xnviewmp-system-libs
LOW
maintainer Corax
31 votes
scanned 2026-10-05 00:08:03.938595
Why flagged
The package downloads a source tarball from the official xnview.com domain, which is the project's legitimate release host; despite the static analyzer flagging it as non-standard, the source is verifiable and the build process is transparent, posing no significant security risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from the official xnview.com domain, which is the project's legitimate release host; despite the static analyzer flagging it as non-standard, the source is verifiable and the build process is transparent, posing no significant security risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
source=("XnViewMP-linux-x64_${pkgver}-rel${srcrel}.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-${pkgver}-linux-x64.tgz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Kevin Brodsky <corax26 'at' gmail 'dot' com>
2
3
pkgname=xnviewmp-system-libs
4
_pkgname=xnviewmp
5
pkgver=1.11.6
6
srcrel=1 # Incremented when there is a new release for the same version number
7
pkgrel=1
8
pkgdesc="An efficient multimedia viewer, browser and converter (using system libraries)."
9
url="https://www.xnview.com/en/xnviewmp/"
10
11
arch=('x86_64')
12
license=('custom')
13
depends=(
14
# Main Qt dependencies
15
'qt5-location' 'qt5-multimedia' 'qt5-quickcontrols2' 'qt5-svg' 'qt5-x11extras'
16
# libmdk dependency
17
'libc++'
18
# Plugin libs
19
'libjxl' 'libwebp' 'openjpeg2' 'openexr'
20
)
21
optdepends=('glib2: support for moving files to trash')
22
conflicts=('xnviewmp')
23
24
source=("XnViewMP-linux-x64_${pkgver}-rel${srcrel}.tgz::https://download.xnview.com/old_versions/XnView_MP/XnView_MP-${pkgver}-linux-x64.tgz"
25
'xnview.sh'
26
'XnView.desktop'
27
'qt5_std_fun_forwarder.S'
28
'qt5_std_fun_forwarder.lds')
29
sha256sums=('3a4a9f80fbf4dcbef0681c78d42cfd52b22eb0129095822e49689452c6287b2c'
30
'87ec80c5049745dc3018fcdcf4dddf0e877ae3b20706705f2a80715232ad2141'
31
'f6b3a4aaa0a55b5f21d9b91ab6f3da3d6ee077ba7fdd17e7c4ab1c69ad2a9e3a'
32
'd4fc1e262f68b7b6b9767ca73870a78f06410035fb97a8bc495f4e1f28416563'
33
'3d6da484cd55eac8910d5cf87f9057e6eadeac842a249dcbda35e1c6f3fcdc0d')
34
35
# There is a lot of useless files in the archive, only install those from that
36
# list.
37
installed_files_dirs=(
38
AddOn
39
country.txt
40
language
41
license.txt
42
PrintPresets.txt
43
ResizePresets.txt
44
UI
45
WhatsNew.txt
46
XnView
47
xnview_2.png
48
xnview.png
49
)
50
51
executable_files=(
52
AddOn/exiftool
53
XnView
54
)
55
56
build() {
57
# This is massive hack to work around an incompatibility with the system Qt5
58
# libraries. On 0.93.1, the dynamic linker fails to start XnView, complaining
59
# that:
60
# symbol _ZNSt20bad_array_new_lengthD1Ev version Qt_5 not defined in file libQt5Gui.so.5 with link time reference
61
# (and other functions related to the std::bad_array_new_length class).
62
#
63
# It seems that the Qt5 libraries shipped in the archive changed in 0.93.1,
64
# and they now declare these functions, but our system libs on Arch don't!
65
# Since these are STL functions, the workaround is to manually define these
66
# functions in a tiny shared library, and implement them by calling the STL
67
# functions in libstdc++. This is frankly horrible, but it has worked fine
68
# since 0.93.1 so fingers crossed it will stay this way!
69
gcc -fPIC -shared -lstdc++ \
70
-Wl,--version-script="${srcdir}/qt5_std_fun_forwarder.lds" \
71
-o "${srcdir}/qt5_std_fun_forwarder.so" \
72
"${srcdir}/qt5_std_fun_forwarder.S"
73
}
74
75
package() {
76
cd "${srcdir}/XnView"
77
78
local pkg_opt_dir=${pkgdir}/opt/${_pkgname}
79
80
install -d -m755 "${pkg_opt_dir}"
81
# The permissions set in the archive are unreliable and excessive (too many
82
# executable files). Instead of copying them, we chmod the files that
83
# actually need to be executable.
84
cp -r --no-preserve=mode "${installed_files_dirs[@]}" "${pkg_opt_dir}"
85
for file in "${executable_files[@]}"; do
86
chmod a+x "${pkg_opt_dir}/${file}"
87
done
88
89
# The plugin libs that XnView packages are included as dependencies, but
90
# XnView will only look for them in the Plugins directory (regardless of the
91
# linker paths). Create symlinks as needed.
92
install -d -m755 "${pkg_opt_dir}/Plugins"
93
ln -s /usr/lib/libwebp.so "${pkg_opt_dir}/Plugins/libwebp.so"
94
ln -s /usr/lib/libOpenEXR.so "${pkg_opt_dir}/Plugins/libOpenEXR.so"
95
ln -s /usr/lib/libopenjp2.so "${pkg_opt_dir}/Plugins/openjp2.so"
96
# This seems to be a custom library that links against libjxl and is required
97
# for opening JPEG XL images, use it as-is.
98
install -D -m644 "Plugins/libJPEGXL.so" -t "${pkg_opt_dir}/Plugins"
99
100
# Using the system libraw doesn't seem to work (assertion failure in libc when
101
# attempting to view a RAW file), use the one provided.
102
install -D -m644 "lib/liblibraw.so.1" -t "${pkg_opt_dir}/lib"
103
# There is no package for libmdk, which is anyway distributed as binary, so
104
# just use the one provided.
105
install -D -m644 "lib/libmdk.so.0" -t "${pkg_opt_dir}/lib"
106
# From Adobe XMP Toolkit SDK, apparently not packaged on Arch.
107
install -D -m644 "lib/libXMPCore.so" -t "${pkg_opt_dir}/lib"
108
install -D -m644 "lib/libXMPFiles.so" -t "${pkg_opt_dir}/lib"
109
110
install -m755 "${srcdir}/xnview.sh" "${pkg_opt_dir}"
111
112
# Install our "function forwarder library" (see build()). xnview.sh forces the
113
# dynamic linker to use it by adding it to LD_PRELOAD.
114
install -D -m644 "${srcdir}/qt5_std_fun_forwarder.so" -t "${pkg_opt_dir}/lib"
115
116
install -d -m755 "${pkgdir}/usr/bin"
117
ln -s "/opt/${_pkgname}/xnview.sh" "${pkgdir}/usr/bin/${_pkgname}"
118
119
install -D -m644 "${srcdir}/XnView.desktop" -t "${pkgdir}/usr/share/applications/"
120
install -D -m644 "${srcdir}/XnView/license.txt" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
121
}
122
123
# vim:set ts=2 sw=2 et:
124
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |