vdr-examples-git
maintainer M-Reimer
· 1 votes
· base
vdr-git
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The non-standard host hosts only supplemental patch and config files, not executable code, and the main source is from a legitimate project-owned git repository; the worst case from a swapped source is limited to configuration or patch tampering, not code execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host hosts only supplemental patch and config files, not executable code, and the main source is from a legitimate project-owned git repository; the worst case from a swapped source is limited to configuration or patch tampering, not code execution.
2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
source=("$pkgbase::git+http://git.tvdr.de/vdr.git"
MEDIUM
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:97
chmod u+s "$pkgdir/usr/lib/vdr/bin/shutdown-wrapper"
PKGBUILD
2 offending line(s) highlighted
1
# This PKGBUILD is part of the VDR4Arch project [https://github.com/vdr4arch]
2
3
# Maintainer: Manuel Reimer <manuel.reimer@gmx.de>
4
pkgbase=vdr-git
5
pkgname=(vdr-git vdr-examples-git)
6
pkgver=2.6.3.r0.g8b14723
7
_vdrapi=2.6.3
8
pkgrel=1
9
url="http://tvdr.de/"
10
arch=('x86_64' 'i686' 'arm' 'armv6h' 'armv7h' 'aarch64')
11
license=('GPL2')
12
makedepends=('fontconfig' 'libcap' 'libjpeg-turbo' 'libsystemd' 'perl' 'ttf-font' 'systemd' 'ncurses')
13
_vdrrepo="https://raw.githubusercontent.com/VDR4Arch/vdr4arch/c71d217dd54c21d97bed2c3806e0453787f8598a/vdr"
14
source=("$pkgbase::git+http://git.tvdr.de/vdr.git"
15
"$_vdrrepo/vdr-MainMenuHooks.patch"
16
"$_vdrrepo/00-vdr.conf"
17
"$_vdrrepo/50-hello.conf"
18
"$_vdrrepo/50-pictures.conf"
19
"$_vdrrepo/60-create-dvb-device-units.rules"
20
"$_vdrrepo/gen-sddropin"
21
"$_vdrrepo/shutdown.sh"
22
"$_vdrrepo/shutdown-wrapper.c"
23
"$_vdrrepo/vdr.service"
24
"$_vdrrepo/vdr.sysuser")
25
sha256sums=('SKIP'
26
'4c553065d24ee4dc001c06ff588494db44982b7debe9a1e6cd1a8903beb7c87b'
27
'86f2469f459e2aabfc0ab703fc8435e458e89c4879376e900160d083924097b3'
28
'423656cb6ba39af52d379dee697c52e6f435c098daa8c2ba429c1247b757af50'
29
'39f4c2886328dc947dbef70dbc37d42504dc5c9d6a2ad81bf0c41d26fa3a5d6a'
30
'1d914d6308a2b79ede34b7670788e5dfd3a8fab24156353555a66c9ef0bb41d7'
31
'54a901d735d200ba3e2df4d9f45e1e537832a868c6ae5ae42ed3ff1a4c2c3f05'
32
'7313a8db29693fa84d19be7b715b3ab04fd77eddcb52682588cc0a094764b6ba'
33
'17b82fd995e9a39ad8d73d46b586d6c1934a6747c2859bd6d6df22ed254b5c4b'
34
'f33f42a77bd93f00e7aa18f22667f0097468de76a0269c6e35fdc0fd2e30f6e6'
35
'7ca24fe1df90ffc20ae7fc6578193874b21ef8f303d7aac421d394a6106eef2a')
36
37
pkgver() {
38
cd "$pkgname"
39
git describe --long | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
40
}
41
42
prepare() {
43
cd "${srcdir}/${pkgbase}"
44
45
echo 'CFLAGS += -O3' > Make.config
46
echo 'CXXFLAGS += -O3' >> Make.config
47
echo 'PREFIX = /usr' >> Make.config
48
echo 'LIBDIR = /usr/lib/vdr/plugins' >> Make.config
49
echo 'VDR_USER = vdr' >> Make.config
50
echo 'SDNOTIFY = 1' >> Make.config
51
echo 'LIRC_DEVICE = /run/lirc/lircd' >> Make.config
