vapoursynth-plugin-mlrt-migx-runtime-git
LOW
maintainer TheFeelTrain
1 votes
scanned 2026-08-26 00:12:07.713121
Why flagged
The package builds from the project's own GitHub repository and downloads a model file from the same project's release assets; both sources are plausibly official, and the models are data files, not executable code, so the risk from unverified downloads is low despite SKIP'd checksums.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own GitHub repository and downloads a model file from the same project's release assets; both sources are plausibly official, and the models are data files, not executable code, so the risk from unverified downloads is low despite SKIP'd checksums.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
Recently orphaned & re-adopted
orphaned_readopted
This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.
PKGBUILD
1
# Maintainer: Josh Holmer <jholmer.in@gmail.com>
2
3
_plug=mlrt
4
pkgname=vapoursynth-plugin-${_plug}-migx-runtime-git
5
pkgver=811.1f166ba
6
pkgrel=2
7
pkgdesc="Plugin for VapourSynth: ${_plug} (MIGraphX runtime)"
8
arch=('x86_64')
9
url='https://github.com/AmusementClub/vs-mlrt'
10
license=('GPL-3.0-only')
11
depends=('vapoursynth' 'migraphx')
12
makedepends=('git' 'ninja' 'cmake' 'jq' 'vapoursynth-api3-headers')
13
optdepends=()
14
provides=("vapoursynth-plugin-${_plug}")
15
conflicts=("vapoursynth-plugin-${_plug}")
16
17
# Function to fetch the latest release version
18
get_latest_release_version() {
19
curl --silent "https://api.github.com/repos/AmusementClub/vs-mlrt/releases/latest" | jq -r .tag_name
20
}
21
22
# Fetch the latest release version
23
latest_release=$(get_latest_release_version)
24
25
source=(
26
"${_plug}::git+https://github.com/AmusementClub/vs-mlrt.git"
27
"models-${latest_release}.7z::https://github.com/AmusementClub/vs-mlrt/releases/download/${latest_release}/models.${latest_release}.7z"
28
)
29
sha256sums=('SKIP' 'SKIP')
30
31
pkgver() {
32
cd "${_plug}"
33
34
_rev=$(git rev-list --count --all)
35
_hash=$(git rev-parse --short HEAD)
36
printf "%s.%s" "$_rev" "$_hash"
37
}
38
39
build() {
40
cmake -S "${_plug}/vsmigx" -B build -G Ninja -Wno-dev -LA \
41
-D CMAKE_BUILD_TYPE=Release \
42
-D VAPOURSYNTH_INCLUDE_DIRECTORY="/usr/include/vapoursynth" \
43
-D CMAKE_CXX_COMPILER=g++ \
44
-D CMAKE_CXX_FLAGS="${CXXFLAGS} -Wall -ffast-math" \
45
-D migraphx_DIR=/opt/rocm/lib/cmake/migraphx \
46
-D MIOpen_DIR=/opt/rocm/lib/cmake/miopen \
47
-D hip_DIR=/opt/rocm/lib/cmake/hip \
48
-D AMDDeviceLibs_DIR=/opt/rocm/lib/cmake/AMDDeviceLibs \
49
-D amd_comgr_DIR=/opt/rocm/lib/cmake/amd_comgr \
50
-D hsa-runtime64_DIR=/opt/rocm/lib/cmake/hsa-runtime64 \
51
-D rocblas_DIR=/opt/rocm/lib/cmake/rocblas \
52
-D hipblaslt_DIR=/opt/rocm/lib/cmake/hipblaslt \
53
-D CMAKE_PREFIX_PATH=/opt/rocm/lib/cmake
54
55
cmake --build build
56
}
57
58
package() {
59
site_packages="$(python -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')"
60
PLUGINDIR=$(python -c "import vapoursynth; print(vapoursynth.get_plugin_dir())")
61
62
# The cmake script puts the library inside a `lib` dir, which we don't want, so we have to install it manually
63
install -Dm755 "build/libvsmigx.so" "${pkgdir}${PLUGINDIR}/libvsmigx.so"
64
# The plugin looks for this binary in this specific location, so make a symlink to it
65
mkdir "${pkgdir}${PLUGINDIR}/vsmlrt-hip"
66
ln -s /opt/rocm/bin/migraphx-driver "${pkgdir}${PLUGINDIR}/vsmlrt-hip/migraphx-driver"
67
for i in $(find models* -type f); do install -Dm644 "${i}" "${pkgdir}${PLUGINDIR}/${i}"; done
68
69
install -Dm644 "${_plug}/scripts/vsmlrt.py" "${pkgdir}${site_packages}/vsmlrt.py"
70
71
install -Dm644 "${_plug}/README.md" "${pkgdir}/usr/share/doc/vapoursynth/tools/${_plug}/README.md"
72
install -Dm644 "${_plug}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
73
}
74
Changes since previous scan
--- PKGBUILD @ 2026-07-14 17:45+++ PKGBUILD @ 2026-08-26 00:12@@ -2,7 +2,7 @@ _plug=mlrt pkgname=vapoursynth-plugin-${_plug}-migx-runtime-git-pkgver=786.83b0180+pkgver=811.1f166ba pkgrel=2 pkgdesc="Plugin for VapourSynth: ${_plug} (MIGraphX runtime)" arch=('x86_64')@@ -56,6 +56,7 @@ } package() {+ site_packages="$(python -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')" PLUGINDIR=$(python -c "import vapoursynth; print(vapoursynth.get_plugin_dir())") # The cmake script puts the library inside a `lib` dir, which we don't want, so we have to install it manually@@ -65,7 +66,7 @@ ln -s /opt/rocm/bin/migraphx-driver "${pkgdir}${PLUGINDIR}/vsmlrt-hip/migraphx-driver" for i in $(find models* -type f); do install -Dm644 "${i}" "${pkgdir}${PLUGINDIR}/${i}"; done - install -Dm644 "${_plug}/scripts/vsmlrt.py" "${pkgdir}${PLUGINDIR}/vsmlrt.py"+ install -Dm644 "${_plug}/scripts/vsmlrt.py" "${pkgdir}${site_packages}/vsmlrt.py" install -Dm644 "${_plug}/README.md" "${pkgdir}/usr/share/doc/vapoursynth/tools/${_plug}/README.md" install -Dm644 "${_plug}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-26 00:12:07 | Low | 2 |
| 2026-08-25 23:28:42 | Medium | 1 |
| 2026-07-20 17:14:35 | Clean | 0 |
| 2026-07-14 17:45:39 | Clean | 0 |
| 2026-06-18 16:11:54 | Clean | 0 |