Höster <damian.hoester@posteo.de>
2
3_plug=julek
4pkgname=vapoursynth-plugin-$_plug-git
5pkgver=r3.r3.7674578
6pkgrel=1
7pkgdesc="Plugin for Vapoursynth: ${_plug} (GIT version)"
8arch=(x86_64)
9url=https://github.com/dnjulek/vapoursynth-julek-plugin
10license=(MIT)
11depends=(
12 vapoursynth
13 brotli
14 gperftools
15)
16makedepends=(
17 git
18 cmake
19 clang
20 lld
21 ninja
22 python
23 asciidoc
24)
25provides=(
26 vapoursynth-plugin-$_plug
27)
28conflicts=(
29 vapoursynth-plugin-$_plug
30)
31source=(
32 $_plug::git+$url.git
33 git+https://github.com/libjxl/libjxl.git
34 git+https://github.com/google/highway.git
35 git+https://skia.googlesource.com/skcms.git
36)
37sha256sums=(
38 SKIP
39 SKIP
40 SKIP
41 SKIP
42)
43
44pkgver() {
45 git -C $_plug describe --long --tags |
46 sed -E 's/^v//; s/-([^-]*)-g([^-]*)$/.r\1.\2/; s/-/./g'
47}
48
49prepare() {
50 cd $_plug
51 git submodule init thirdparty/libjxl
52 git config submodule.thirdparty/libjxl.url "$srcdir/libjxl"
53 git -c protocol.file.allow=always submodule update
54 mkdir -p thirdparty/libjxl_build
55 cd thirdparty/libjxl
56 git submodule init third_party/{highway,skcms}
57 git config submodule.third_party/highway.url "$srcdir/highway"
58 git config submodule.third_party/skcms.url "$srcdir/skcms"
59 git -c protocol.file.allow=always submodule update
60}
61
62build() {
63 export CC=clang CXX=clang++
64 export LDFLAGS+=' -fuse-ld=lld'
65 cmake \
66 -S $_plug/thirdparty/libjxl \
67 -B $_plug/thirdparty/libjxl_build \
68 -C $_plug/thirdparty/libjxl_cache.cmake \
69 -DJPEGXL_ENABLE_DOXYGEN=OFF \
70 -DJPEGXL_ENABLE_JPEGLI=OFF \
71 -DJPEGXL_FORCE_SYSTEM_BROTLI=ON \
72 -G Ninja
73 cmake --build $_plug/thirdparty/libjxl_build -- $NINJAFLAGS
74 cmake --install $_plug/thirdparty/libjxl_build
75
76 cmake \
77 -S $_plug \
78 -B build \
79 -DCMAKE_BUILD_TYPE=Release \
80 -G Ninja
81 cmake --build build -- $NINJAFLAGS
82}
83
84package() {
85 DESTDIR="$pkgdir" cmake --install build
86 install -Dm644 $_plug/LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
87}
88

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -70,7 +70,7 @@
-DJPEGXL_ENABLE_JPEGLI=OFF \
-DJPEGXL_FORCE_SYSTEM_BROTLI=ON \
-G Ninja
- cmake --build $_plug/thirdparty/libjxl_build
+ cmake --build $_plug/thirdparty/libjxl_build -- $NINJAFLAGS
cmake --install $_plug/thirdparty/libjxl_build
cmake \
@@ -78,7 +78,7 @@
-B build \
-DCMAKE_BUILD_TYPE=Release \
-G Ninja
- cmake --build build
+ cmake --build build -- $NINJAFLAGS
}
package() {

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 05:20:08 MEDIUM 1
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 15:39:03 MEDIUM 1
2026-06-19 23:51:18 CLEAN 2
2026-06-19 22:34:54 MEDIUM 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion