bili-music

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own GitHub source; the flagged 'cargo install tauri-cli' in prepare() fetches a build tool from crates.io (the official Rust registry), which is a common but slightly risky pattern since it pulls an unversioned/unpinned dependency at build time, though not malicious.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The package builds from the project's own GitHub source; the flagged 'cargo install tauri-cli' in prepare() fetches a build tool from crates.io (the official Rust registry), which is a common but slightly risky pattern since it pulls an unversioned/unpinned dependency at build time, though not malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:47 cargo install tauri-cli

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=bili-music
    
      3_pkgname='Bili Music'
    
      4_zhsname='午夜黑胶'
    
      5pkgver=0.3.3
    
      6_nodeversion=20
    
      7pkgrel=1
    
      8pkgdesc="A desktop music player based on Tauri v2 + Rust, which uses the music area of Bilibili as a music library to listen to songs."
    
      9arch=('any')
    
      10url="https://github.com/Jmiao11/bili-music"
    
      11license=('LicenseRef-PolyForm-Strict-License-1.0.0')
    
      12provides=("${pkgname%-git}=${pkgver%.r*}")
    
      13conflicts=("${pkgname%-git}")
    
      14depends=(
    
      15    'gtk3'
    
      16    'gdk-pixbuf2'
    
      17    'webkit2gtk-4.1'
    
      18)
    
      19makedepends=(
    
      20    'git'
    
      21    'curl'
    
      22    'rustup'
    
      23    'gendesk'
    
      24)
    
      25source=(
    
      26    "${pkgname}-${pkgver}::git+${url}.git#tag=v${pkgver}"
    
      27)
    
      28sha256sums=('69f3fe9b4e1e366aee8a58bea885d57ef708358598f93cec23be8e0a0f467106')
    
      29_set_build_env() {
    
      30    export CARGO_HOME="${srcdir}/.cargo"
    
      31    if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      32        export RUSTUP_DIST_SERVER="https://mirrors.aliyun.com/rustup"
    
      33        export RUSTUP_UPDATE_ROOT="https://mirrors.aliyun.com/rustup/rustup"
    
      34    fi
    
      35}
    
      36prepare() {
    
      37    cd "${srcdir}/${pkgname}-${pkgver}"
    
      38    _set_build_env
    
      39    gendesk -q -f -n \
    
      40        --pkgname="${pkgname}" \
    
      41        --pkgdesc="${pkgdesc}" \
    
      42        --categories="AudioVideo" \
    
      43        --name="${_pkgname}" \
    
      44        --custom=Name[zh_CN]="${_zhsname}" \
    
      45        --exec="${pkgname} %U"
    
      46    rustup default stable
    
      47    cargo install tauri-cli
    
      48}
    
      49build() {
    
      50    cd "${srcdir}/${pkgname}-${pkgver}"
    
      51    _set_build_env
    
      52    cargo tauri build
    
      53}
    
      54package() {
    
      55    install -Dm755 "${srcdir}/${pkgname}-${pkgver}/target/release/${pkgname}" -t "${pkgdir}/usr/bin"
    
      56    install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      57    install -Dm644 "${srcdir}/${pkgname}-${pkgver}/design/app-icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      58    install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE.md" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      59}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 11:19:29	LOW	3
2026-07-31 11:17:50	MEDIUM	2