vst-preset-generator
maintainer actionless
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a tarball from tuxfamily.org, a known free software hosting provider, which is not on the standard whitelist but is a legitimate project host; the package builds from source and installs only binaries and static assets, with no evidence of malicious or remote code execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from tuxfamily.org, a known free software hosting provider, which is not on the standard whitelist but is a legitimate project host; the package builds from source and installs only binaries and static assets, with no evidence of malicious or remote code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
${_reponame}.tar.gz::https://download.tuxfamily.org/vpg/$pkgver/vpg-$pkgver-src.tar.gz
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yauheni Kirylau <actionless dot loveless AT gmail MF com>
2
pkgname=vst-preset-generator
3
_reponame=vpg
4
pkgver=0.3.0
5
pkgrel=1
6
pkgdesc="GUI tool for generating VST presets in FXP/FXB formats"
7
arch=('x86_64')
8
url="https://vst-preset-generator.org/"
9
license=('GPLv2')
10
depends=(qt5-base)
11
makedepends=(gcc cmake vst2sdk )
12
optdepends=('asciidoctor-pdf: generate-docs')
13
source=(
14
${_reponame}.tar.gz::https://download.tuxfamily.org/vpg/$pkgver/vpg-$pkgver-src.tar.gz
15
)
16
sha256sums=('8bd4970d154ef73722d29e02de6b5827754efcc97a9d651e948aaf60d1114601')
17
18
19
build(){
20
cd $srcdir/$_reponame/vst-preset-gen.r113
21
qmake -makefile src/vpg.pro
22
make
23
if which asciidoctor-pdf ; then
24
asciidoctor -r asciidoctor-pdf -b pdf -o vpg-doc.pdf ./doc/vpg.asciidoc
25
fi
26
}
27
28
package(){
29
cd $srcdir/$_reponame/vst-preset-gen.r113
30
install -Dm755 vpg -t $pkgdir/usr/bin/
31
if test -f vpg-doc.pdf ; then
32
install -Dm755 vpg-doc.pdf -t $pkgdir/usr/share/doc/$pkgname
33
fi
34
install -Dm755 LICENSE -t $pkgdir/usr/share/doc/$pkgname
35
install -Dm644 build/package/vst-preset-generator.desktop \
36
"$pkgdir/usr/share/applications/vst-preset-generator.desktop"
37
install -Dm644 build/package/vpg_128x128.png \
38
"$pkgdir"/usr/share/icons/hicolor/scalable/apps/vpg.png
39
install -Dm644 build/package/vpg_128x128.png \
40
"$pkgdir"/usr/share/icons/hicolor/128x128/apps/vpg.png
41
install -Dm644 build/package/vpg_48x48.png \
42
"$pkgdir"/usr/share/icons/hicolor/48x48/apps/vpg.png
43
install -Dm644 build/package/vpg_32x32.png \
44
"$pkgdir"/usr/share/icons/hicolor/32x32/apps/vpg.png
45
}
46
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |