xnviewmp-system-libs

MEDIUM

maintainer Corax 31 votes scanned 2026-08-20 21:12:41.539726

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("XnViewMP-linux-x64_${pkgver}-rel${srcrel}.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-${pkgver}-linux-x64.tgz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kevin Brodsky <corax26 'at' gmail 'dot' com>
    
      2
    
      3pkgname=xnviewmp-system-libs
    
      4_pkgname=xnviewmp
    
      5pkgver=1.11.5
    
      6srcrel=1 # Incremented when there is a new release for the same version number
    
      7pkgrel=1
    
      8pkgdesc="An efficient multimedia viewer, browser and converter (using system libraries)."
    
      9url="https://www.xnview.com/en/xnviewmp/"
    
      10
    
      11arch=('x86_64')
    
      12license=('custom')
    
      13depends=(
    
      14  # Main Qt dependencies
    
      15  'qt5-location' 'qt5-multimedia' 'qt5-quickcontrols2' 'qt5-svg' 'qt5-x11extras'
    
      16  # libmdk dependency
    
      17  'libc++'
    
      18  # Plugin libs
    
      19  'libjxl' 'libwebp' 'openjpeg2' 'openexr'
    
      20)
    
      21optdepends=('glib2: support for moving files to trash')
    
      22conflicts=('xnviewmp')
    
      23
    
      24source=("XnViewMP-linux-x64_${pkgver}-rel${srcrel}.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-${pkgver}-linux-x64.tgz"
    
      25        'xnview.sh'
    
      26        'XnView.desktop'
    
      27        'qt5_std_fun_forwarder.S'
    
      28        'qt5_std_fun_forwarder.lds')
    
      29sha256sums=('736c272f3007a59d9247fb6786f7a4d34d442386c1ceb262fae090261e96a9b7'
    
      30            '87ec80c5049745dc3018fcdcf4dddf0e877ae3b20706705f2a80715232ad2141'
    
      31            'f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a'
    
      32            '6cc9a42023c698a93e5608278e414ccbe9f1be94bff575160450174c529cbb19'
    
      33            '3d6da484cd55eac8910d5cf87f9057e6eadeac842a249dcbda35e1c6f3fcdc0d')
    
      34
    
      35# There is a lot of useless files in the archive, only install those from that
    
      36# list.
    
      37installed_files_dirs=(
    
      38  AddOn
    
      39  country.txt
    
      40  language
    
      41  license.txt
    
      42  PrintPresets.txt
    
      43  ResizePresets.txt
    
      44  UI
    
      45  WhatsNew.txt
    
      46  XnView
    
      47  xnview_2.png
    
      48  xnview.png
    
      49)
    
      50
    
      51executable_files=(
    
      52  AddOn/exiftool
    
      53  XnView
    
      54)
    
      55
    
      56build() {
    
      57  # This is massive hack to work around an incompatibility with the system Qt5
    
      58  # libraries. On 0.93.1, the dynamic linker fails to start XnView, complaining
    
      59  # that:
    
      60  #   symbol _ZNSt20bad_array_new_lengthD1Ev version Qt_5 not defined in file libQt5Gui.so.5 with link time reference
    
      61  # (and other functions related to the std::bad_array_new_length class).
    
      62  #
    
      63  # It seems that the Qt5 libraries shipped in the archive changed in 0.93.1,
    
      64  # and they now declare these functions, but our system libs on Arch don't!
    
      65  # Since these are STL functions, the workaround is to manually define these
    
      66  # functions in a tiny shared library, and implement them by calling the STL
    
      67  # functions in libstdc++. This is frankly horrible, but it has worked fine
    
      68  # since 0.93.1 so fingers crossed it will stay this way!
    
      69  gcc -fPIC -shared -lstdc++ \
    
      70    -Wl,--version-script="${srcdir}/qt5_std_fun_forwarder.lds" \
    
      71    -o "${srcdir}/qt5_std_fun_forwarder.so" \
    
      72    "${srcdir}/qt5_std_fun_forwarder.S"
    
      73}
    
      74
    
      75package() {
    
      76  cd "${srcdir}/XnView"
    
      77
    
      78  local pkg_opt_dir=${pkgdir}/opt/${_pkgname}
    
      79
    
      80  install -d -m755 "${pkg_opt_dir}"
    
      81  # The permissions set in the archive are unreliable and excessive (too many
    
      82  # executable files). Instead of copying them, we chmod the files that
    
      83  # actually need to be executable.
    
      84  cp -r --no-preserve=mode "${installed_files_dirs[@]}" "${pkg_opt_dir}"
    
      85  for file in "${executable_files[@]}"; do
    
      86    chmod a+x "${pkg_opt_dir}/${file}"
    
      87  done
    
      88
    
      89  # The plugin libs that XnView packages are included as dependencies, but
    
      90  # XnView will only look for them in the Plugins directory (regardless of the
    
      91  # linker paths). Create symlinks as needed.
    
      92  install -d -m755 "${pkg_opt_dir}/Plugins"
    
      93  ln -s /usr/lib/libwebp.so "${pkg_opt_dir}/Plugins/libwebp.so"
    
      94  ln -s /usr/lib/libOpenEXR.so "${pkg_opt_dir}/Plugins/libOpenEXR.so"
    
      95  ln -s /usr/lib/libopenjp2.so "${pkg_opt_dir}/Plugins/openjp2.so"
    
      96  # This seems to be a custom library that links against libjxl and is required
    
      97  # for opening JPEG XL images, use it as-is.
    
      98  install -D -m644 "Plugins/libJPEGXL.so" -t "${pkg_opt_dir}/Plugins"
    
      99
    
      100  # Using the system libraw doesn't seem to work (assertion failure in libc when
    
      101  # attempting to view a RAW file), use the one provided.
    
      102  install -D -m644 "lib/liblibraw.so.1" -t "${pkg_opt_dir}/lib"
    
      103  # There is no package for libmdk, which is anyway distributed as binary, so
    
      104  # just use the one provided.
    
      105  install -D -m644 "lib/libmdk.so.0" -t "${pkg_opt_dir}/lib"
    
      106  # From Adobe XMP Toolkit SDK, apparently not packaged on Arch.
    
      107  install -D -m644 "lib/libXMPCore.so" -t "${pkg_opt_dir}/lib"
    
      108  install -D -m644 "lib/libXMPFiles.so" -t "${pkg_opt_dir}/lib"
    
      109
    
      110  install -m755 "${srcdir}/xnview.sh" "${pkg_opt_dir}"
    
      111
    
      112  # Install our "function forwarder library" (see build()). xnview.sh forces the
    
      113  # dynamic linker to use it by adding it to LD_PRELOAD.
    
      114  install -D -m644 "${srcdir}/qt5_std_fun_forwarder.so" -t "${pkg_opt_dir}/lib"
    
      115
    
      116  install -d -m755 "${pkgdir}/usr/bin"
    
      117  ln -s "/opt/${_pkgname}/xnview.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      118
    
      119  install -D -m644 "${srcdir}/XnView.desktop" -t "${pkgdir}/usr/share/applications/"
    
      120  install -D -m644 "${srcdir}/XnView/license.txt" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
    
      121}
    
      122
    
      123# vim:set ts=2 sw=2 et:
    
      124

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-20 21:12
@@ -2,7 +2,7 @@
 
 pkgname=xnviewmp-system-libs
 _pkgname=xnviewmp
-pkgver=1.11.2
+pkgver=1.11.5
 srcrel=1 # Incremented when there is a new release for the same version number
 pkgrel=1
 pkgdesc="An efficient multimedia viewer, browser and converter (using system libraries)."
@@ -26,10 +26,10 @@
         'XnView.desktop'
         'qt5_std_fun_forwarder.S'
         'qt5_std_fun_forwarder.lds')
-sha256sums=('f940a7884d4e2f0050a3158902596dc038b91da613d821dea4b8af8cfdb7edd1'
+sha256sums=('736c272f3007a59d9247fb6786f7a4d34d442386c1ceb262fae090261e96a9b7'
             '87ec80c5049745dc3018fcdcf4dddf0e877ae3b20706705f2a80715232ad2141'
             'f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a'
-            'f9ee40f03a1783dd5844d2fcd4a8986a982800d8adf75f7a787799f961d09a11'
+            '6cc9a42023c698a93e5608278e414ccbe9f1be94bff575160450174c529cbb19'
             '3d6da484cd55eac8910d5cf87f9057e6eadeac842a249dcbda35e1c6f3fcdc0d')
 
 # There is a lot of useless files in the archive, only install those from that

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 21:12:41	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-19 18:54:17	Clean	2
2026-06-18 16:11:54	Medium	1