vdr

maintainer CReimer · 63 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is downloaded from the project's own domain (tvdr.de) via a snapshot link, which is a normal and legitimate practice for building from upstream source; the non-whitelisted host is the project's official site, so this is a standard AUR build with no evidence of malicious intent or supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from the project's own domain (tvdr.de) via a snapshot link, which is a normal and legitimate practice for building from upstream source; the non-whitelisted host is the project's official site, so this is a standard AUR build with no evidence of malicious intent or supply-chain risk.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("$pkgname-$pkgver.tar.bz2::http://git.tvdr.de/?p=vdr.git;a=snapshot;h=refs/tags/$pkgver;sf=tbz2"

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:86 chmod u+s "$pkgdir/usr/lib/vdr/bin/shutdown-wrapper"

PKGBUILD

2 offending line(s) highlighted

      1# This PKGBUILD is part of the VDR4Arch project [https://github.com/vdr4arch]
    
      2
    
      3# Maintainer: Manuel Reimer <manuel.reimer@gmx.de>
    
      4pkgbase=vdr
    
      5pkgname=(vdr vdr-examples)
    
      6pkgver=2.8.2
    
      7_vdrapi=13
    
      8pkgrel=1
    
      9url="http://tvdr.de/"
    
      10arch=('x86_64' 'i686' 'arm' 'armv6h' 'armv7h' 'aarch64')
    
      11license=('GPL-2.0-or-later')
    
      12makedepends=('fontconfig' 'libcap' 'libjpeg-turbo' 'libsystemd' 'perl' 'ttf-font' 'systemd' 'ncurses')
    
      13source=("$pkgname-$pkgver.tar.bz2::http://git.tvdr.de/?p=vdr.git;a=snapshot;h=refs/tags/$pkgver;sf=tbz2"
    
      14        'Make.config'
    
      15        'vdr-MainMenuHooks.patch'
    
      16        '00-vdr.conf' '50-hello.conf' '50-pictures.conf'
    
      17        '60-create-dvb-device-units.rules'
    
      18        'gen-sddropin'
    
      19        'shutdown.sh'
    
      20        'shutdown-wrapper.c'
    
      21        'vdr.service'
    
      22        'vdr.sysuser')
    
      23sha256sums=('237460477b980354286162604b9228c0414950e9c64ccd2f9fe8a47aacd3efe7'
    
      24            '6d5a69501e65046b708841c38f066f4598baa7c4b52f382e70fe2f69c01a233f'
    
      25            'cb44edeed0c7a8c1110d5963934dd6c9a79f7e7618ecc1dafb38bbe05d982f7a'
    
      26            '86f2469f459e2aabfc0ab703fc8435e458e89c4879376e900160d083924097b3'
    
      27            '423656cb6ba39af52d379dee697c52e6f435c098daa8c2ba429c1247b757af50'
    
      28            '39f4c2886328dc947dbef70dbc37d42504dc5c9d6a2ad81bf0c41d26fa3a5d6a'
    
      29            '1d914d6308a2b79ede34b7670788e5dfd3a8fab24156353555a66c9ef0bb41d7'
    
      30            '54a901d735d200ba3e2df4d9f45e1e537832a868c6ae5ae42ed3ff1a4c2c3f05'
    
      31            '7313a8db29693fa84d19be7b715b3ab04fd77eddcb52682588cc0a094764b6ba'
    
      32            '17b82fd995e9a39ad8d73d46b586d6c1934a6747c2859bd6d6df22ed254b5c4b'
    
      33            'f33f42a77bd93f00e7aa18f22667f0097468de76a0269c6e35fdc0fd2e30f6e6'
    
      34            '7ca24fe1df90ffc20ae7fc6578193874b21ef8f303d7aac421d394a6106eef2a')
    
      35
    
      36prepare() {
    
      37  cd "${srcdir}/${pkgbase}-${pkgver}"
    
      38
    
      39  # Place our "distribution defaults"
    
      40  cp "$srcdir/Make.config" .
    
