alda-bin

LOW

maintainer Ajmeade 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt Alda binaries from the project's own release infrastructure on DigitalOcean Spaces; while the host is not a standard domain, it is plausibly controlled by the project, and the binaries are verified with b2sums, reducing supply-chain risk to low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Alda binaries from the project's own release infrastructure on DigitalOcean Spaces; while the host is not a standard domain, it is plausibly controlled by the project, and the binaries are verified with b2sums, reducing supply-chain risk to low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("alda-player-$pkgver::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/player/non-windows/alda-player")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Arthurmeade12 <s728c3ilp at relay dot firefox dot com>
    
      2# Former Maintainer: Luis Martinez <luis dot martinez at disroot dot org>
    
      3# Former Contributor: 0x715C
    
      4# Last updated September 4th 2026 @Arthurmeade12
    
      5
    
      6pkgname=alda-bin
    
      7pkgver=2.4.7
    
      8pkgrel=1
    
      9pkgdesc='A music programming language for musicians'
    
      10arch=('i686' 'x86_64')
    
      11url='https://github.com/alda-lang/alda'
    
      12license=('EPL-2.0')
    
      13depends=('java-runtime>=8')
    
      14provides=('alda')
    
      15conflicts=('alda') # If it ever appears on the AUR (it was not on the AUR as of 8/16/26), Alda also conflicts with IcedTea (https://openjdk.org/projects/icedtea/). See https://github.com/alda-lang/alda/blob/master/doc/troubleshooting.md#icedtea-related-issues for more.
    
      16source=("alda-player-$pkgver::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/player/non-windows/alda-player")
    
      17# I know namcap complains about having arch-specific sources, but upstream calls x86_64 amd64 and i686 i386. I didn't want to complicate things with an if statement
    
      18source_x86_64=("alda-$pkgver-x86_64::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/client/linux-amd64/alda")
    
      19source_i686=("alda-$pkgver-i686::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/client/linux-386/alda")
    
      20b2sums=('f792b770a2cbf45e1653e8fb744a1f7726b72a8356cb29ec08f714b0e17b9e87daf2c771f764eaf3629a46782b34d57a5c0486f3fcf508bfc28dbf08f8655e99')
    
      21b2sums_x86_64=('327a21623f9764ab3f35ee92e20cdfa9a16c4c162540241c64f848f4e1852f1ebba1f628547f7b43f177591b35f9c08dffed49cc687f424604f787e65913801a')
    
      22b2ums_i686=('7c381afafa560a3a85656a2b23375c4e309340251b3c83be216985506266135ac460f2cc9ebabcf22d467edae65c5b0ac8d882f3f33ad066898368eb8acded98')
    
      23
    
      24package() {
    
      25  install -Dv "alda-$pkgver-$CARCH" "$pkgdir/usr/bin/alda"
    
      26  install -Dv "alda-player-$pkgver" "$pkgdir/usr/bin/alda-player"
    
      27}
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-09-04 00:03
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,10 +1,10 @@
 # Maintainer: Arthurmeade12 <s728c3ilp at relay dot firefox dot com>
 # Former Maintainer: Luis Martinez <luis dot martinez at disroot dot org>
 # Former Contributor: 0x715C
-# Last updated August 16th 2026 @Arthurmeade12
+# Last updated September 4th 2026 @Arthurmeade12
 
 pkgname=alda-bin
-pkgver=2.4.5
+pkgver=2.4.7
 pkgrel=1
 pkgdesc='A music programming language for musicians'
 arch=('i686' 'x86_64')
@@ -12,14 +12,14 @@
 license=('EPL-2.0')
 depends=('java-runtime>=8')
 provides=('alda')
-conflicts=('alda')
+conflicts=('alda') # If it ever appears on the AUR (it was not on the AUR as of 8/16/26), Alda also conflicts with IcedTea (https://openjdk.org/projects/icedtea/). See https://github.com/alda-lang/alda/blob/master/doc/troubleshooting.md#icedtea-related-issues for more.
 source=("alda-player-$pkgver::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/player/non-windows/alda-player")
 # I know namcap complains about having arch-specific sources, but upstream calls x86_64 amd64 and i686 i386. I didn't want to complicate things with an if statement
 source_x86_64=("alda-$pkgver-x86_64::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/client/linux-amd64/alda")
 source_i686=("alda-$pkgver-i686::https://alda-releases.nyc3.digitaloceanspaces.com/$pkgver/client/linux-386/alda")
-b2sums=('64076a6dea20f82f843cea6d60b6e5cc4d09056e80a34aeaf4db408c06af7904880e2ec22d068dd7824beaf3cbec72e8ac9ca263f47847f5868d6e905df99d96')
-b2sums_x86_64=('3e6ea83b85feb97866251f60cb973d2d0f69b8f7c351e9018edc4030a54b6648d3cf4ae7823d19d5155314bda3c3a9631c019b985802219e841fcfd65a5fedc9')
-b2sums_i686=('709e5fb471bf1f093b413079224720b9c7bc3831c20d2b24046e69f7741071db3d786f35b38eb0fc6e8a2ccbbbb8da66b3de4f9b10cab41b518faecf2a83ce86')
+b2sums=('f792b770a2cbf45e1653e8fb744a1f7726b72a8356cb29ec08f714b0e17b9e87daf2c771f764eaf3629a46782b34d57a5c0486f3fcf508bfc28dbf08f8655e99')
+b2sums_x86_64=('327a21623f9764ab3f35ee92e20cdfa9a16c4c162540241c64f848f4e1852f1ebba1f628547f7b43f177591b35f9c08dffed49cc687f424604f787e65913801a')
+b2ums_i686=('7c381afafa560a3a85656a2b23375c4e309340251b3c83be216985506266135ac460f2cc9ebabcf22d467edae65c5b0ac8d882f3f33ad066898368eb8acded98')
 
 package() {
   install -Dv "alda-$pkgver-$CARCH" "$pkgdir/usr/bin/alda"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 23:58:52	Medium	1
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2