vapoursynth-plugin-placebo-git (LOW)

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own git repository, which is a normal AUR practice; the recently orphaned flag does not imply malicious content.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer:  Dave <orangechannel@pm.me>
    
      2
    
      3_plug=placebo
    
      4pkgname=vapoursynth-plugin-${_plug}-git
    
      5pkgver=2.0.4.r0.g3cfd23f
    
      6pkgrel=1
    
      7pkgdesc="Plugin for VapourSynth: ${_plug} (GIT version)"
    
      8arch=('x86_64')
    
      9url='https://github.com/Lypheo/vs-placebo'
    
      10license=('LGPL')
    
      11depends=('vapoursynth' 'libplacebo')
    
      12makedepends=(
    
      13  'git'
    
      14  'python-build'
    
      15  'python-installer'
    
      16  'meson-python'
    
      17  'vulkan-headers'
    
      18)
    
      19optdepends=('libdovi')
    
      20provides=("vapoursynth-plugin-${_plug}")
    
      21conflicts=("vapoursynth-plugin-${_plug}")
    
      22source=("${_plug}::git+https://github.com/Lypheo/vs-placebo.git")
    
      23b2sums=('SKIP')
    
      24
    
      25pkgver() {
    
      26  cd "${_plug}"
    
      27  git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      28}
    
      29
    
      30build() {
    
      31  cd "${_plug}"
    
      32
    
      33  python -m build --wheel --no-isolation
    
      34}
    
      35
    
      36package(){
    
      37  cd "${_plug}"
    
      38  
    
      39  python -m installer --destdir="$pkgdir" dist/*.whl
    
      40
    
      41  install -Dm644 README.md "${pkgdir}/usr/share/doc/vapoursynth/plugins/${_plug}/README.md"
    
      42  install -Dm644 COPYING "${pkgdir}/usr/share/licenses/${pkgname}/COPYING"
    
      43}
    
      44

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-26 00:12
@@ -2,48 +2,42 @@
 
 _plug=placebo
 pkgname=vapoursynth-plugin-${_plug}-git
-pkgver=r167.ccb4bea
+pkgver=2.0.4.r0.g3cfd23f
 pkgrel=1
 pkgdesc="Plugin for VapourSynth: ${_plug} (GIT version)"
 arch=('x86_64')
 url='https://github.com/Lypheo/vs-placebo'
 license=('LGPL')
 depends=('vapoursynth' 'libplacebo')
-makedepends=('git' 'meson' 'vulkan-headers')
+makedepends=(
+  'git'
+  'python-build'
+  'python-installer'
+  'meson-python'
+  'vulkan-headers'
+)
 optdepends=('libdovi')
 provides=("vapoursynth-plugin-${_plug}")
 conflicts=("vapoursynth-plugin-${_plug}")
-LIBP2P_COMMIT="f50288b0c8db2cb14bb98fc25a5f056609d03652"
-source=("${_plug}::git+https://github.com/Lypheo/vs-placebo.git"
-  "libp2p.tar.gz::https://github.com/sekrit-twc/libp2p/archive/$LIBP2P_COMMIT.tar.gz"
-)
-sha256sums=('SKIP' '37b14be5b1108268e55aa4fbaf838c287018ecc5b58e15efdfe064916afc44e9')
+source=("${_plug}::git+https://github.com/Lypheo/vs-placebo.git")
+b2sums=('SKIP')
 
 pkgver() {
   cd "${_plug}"
-  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
-}
-
-prepare() {
-  cd "${_plug}"
-  rm -rf "subprojects/libp2p-$LIBP2P_COMMIT"
-  ln -s "$srcdir/libp2p-$LIBP2P_COMMIT" "subprojects/libp2p-$LIBP2P_COMMIT"
-  cp -f "subprojects/packagefiles/libp2p-$LIBP2P_COMMIT/meson.build" "subprojects/libp2p-$LIBP2P_COMMIT/"
-  cp -f "subprojects/packagefiles/libp2p-$LIBP2P_COMMIT/meson_options.txt" "subprojects/libp2p-$LIBP2P_COMMIT/"
-
-  arch-meson build --reconfigure
+  git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
 }
 
 build() {
   cd "${_plug}"
-  ninja -C build
+
+  python -m build --wheel --no-isolation
 }
 
-package() {
-  PLUGINDIR=$(python3 -c "import vapoursynth; print(vapoursynth.get_plugin_dir())")
+package(){
   cd "${_plug}"
+  
+  python -m installer --destdir="$pkgdir" dist/*.whl
 
-  install -Dm755 build/libvs_placebo.so "${pkgdir}${PLUGINDIR}/libvs_placebo.so"
   install -Dm644 README.md "${pkgdir}/usr/share/doc/vapoursynth/plugins/${_plug}/README.md"
   install -Dm644 COPYING "${pkgdir}/usr/share/licenses/${pkgname}/COPYING"
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 00:12:07	Low	2
2026-08-25 23:28:42	Medium	1
2026-06-18 16:11:54	Clean	0