vgmstream-git
maintainer Deewiant
· 10 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The non-standard host is xiph.org, a well-known and trusted open-source multimedia project; the downloaded tarballs are source code for building dependencies, not executables, and are checksum-verified.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is xiph.org, a well-known and trusted open-source multimedia project; the downloaded tarballs are source code for building dependencies, not executables, and are checksum-verified.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
https://downloads.xiph.org/releases/celt/celt-0.6.1.tar.gz
PKGBUILD
1 offending line(s) highlighted
1
pkgname=vgmstream-git
2
pkgver=r2117.58.g70304141
3
pkgrel=1
4
pkgdesc='Library for playback of various streamed audio formats used in video games'
5
arch=(x86_64)
6
url='https://github.com/vgmstream/vgmstream'
7
license=(ISC)
8
depends=(ffmpeg libao libatrac9-git libogg libvorbis mpg123 speex)
9
makedepends=(audacious git glib2 pango)
10
optdepends=('audacious: for using the bundled plugin')
11
provides=(vgmstream libvgmstream)
12
conflicts=(vgmstream vgmstream-kode54-git)
13
replaces=(vgmstream-kode54-git)
14
source=(${pkgname}::git+https://github.com/vgmstream/vgmstream.git
15
https://downloads.xiph.org/releases/celt/celt-0.6.1.tar.gz
16
https://downloads.xiph.org/releases/celt/celt-0.11.0.tar.gz
17
remove-bogus-gtk2.patch
18
install-headers.patch)
19
sha256sums=('SKIP'
20
'a991dff4a9e0772ede0881d81cdc7ac559148c2194885cbdd534fe4af43779da'
21
'c94d4d34f5a2caa1574b1a94869202cacd959b55f643a8bafe0660008acad9c3'
22
'0290744235adb549c66643dfebc728ceeb81dd53ab5cd867a8e8bf75cd17e63c'
23
'1f17d57e222306bc9bbe74cbf8b72676b035370478aa7336ddd55e81847a2496')
24
25
pkgver() {
26
cd "$srcdir/$pkgname"
27
git describe --tags --long | tr - .
28
}
29
30
prepare() {
31
cd "$srcdir/$pkgname"
32
patch -p0 < "$srcdir"/remove-bogus-gtk2.patch
33
patch -p0 < "$srcdir"/install-headers.patch
34
}
35
36
celt_symbols=(
37
alg_quant
38
alg_unquant
39
celt_decode
40
celt_decoder_create
41
celt_decoder_create_custom
42
celt_decoder_destroy
43
celt_mode_create
44
celt_mode_destroy
45
celt_mode_info
46
celt_encoder_destroy
47
celt_encoder_create
48
celt_encode
49
celt_encode_float
50
celt_encoder_ctl
51
celt_decode_float
52
celt_decoder_ctl
53
compute_allocation
54
compute_band_energies
55
denormalise_bands
56
ec_dec_init
57
ec_decode
58
ec_decode_bin
59
ec_dec_update
60
ec_dec_uint
61
ec_dec_bits
62
ec_enc_init
63
ec_encode
64
ec_encode_bin
65
ec_enc_uint
66
ec_enc_bits
67
ec_enc_done
68
normalise_bands
69
renormalise_vector
70
quant_coarse_energy
71
quant_fine_energy
72
quant_energy_finalise
73
unquant_coarse_energy
74
unquant_energy_finalise
75
unquant_fine_energy)
76
77
build() {
78
celt06_cflags="$CFLAGS -fPIC"
79
for sym in ${celt_symbols[@]}; do
80
celt06_cflags+=" -D$sym=${sym}_0061"
81
done
82
celt11_cflags="${celt06_cflags//_0061/_0110} -DCUSTOM_MODES=1"
83
84
make -f /dev/stdin <<EOF
85
all .PHONY: $srcdir/celt-0.6.1 $srcdir/celt-0.11.0
86
$srcdir/celt-0.6.1:
87
cd "\$@" && CFLAGS="$celt06_cflags" ./configure
88
\$(MAKE) -C "\$@"
89
$srcdir/celt-0.11.0:
90
cd "\$@" && CFLAGS="$celt11_cflags" ./configure
91
\$(MAKE) -C "\$@"
92
EOF
93
94
cd "$srcdir/$pkgname"
95
./bootstrap
96
CFLAGS="$CFLAGS -DVGM_USE_FFMPEG -DVGM_USE_MPEG -DVGM_USE_VORBIS -DVGM_USE_G7221 -DVGM_USE_ATRAC9 -DVGM_USE_CELT -DVGM_USE_SPEEX" \
97
LIBS="-lavcodec -lavformat -lavutil -latrac9 $srcdir/celt-0.6.1/libcelt/.libs/libcelt.a $srcdir/celt-0.11.0/libcelt/.libs/libcelt0.a -lm" \
98
./configure --prefix=/usr
99
make -f Makefile.autotools
100
}
101
102
package() {
103
cd "$srcdir/$pkgname"
104
make -f Makefile.autotools install DESTDIR="$pkgdir"
105
install -Dm644 -t "$pkgdir"/usr/share/licenses/$pkgname COPYING
106
}
107
108
check() {
109
cd "$srcdir/$pkgname"
110
make -f Makefile.autotools install DESTDIR="$srcdir/test"
111
printf '#include <vgmstream/%s.h>\n' vgmstream libvgmstream | gcc -E - -I "$srcdir/test/usr/include" -o /dev/null
112
}
113
114
# vim:set sw=2 et:
115
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |