alda-bin

LOW

maintainer Ajmeade 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt binaries from the project's own release infrastructure (DigitalOcean Spaces bucket 'alda-releases'), which is plausibly official; while the host is not a standard forge, it hosts the project's legitimate binaries, and checksums are provided, reducing risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's own release infrastructure (DigitalOcean Spaces bucket 'alda-releases'), which is plausibly official; while the host is not a standard forge, it hosts the project's legitimate binaries, and checksums are provided, reducing risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("alda-player-$pkgver::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/player/non-windows/alda-player")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Arthurmeade12 <ajmeade at proton dot me>
    
      2# Former Maintainer: Luis Martinez <luis dot martinez at disroot dot org>
    
      3# Former Contributor: 0x715C
    
      4# Last updated October 24th 2026 @Arthurmeade12
    
      5
    
      6pkgname=alda-bin
    
      7pkgver=2.4.8
    
      8pkgrel=1
    
      9pkgdesc='A music programming language for musicians'
    
      10arch=('i686' 'x86_64')
    
      11url='https://github.com/alda-lang/alda'
    
      12license=('EPL-2.0')
    
      13depends=('java-runtime>=8')
    
      14provides=('alda')
    
      15conflicts=('alda' 'icedtea-web')
    
      16source=("alda-player-$pkgver::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/player/non-windows/alda-player")
    
      17# I know namcap complains about having arch-specific sources, but upstream calls x86_64 amd64 and i686 i386. I didn't want to complicate things with an if statement
    
      18source_x86_64=("alda-$pkgver-x86_64::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/client/linux-amd64/alda")
    
      19source_i686=("alda-$pkgver-i686::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/client/linux-386/alda")
    
      20b2sums=('deb295cc208c58517043462cfc3532957f0852618dd6ccedbbc54fc5688992a28c0df957b4642be6ce711ec732981e10891a6b91046ed2bc45239e5c7313c768')
    
      21b2sums_x86_64=('8ee24cb264e2ec7f3ea01fd481ff1ba49d4213f54f3f39a004cc5ec229b39170c01db9abca341fa06a02cecc4497ee48d15dd1f8e51e23a7a39efa8f2d41e4b5')
    
      22b2sums_i686=('26897610ef2e73024bcfc3ea879b198ffaef27ea805fde3dbd5ce7eed0b116168b148f9510ab5a3a903b5b1940933274673a20384d188fc28d30cd435b530e77')
    
      23
    
      24package() {
    
      25  install -Dv "alda-$pkgver-$CARCH" "$pkgdir/usr/bin/alda"
    
      26  install -Dv "alda-player-$pkgver" "$pkgdir/usr/bin/alda-player"
    
      27}
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-10-25 00:20
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,10 +1,10 @@
-# Maintainer: Arthurmeade12 <s728c3ilp at relay dot firefox dot com>
+# Maintainer: Arthurmeade12 <ajmeade at proton dot me>
 # Former Maintainer: Luis Martinez <luis dot martinez at disroot dot org>
 # Former Contributor: 0x715C
-# Last updated September 4th 2026 @Arthurmeade12
+# Last updated October 24th 2026 @Arthurmeade12
 
 pkgname=alda-bin
-pkgver=2.4.7
+pkgver=2.4.8
 pkgrel=1
 pkgdesc='A music programming language for musicians'
 arch=('i686' 'x86_64')
@@ -12,14 +12,14 @@
 license=('EPL-2.0')
 depends=('java-runtime>=8')
 provides=('alda')
-conflicts=('alda') # If it ever appears on the AUR (it was not on the AUR as of 8/16/26), Alda also conflicts with IcedTea (https://openjdk.org/projects/icedtea/). See https://github.com/alda-lang/alda/blob/master/doc/troubleshooting.md#icedtea-related-issues for more.
+conflicts=('alda' 'icedtea-web')
 source=("alda-player-$pkgver::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/player/non-windows/alda-player")
 # I know namcap complains about having arch-specific sources, but upstream calls x86_64 amd64 and i686 i386. I didn't want to complicate things with an if statement
 source_x86_64=("alda-$pkgver-x86_64::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/client/linux-amd64/alda")
 source_i686=("alda-$pkgver-i686::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/client/linux-386/alda")
-b2sums=('f792b770a2cbf45e1653e8fb744a1f7726b72a8356cb29ec08f714b0e17b9e87daf2c771f764eaf3629a46782b34d57a5c0486f3fcf508bfc28dbf08f8655e99')
-b2sums_x86_64=('327a21623f9764ab3f35ee92e20cdfa9a16c4c162540241c64f848f4e1852f1ebba1f628547f7b43f177591b35f9c08dffed49cc687f424604f787e65913801a')
-b2ums_i686=('7c381afafa560a3a85656a2b23375c4e309340251b3c83be216985506266135ac460f2cc9ebabcf22d467edae65c5b0ac8d882f3f33ad066898368eb8acded98')
+b2sums=('deb295cc208c58517043462cfc3532957f0852618dd6ccedbbc54fc5688992a28c0df957b4642be6ce711ec732981e10891a6b91046ed2bc45239e5c7313c768')
+b2sums_x86_64=('8ee24cb264e2ec7f3ea01fd481ff1ba49d4213f54f3f39a004cc5ec229b39170c01db9abca341fa06a02cecc4497ee48d15dd1f8e51e23a7a39efa8f2d41e4b5')
+b2sums_i686=('26897610ef2e73024bcfc3ea879b198ffaef27ea805fde3dbd5ce7eed0b116168b148f9510ab5a3a903b5b1940933274673a20384d188fc28d30cd435b530e77')
 
 package() {
   install -Dv "alda-$pkgver-$CARCH" "$pkgdir/usr/bin/alda"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 03:41:34	Medium	1
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2