vapoursynth-plugin-svpflow

maintainer AvianaCruz · 8 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD extracts a prebuilt binary (libsvpflow2.so) from a proprietary installer (svp4-linux-64.run) obtained via a web.archive.org snapshot of the official SVP Team host. Two concerns: (1) libsvpflow2.so is a prebuilt shared library that gets installed into /usr/lib/vapoursynth and loaded by Vapoursynth — it is executed/loaded code from a binary blob, not compiled from source. (2) The source URL is a Wayback Machine snapshot (web.archive.org) rather than the live upstream URL, which means the integrity depends on what the Internet Archive captured; however, a sha256sum is provided and pinned, which mitigates silent substitution. The original host (svp-team.com) is the legitimate upstream vendor for SVP4, so this is not a random personal host. svpflow1 is built from GPL source (legitimate). The medium rating is appropriate because a prebuilt proprietary .so is being extracted from a vendor installer and installed as an executed library, but there is no evidence of malice, the hash is pinned, and the vendor is the legitimate upstream.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("svpflow1-src-$_svpflow1_ver.zip::https://www.svp-team.com/files/gpl/svpflow1-src.zip"
PKGBUILD:19 "https://web.archive.org/web/20250904130553if_/https://www.svp-team.com/files/svp4-linux.$_pkgver.tar.bz2")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD extracts a prebuilt binary (libsvpflow2.so) from a proprietary installer (svp4-linux-64.run) obtained via a web.archive.org snapshot of the official SVP Team host. Two concerns: (1) libsvpflow2.so is a prebuilt shared library that gets installed into /usr/lib/vapoursynth and loaded by Vapoursynth — it is executed/loaded code from a binary blob, not compiled from source. (2) The source URL is a Wayback Machine snapshot (web.archive.org) rather than the live upstream URL, which means the integrity depends on what the Internet Archive captured; however, a sha256sum is provided and pinned, which mitigates silent substitution. The original host (svp-team.com) is the legitimate upstream vendor for SVP4, so this is not a random personal host. svpflow1 is built from GPL source (legitimate). The medium rating is appropriate because a prebuilt proprietary .so is being extracted from a vendor installer and installed as an executed library, but there is no evidence of malice, the hash is pinned, and the vendor is the legitimate upstream.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: AvianaCruz <gwencroft <at> proton <dot> me>
    
      2# Contributor: phiresky <phireskyde+git <at> gmail <dot> com>
    
      3# shellcheck shell=bash
    
      4pkgname=vapoursynth-plugin-svpflow
    
      5pkgver=4.6.263
    
      6_pkgver=$pkgver
    
      7_svpflow1_ver=4.5.0.205 # version of svpflow1 may be different from svpflow2
    
      8pkgrel=1
    
      9pkgdesc='SmoothVideo plugin for Vapoursynth'
    
      10arch=('x86_64')
    
      11url='https://www.svp-team.com/wiki/SVP:Linux'
    
      12license=('GPL-2.0-only' 'LicenseRef-svp-team')
    
      13depends=('vapoursynth')
    
      14makedepends=('p7zip' 'qt6-base' 'nasm')
    
      15provides=("vapoursynth-plugin-svpflow1=$_svpflow1_ver"
    
      16    "vapoursynth-plugin-svpflow2=$pkgver")
    
      17conflicts=('vapoursynth-plugin-svpflow1' 'vapoursynth-plugin-svpflow2-bin')
    
      18source=("svpflow1-src-$_svpflow1_ver.zip::https://www.svp-team.com/files/gpl/svpflow1-src.zip"
    
      19    "https://web.archive.org/web/20250904130553if_/https://www.svp-team.com/files/svp4-linux.$_pkgver.tar.bz2")
    
      20sha256sums=('c384b3b969d66f2e22003f87b644fa79ce9093a8af326f7fc79cc305239d05f3'
    
      21    '1f24435451d59936a7fd28b7423190a42df36b7d306b2d747741e4efda171bdf')
    
      22
    
      23prepare() {
    
      24    rm -rf "$srcdir/installer"
    
      25    mkdir "$srcdir/installer"
    
      26    echo 'Finding 7z archives in installer...'
    
      27    LANG=C grep --only-matching --byte-offset --binary --text $'7z\xBC\xAF\x27\x1C' "$srcdir/svp4-linux-64.run" |
    
      28        cut -f1 -d: |
    
      29        while read -r ofs; do dd if="$srcdir/svp4-linux-64.run" bs=1M iflag=skip_bytes status=none skip="$ofs" of="$srcdir/installer/bin-$ofs.7z"; done
    
      30
    
      31    echo 'Extracting 7z archives from installer...'
    
      32    for f in "$srcdir"/installer/*.7z; do
    
      33        7z -bd -bb0 -y x -o"$srcdir/extracted" "$f" plugins/libsvpflow2.so || true
    
      34    done
    
      35}
    
      36
    
      37build() {
    
      38    cd "$srcdir/svpflow1-src"
    
      39
    
      40    pushd jsoncpp
    
      41    qmake6
    
      42    make
    
      43    popd >/dev/null
    
      44
    
      45    pushd svpflow1
    
      46    LDFLAGS+=' -Wl,-z,shstk'
    
      47    qmake6
    
      48    make
    
      49    popd >/dev/null
    
      50}
    
      51
    
      52package() {
    
      53    install -dm755 "$pkgdir/usr/lib/vapoursynth"
    
      54    install -m755 "$srcdir/svpflow1-src/release/libsvpflow1.so" "$pkgdir/usr/lib/vapoursynth/libsvpflow1.so"
    
      55    install -m755 "$srcdir/extracted/plugins/libsvpflow2.so" "$pkgdir/usr/lib/vapoursynth/libsvpflow2.so"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2