xpcog
LOW
maintainer KDDLB
0 votes
scanned 2026-08-31 00:19:57.373659
Why flagged
The package builds from source and uses a pinned vcpkg commit for dependency management, which is checked at prepare time; network access is required but the sources are deterministic and no untrusted executables are downloaded or executed.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source and uses a pinned vcpkg commit for dependency management, which is checked at prepare time; network access is required but the sources are deterministic and no untrusted executables are downloaded or executed.
PKGBUILD
1
# Maintainer: Kevin López Brante <kevin@kddlb.cl>
2
3
# XPCog for Arch, built against the distribution's libraries.
4
#
5
# The presets are not used here and that is deliberate: each one names a build
6
# directory under the source tree and sets VCPKG_BINARY_SOURCES to a cache
7
# inside it, neither of which a package build wants. What this configures by
8
# hand is `linux-repo-release` -- XPCOG_USE_SYSTEM_LIBS=ON plus RelWithDebInfo
9
# -- with the three differences set out below.
10
#
11
# **This build reaches the network.** vcpkg cannot be avoided: mgba, libvgm and
12
# the four libraries the project never substitutes (libogg, libflac, libvorbis,
13
# zlib) have no system path in cmake/XPCogSystemDeps.cmake, and vcpkg downloads
14
# each port's sources itself rather than from source=(). The vcpkg tree is
15
# pinned below and checked against the manifest, so what varies is the download
16
# and not the version; a build in a network-isolated chroot will still fail.
17
18
pkgname=xpcog
19
pkgver=1.0.0
20
pkgrel=1
21
pkgdesc="Audio player ported from Cog, for the formats other players do not open"
22
arch=('x86_64')
23
url="https://cog.losno.co/xpcog"
24
license=('GPL-2.0-or-later')
25
26
# What the built binaries link from the repositories.
27
#
28
# This list is not only a declaration, it is what makes the build deterministic.
29
# cmake/XPCogSystemDeps.cmake decides per library, at configure time, whether the
30
# system has one good enough -- so on a machine without libsidplayfp installed,
31
# vcpkg quietly builds its own and the package links that instead. makepkg
32
# installs depends before build(), so naming them here is what guarantees the
33
# system copy is the one found, and that two builds of the same pkgver agree.
34
#
35
# libogg, libflac, libvorbis and zlib are absent on purpose: those four are never
36
# substituted, vcpkg builds them static, and they end up inside the executable
37
# rather than beside it.
38
depends=(
39
'wxwidgets-gtk3' 'glib2' 'gcc-libs'
40
'ffmpeg' 'taglib' 'sqlite' 'libopenmpt' 'libgme' 'libarchive'
41
'curl' 'opusfile' 'wavpack' 'libsoxr' 'rubberband' 'libmpcdec'
42
'libsidplayfp' 'hicolor-icon-theme'
43
)
44
# nlohmann-json is header-only, so it is wanted at build time and never linked.
45
# Here for the determinism reason above rather than to save the download.
46
makedepends=('cmake' 'ninja' 'git' 'pkgconf' 'zip' 'unzip' 'curl' 'tar'
47
'nlohmann-json')
48
49
# The vcpkg commit is pinned to the manifest's builtin-baseline, and prepare()
50
# checks that it still is. Left unpinned this would resolve ports from whatever
51
# vcpkg's default branch says today, which is the one way this package could
52
# start producing a different program from the same pkgver.
53
_vcpkg_commit=17f35ad2418007a895ced8a4cece4ab34068a58d
54
55
source=(
56
"$pkgname-$pkgver.tar.gz::https://github.com/losnoco/XPCog/archive/refs/tags/v$pkgver.tar.gz"
57
"vcpkg::git+https://github.com/microsoft/vcpkg.git#commit=$_vcpkg_commit"
58
)
59
# The release tarball is checksummed; the vcpkg tree is not, because a git
60
# source is pinned by its commit and makepkg wants SKIP for one.
61
sha256sums=(
62
'78f30470ff2c01bd69673af8b05ce9ca32e628e9f2ca05f5f2db28b2ec2e5385'
63
'SKIP'
64
)
65
66
prepare() {
67
# That the pin above and the manifest agree. They are two files that have to
68
# say the same commit, and nothing else would notice them drifting apart --
69
# vcpkg would resolve ports against the tree it was given and build something
70
# subtly different without a word.
71
local baseline
72
baseline=$(sed -n 's/.*"builtin-baseline"[[:space:]]*:[[:space:]]*"\([0-9a-f]*\)".*/\1/p' \
73
"XPCog-$pkgver/vcpkg.json")
74
75
if [ "$baseline" != "$_vcpkg_commit" ]; then
76
echo "PKGBUILD: _vcpkg_commit is $_vcpkg_commit but vcpkg.json's" >&2
77
echo "builtin-baseline is $baseline. Update _vcpkg_commit to match." >&2
78
return 1
79
fi
80
}
81
82
build() {
83
# The Last.fm credentials come through the environment, and nothing here has
84
# to forward them: makepkg runs build() with the environment it was invoked
85
# with, and app/CMakeLists.txt reads XPCOG_LASTFM_API_KEY and
86
# XPCOG_LASTFM_API_SECRET from there when the cache variables are unset. So
87
#
88
# XPCOG_LASTFM_API_KEY=... XPCOG_LASTFM_API_SECRET=... makepkg -si
89
#
90
# produces a package that can scrobble, and a plain `makepkg -si` produces one
91
# that compiles all of the scrobbling code and reports the feature as
92
# unavailable. Deliberately not a -D: that would put the secret in
93
# CMakeCache.txt, which outlives the environment that supplied it.
94
#
95
# Said out loud in the log so a package built without them is not a surprise
96
# discovered later in the Last.fm pane.
97
if [ -n "$XPCOG_LASTFM_API_KEY" ] && [ -n "$XPCOG_LASTFM_API_SECRET" ]; then
98
echo "Last.fm: credentials supplied to this build."
99
else
100
echo "Last.fm: no credentials; scrobbling will report itself unavailable."
101
fi
102
103
export VCPKG_ROOT="$srcdir/vcpkg"
104
# vcpkg ships a bootstrap script rather than a binary in the git tree.
105
[ -x "$VCPKG_ROOT/vcpkg" ] || "$VCPKG_ROOT/bootstrap-vcpkg.sh" -disableMetrics
106
107
# Three differences from linux-repo-release, each with a reason a package has
108
# and a developer build does not:
109
#
110
# sentry OFF -- crash reporting is the upstream project's, pointed at the
111
# project's own Sentry, and a distribution package is not
112
# the right thing to send reports from. It also drops
113
# sentry-native, crashpad and libunwind from the vcpkg
114
# build, and frees the system libcurl: cmake/XPCogSystemDeps
115
# forces vcpkg's curl whenever sentry is asked for, so that
116
# one process cannot end up holding two libcurls.
117
#
118
# tests OFF -- the suite is not what ships, and building it here would
119
# pull Catch2 in for binaries the package discards.
120
#
121
# libdir -- lib/xpcog rather than lib. The one bundled shared library
122
# is vcpkg's libvgmstream.so, and dropping a private copy of
123
# it into /usr/lib would claim a name a real vgmstream
124
# package may want. cmake/XPCogInstallRuntime.cmake derives
125
# both the install destination and the $ORIGIN rpath from
126
# CMAKE_INSTALL_LIBDIR, so setting it is the whole change.
127
cmake -S "XPCog-$pkgver" -B build -G Ninja \
128
-DCMAKE_TOOLCHAIN_FILE="$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" \
129
-DCMAKE_BUILD_TYPE=RelWithDebInfo \
130
-DCMAKE_INSTALL_PREFIX=/usr \
131
-DCMAKE_INSTALL_LIBDIR=lib/xpcog \
132
-DXPCOG_USE_SYSTEM_LIBS=ON \
133
-DXPCOG_BUILD_TESTS=OFF \
134
-DXPCOG_WITH_SENTRY=OFF \
135
-DVCPKG_MANIFEST_FEATURES="ffmpeg;vgmstream;mgba;psf-cores;sid;musepack;adplug;libvgm" \
136
-DXPCOG_WITH_FFMPEG=ON \
137
-DXPCOG_WITH_VGMSTREAM=ON \
138
-DXPCOG_WITH_PSF=ON \
139
-DXPCOG_WITH_SID=ON \
140
-DXPCOG_WITH_MUSEPACK=ON \
141
-DXPCOG_WITH_MIDI=ON \
142
-DXPCOG_WITH_ADPLUG=ON \
143
-DXPCOG_WITH_LIBVGM=ON
144
145
cmake --build build
146
}
147
148
package() {
149
DESTDIR="$pkgdir" cmake --install build
150
151
install -Dm644 "XPCog-$pkgver/COPYING" \
152
"$pkgdir/usr/share/licenses/$pkgname/COPYING"
153
}
154
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 23:44:22 | Low | 2 |