vdr-remote

maintainer CReimer · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the upstream project's official domain, used to build the plugin normally; the host is not whitelisted but is plausibly official, and the package installs only compiled code and config files with no remote execution or obfuscation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the upstream project's official domain, used to build the plugin normally; the host is not whitelisted but is plausibly official, and the package installs only compiled code and config files with no remote execution or obfuscation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("http://www.escape-edv.de/endriss/vdr/${pkgname}-${pkgver}.tgz"

PKGBUILD

1 offending line(s) highlighted

      1# This PKGBUILD is part of the VDR4Arch project [https://github.com/vdr4arch]
    
      2
    
      3# Maintainer: Christopher Reimer <mail+vdr4arch[at]c-reimer[dot]de>
    
      4pkgname=vdr-remote
    
      5pkgver=0.7.0
    
      6_vdrapi=13
    
      7pkgrel=20
    
      8pkgdesc="Extends the remote control capabilities of vdr"
    
      9url="http://www.escape-edv.de/endriss/vdr/"
    
      10arch=('x86_64' 'i686' 'arm' 'armv6h' 'armv7h' 'aarch64')
    
      11license=('GPL2')
    
      12depends=('gcc-libs' "vdr-api=${_vdrapi}")
    
      13_plugname=${pkgname//vdr-/}
    
      14source=("http://www.escape-edv.de/endriss/vdr/${pkgname}-${pkgver}.tgz"
    
      15        'av7110_ir_vdr_perms.conf'
    
      16        '70-remote-device.rules'
    
      17        "50-$_plugname.conf")
    
      18backup=("etc/vdr/conf.avail/50-$_plugname.conf")
    
      19md5sums=('21989c0d244dc0de213134be4b8a4fdc'
    
      20         'bc604e2dff886fb683048590fc5f63c8'
    
      21         '773e9b84837b51f3d0aeff8035c6c3ce'
    
      22         '6b163c3d23df45423652f5559f8c6a61')
    
      23
    
      24prepare() {
    
      25  cd "${srcdir}/${_plugname}-${pkgver}"
    
      26
    
      27  # https://www.vdr-portal.de/forum/index.php?thread/135372-announce-vdr-version-2-6-2-freigegeben/&postID=1354402#post1354402
    
      28  sed -i 's/new cLircRemote(devnam\[i\]);/cLircRemote::NewLircRemote(devnam[i]);/' remote.c
    
      29}
    
      30
    
      31build() {
    
      32  cd "${srcdir}/${_plugname}-${pkgver}"
    
      33  make
    
      34}
    
      35
    
      36package() {
    
      37  cd "${srcdir}/${_plugname}-${pkgver}"
    
      38  make DESTDIR="${pkgdir}" install
    
      39
    
      40  install -Dm644 ${srcdir}/70-remote-device.rules "$pkgdir/usr/lib/udev/rules.d/70-remote-device.rules"
    
      41  install -Dm644 ${srcdir}/av7110_ir_vdr_perms.conf "$pkgdir/usr/lib/modprobe.d/av7110_ir_vdr_perms.conf"
    
      42
    
      43  install -Dm644 "$srcdir/50-$_plugname.conf" "$pkgdir/etc/vdr/conf.avail/50-$_plugname.conf"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2