vdr-suspendoutput
LOW
maintainer CReimer
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads source code from a non-whitelisted but plausibly project-owned host for building a VDR plugin; all actions are transparent, checksums are provided, and no unverified executables or remote code execution occur.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from a non-whitelisted but plausibly project-owned host for building a VDR plugin; all actions are transparent, checksums are provided, and no unverified executables or remote code execution occur.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
source=("https://phivdr.dyndns.org/vdr/$pkgname/$pkgname-$pkgver.tgz"
PKGBUILD
1 offending line(s) highlighted
1
# This PKGBUILD is part of the VDR4Arch project [https://github.com/vdr4arch]
2
3
# Maintainer: Christopher Reimer <mail+vdr4arch[at]c-reimer[dot]de>
4
pkgname=vdr-suspendoutput
5
pkgver=2.1.0
6
_vdrapi=13
7
pkgrel=17
8
pkgdesc="Output device that does nothing"
9
url="https://phivdr.dyndns.org/vdr/vdr-suspendoutput/"
10
arch=('x86_64' 'i686' 'arm' 'armv6h' 'armv7h' 'aarch64')
11
license=('GPL2')
12
depends=('gcc-libs' "vdr-api=${_vdrapi}")
13
makedepends=('ffmpeg')
14
_plugname=${pkgname//vdr-/}
15
source=("https://phivdr.dyndns.org/vdr/$pkgname/$pkgname-$pkgver.tgz"
16
"$pkgname-nooutput.patch"
17
"$pkgname-timer_fix_vdr2.4.patch"
18
"${pkgname}-vdr-2.7.1-compat.patch"
19
"50-$_plugname.conf")
20
backup=("etc/vdr/conf.avail/50-$_plugname.conf")
21
sha256sums=('3109de8b18431613b8ebd5d9a2dd8b6b730a8efd321beb2b13508ae1825c80ed'
22
'23bfb82b24555fd936538cfc33d232bc8833547182d5429996abf486023ab4b6'
23
'681cade0debc9c22df507a816d3137635b03243dd76f18df648a6df7d3bf7b77'
24
'474aec1d7a61223d214fac994760449631a73939aea6734ed56c20d1fb0b2cb9'
25
'df5a85dd056e5dd99c723bb96ec5f822df3beed97e232a33378542e2e686d8de')
26
27
DLAGENTS=("https::/usr/bin/curl -k -o %o %u")
28
29
prepare() {
30
cd "${srcdir}/${_plugname}-${pkgver}"
31
patch -p1 -i "$srcdir/$pkgname-nooutput.patch"
32
patch -p1 -i "$srcdir/$pkgname-timer_fix_vdr2.4.patch"
33
patch -p1 -i "${srcdir}/${pkgname}-vdr-2.7.1-compat.patch"
34
35
# http://www.vdr-wiki.de/wiki/index.php/Kategorie:Raspbian_VDR_Streaming_Client_mittels_Streamdev_und_rpihddevice#Installation_vorbereiten
36
for i in *.mpg; do
37
mv $i $i.pes
38
ffmpeg -i $i.pes -f mpegts $i
39
done
40
}
41
42
build() {
43
cd "${srcdir}/${_plugname}-${pkgver}"
44
make
45
}
46
47
package() {
48
cd "${srcdir}/${_plugname}-${pkgver}"
49
make DESTDIR="${pkgdir}" install
50
51
install -Dm644 "$srcdir/50-$_plugname.conf" "$pkgdir/etc/vdr/conf.avail/50-$_plugname.conf"
52
}
53
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |