antra-bin

MEDIUM

maintainer h8ray 0 votes scanned 2026-10-25 17:43:03.910647

View on AUR

Why flagged

The package installs an AppImage from a GitHub release without verifying its internal integrity, creating a supply-chain risk if the source is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs an AppImage from a GitHub release without verifying its internal integrity, creating a supply-chain risk if the source is compromised.

PKGBUILD

      1# See contacts at https://aur.archlinux.org/cgit/aur.git/tree/README.md?h=antra-bin
    
      2
    
      3pkgname=antra-bin
    
      4_pkgname=antra
    
      5__pkgname=Antra
    
      6pkgver=1.1.8
    
      7pkgrel=1
    
      8pkgdesc="A desktop music library builder that supports Spotify, YouTube Music, Apple Music, Amazon Music, Tidal, Qobuz, and Deezer"
    
      9arch=("x86_64")
    
      10url="https://github.com/anandprtp/Antra"
    
      11license=("Elastic-2.0")
    
      12depends=('glib2' 'webkit2gtk-4.1' 'gtk3' 'gdk-pixbuf2' 'libsoup3')
    
      13provides=("${_pkgname}")
    
      14conflicts=("${_pkgname}")
    
      15source=("https://github.com/anandprtp/Antra/releases/download/v${pkgver}/${__pkgname}-Linux.AppImage")
    
      16sha256sums=('83ec796a9ffa9ea75e55c71d575933de4060f72e9f6e9957229fae06bef9efdd')
    
      17
    
      18prepare() {
    
      19  chmod +x "${__pkgname}-Linux.AppImage"
    
      20
    
      21  "./${__pkgname}-Linux.AppImage" --appimage-extract
    
      22}
    
      23
    
      24package() {
    
      25  mkdir -vp "${pkgdir}/usr/bin"
    
      26  cp -v --no-preserve=ownership --preserve=mode "squashfs-root/usr/bin/${__pkgname}" "${pkgdir}/usr/bin/"
    
      27
    
      28  mkdir -vp "${pkgdir}/usr/share/applications"
    
      29  cp -v --no-preserve=ownership --preserve=mode "squashfs-root/usr/share/applications/${__pkgname}.desktop" "${pkgdir}/usr/share/applications/"
    
      30
    
      31  mkdir -vp "${pkgdir}/usr/share/icons/hicolor/512x512/apps"
    
      32  cp -v --no-preserve=ownership --preserve=mode "squashfs-root/usr/share/icons/hicolor/512x512/apps/${__pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/"
    
      33
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-25 17:43:03	Medium	2