52
53
# Custom extensions
54
patch -p1 -i "$srcdir/vdr-MainMenuHooks.patch"
55
56
# Don't install plugins with VDR
57
sed -i '/^install: /s/install-plugins //' Makefile
58
}
59
60
build() {
61
gcc -o shutdown-wrapper shutdown-wrapper.c
62
63
cd "${srcdir}/${pkgbase}"
64
make
65
}
66
67
package_vdr-git() {
68
pkgdesc="'open' digital satellite receiver and timer controlled video disk recorder"
69
depends=('fontconfig' 'libcap' 'libjpeg-turbo' 'libsystemd' 'perl' 'ttf-font')
70
optdepends=('lirc-utils: remote control support'
71
'vdr-xorg: To start X11')
72
replaces=('runvdr-extreme')
73
conflicts=('runvdr-extreme' vdr)
74
provides=("vdr-api=$_vdrapi" vdr)
75
install='vdr.install'
76
options=(emptydirs)
77
backup=('etc/vdr/conf.d/00-vdr.conf'
78
'var/lib/vdr/camresponses.conf'
79
'var/lib/vdr/channels.conf'
80
'var/lib/vdr/diseqc.conf'
81
'var/lib/vdr/keymacros.conf'
82
'var/lib/vdr/scr.conf'
83
'var/lib/vdr/sources.conf'
84
'var/lib/vdr/svdrphosts.conf')
85
86
# Ship this one empty so it's there even without plugin packages installed
87
mkdir -p "$pkgdir/etc/vdr/conf.avail"
88
# This one has to be shipped empty or some plugins (streamdev) fail to build
89
mkdir -p "$pkgdir/usr/lib/vdr/plugins"
90
91
install -Dm644 00-vdr.conf "$pkgdir/etc/vdr/conf.d/00-vdr.conf"
92
install -Dm644 60-create-dvb-device-units.rules "$pkgdir/usr/lib/udev/rules.d/60-create-dvb-device-units.rules"
93
install -Dm644 vdr.service "$pkgdir/usr/lib/systemd/system/vdr.service"
94
95
install -Dm754 shutdown-wrapper "$pkgdir/usr/lib/vdr/bin/shutdown-wrapper"
96
chgrp 666 "$pkgdir/usr/lib/vdr/bin/shutdown-wrapper"
97
chmod u+s "$pkgdir/usr/lib/vdr/bin/shutdown-wrapper"
98
99
install -Dm755 gen-sddropin "$pkgdir/usr/bin/vdr-gensddropin"
100
install -Dm755 shutdown.sh "$pkgdir/usr/lib/vdr/bin/shutdown.sh"
101
102
#Install sysuser config
103
install -Dm644 ${srcdir}/vdr.sysuser "$pkgdir/usr/lib/sysusers.d/vdr.conf"
104
105
cd "${srcdir}/${pkgbase}"
106
mkdir -p "$pkgdir/var/lib/vdr"
107
make DESTDIR="${pkgdir}" install
108
109
mkdir -p "$pkgdir/usr/share/vdr/shutdown-hooks"
110
111
chown -R 666:666 "$pkgdir/srv/vdr"
112
chown -R 666:666 "$pkgdir/var/cache/vdr"
113
chown -R 666:666 "$pkgdir/var/lib/vdr"
114
}
115
116
package_vdr-examples-git() {
117
pkgdesc="Plugins for vdr to show some possible features"
118
depends=("vdr-api=${_vdrapi}" "gcc-libs" 'ncurses')
119
conflicts=(vdr-examples)
120
provides=(vdr-examples)
121
backup=("etc/vdr/conf.avail/"50-{epgtableid0,hello,osddemo,pictures,skincurses,status,svdrpdemo}.conf
122
"etc/vdr/conf.avail/"50-svc{cli,svr}.conf)
123
124
cd "${srcdir}/${pkgbase}"
125
make DESTDIR="${pkgdir}" install-plugins
126
127
mkdir -p "$pkgdir/etc/vdr/conf.avail"
128
for i in hello pictures; do
129
install -Dm644 "${srcdir}/50-$i.conf" "$pkgdir/etc/vdr/conf.avail/50-$i.conf"
130
done
131
for i in epgtableid0 osddemo skincurses status svc{cli,svr} svdrpdemo; do
132
echo "[$i]" > "$pkgdir/etc/vdr/conf.avail/50-$i.conf"
133
done
134
}
135
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |
| 2026-07-15 00:09:25 | LOW | 3 |