      41
    
      42  # Custom extensions
    
      43  patch -p1 -i "$srcdir/vdr-MainMenuHooks.patch"
    
      44
    
      45  # Don't install plugins with VDR
    
      46  sed -i '/^install: /s/install-plugins //' Makefile
    
      47}
    
      48
    
      49build() {
    
      50  gcc -o shutdown-wrapper shutdown-wrapper.c
    
      51
    
      52  cd "${srcdir}/${pkgbase}-${pkgver}"
    
      53  make
    
      54}
    
      55
    
      56package_vdr() {
    
      57  pkgdesc="'open' digital satellite receiver and timer controlled video disk recorder"
    
      58  depends=('fontconfig' 'libcap' 'libjpeg-turbo' 'libsystemd' 'perl' 'ttf-font')
    
      59  optdepends=('lirc-utils: remote control support'
    
      60              'vdr-xorg: To start X11')
    
      61  replaces=('runvdr-extreme')
    
      62  conflicts=('runvdr-extreme')
    
      63  provides=("vdr-api=$_vdrapi")
    
      64  install='vdr.install'
    
      65  options=(emptydirs)
    
      66  backup=('etc/vdr/conf.d/00-vdr.conf'
    
      67          'var/lib/vdr/camresponses.conf'
    
      68          'var/lib/vdr/channels.conf'
    
      69          'var/lib/vdr/diseqc.conf'
    
      70          'var/lib/vdr/keymacros.conf'
    
      71          'var/lib/vdr/scr.conf'
    
      72          'var/lib/vdr/sources.conf'
    
      73          'var/lib/vdr/svdrphosts.conf')
    
      74
    
      75  # Ship this one empty so it's there even without plugin packages installed
    
      76  mkdir -p "$pkgdir/etc/vdr/conf.avail"
    
      77  # This one has to be shipped empty or some plugins (streamdev) fail to build
    
      78  mkdir -p "$pkgdir/usr/lib/vdr/plugins"
    
      79
    
      80  install -Dm644 00-vdr.conf "$pkgdir/etc/vdr/conf.d/00-vdr.conf"
    
      81  install -Dm644 60-create-dvb-device-units.rules "$pkgdir/usr/lib/udev/rules.d/60-create-dvb-device-units.rules"
    
      82  install -Dm644 vdr.service "$pkgdir/usr/lib/systemd/system/vdr.service"
    
      83
    
      84  install -Dm754 shutdown-wrapper "$pkgdir/usr/lib/vdr/bin/shutdown-wrapper"
    
      85  chgrp 666 "$pkgdir/usr/lib/vdr/bin/shutdown-wrapper"
    
      86  chmod u+s "$pkgdir/usr/lib/vdr/bin/shutdown-wrapper"
    
      87
    
      88  install -Dm755 gen-sddropin "$pkgdir/usr/bin/vdr-gensddropin"
    
      89  install -Dm755 shutdown.sh "$pkgdir/usr/lib/vdr/bin/shutdown.sh"
    
      90
    
      91  #Install sysuser config
    
      92  install -Dm644 ${srcdir}/$pkgbase.sysuser "$pkgdir/usr/lib/sysusers.d/$pkgbase.conf"
    
      93
    
      94  cd "${srcdir}/${pkgbase}-${pkgver}"
    
      95  mkdir -p "$pkgdir/var/lib/vdr"
    
      96  make DESTDIR="${pkgdir}" install
    
      97
    
      98  mkdir -p "$pkgdir/usr/share/vdr/shutdown-hooks"
    
      99
    
      100  chown -R 666:666 "$pkgdir/srv/vdr"
    
      101  chown -R 666:666 "$pkgdir/var/cache/vdr"
    
      102  chown -R 666:666 "$pkgdir/var/lib/vdr"
    
      103}
    
      104
    
      105package_vdr-examples() {
    
      106  pkgdesc="Plugins for vdr to show some possible features"
    
      107  depends=("vdr-api=${_vdrapi}" "gcc-libs" 'ncurses')
    
      108  backup=("etc/vdr/conf.avail/"50-{epgtableid0,hello,osddemo,pictures,skincurses,status,svdrpdemo}.conf
    
      109          "etc/vdr/conf.avail/"50-svc{cli,svr}.conf)
    
      110
    
      111  cd "${srcdir}/${pkgbase}-${pkgver}"
    
      112  make DESTDIR="${pkgdir}" install-plugins
    
      113
    
      114  mkdir -p "$pkgdir/etc/vdr/conf.avail"
    
      115  for i in hello pictures; do
    
      116    install -Dm644 "${srcdir}/50-$i.conf" "$pkgdir/etc/vdr/conf.avail/50-$i.conf"
    
      117  done
    
      118  for i in epgtableid0 osddemo skincurses status svc{cli,svr} svdrpdemo; do
    
      119    echo "[$i]" > "$pkgdir/etc/vdr/conf.avail/50-$i.conf"
    
      120  done
    
      121}
    
      122

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3