bitwig-studio

LOW

maintainer stylemistake 135 votes scanned 2026-08-27 19:33:23.106999

View on AUR

Why flagged

The package downloads a .deb from the official Bitwig website over HTTPS; despite the non-whitelisted host, it is the project's own release infrastructure, and the checksum is verified, making it a standard AUR build with low risk.

Triggered rules

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a .deb from the official Bitwig website over HTTPS; despite the non-whitelisted host, it is the project's own release infrastructure, and the checksum is verified, making it a standard AUR build with low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("bitwig-studio-${_pkgver}.deb::https://www.bitwig.com/dl/Bitwig%20Studio/${_pkgver}/installer_linux/")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aleksej Komarov <stylemistake@gmail.com>
    
      2# Upstream: Bitwig GmbH <support@bitwig.com>
    
      3
    
      4pkgname='bitwig-studio'
    
      5pkgver='6.1.0'
    
      6_pkgver='6.1'
    
      7pkgrel='1'
    
      8pkgdesc='Digital audio workstation for music production, remixing and live performance'
    
      9arch=('x86_64')
    
      10url='https://www.bitwig.com/'
    
      11license=('custom')
    
      12depends=('xdg-utils' 'xcb-util-wm' 'libbsd')
    
      13optdepends=('jack' 'alsa-lib' 'oss' 'ffmpeg: MP3 support')
    
      14provides=('clap-host' 'vst-host' 'vst3-host')
    
      15replaces=()
    
      16conflicts=('bitwig-studio-legacy' 'bitwig-8-track')
    
      17options=(!strip)
    
      18source=("bitwig-studio-${_pkgver}.deb::https://www.bitwig.com/dl/Bitwig%20Studio/${_pkgver}/installer_linux/")
    
      19sha256sums=('7496f09fc24d1ee499fe5290578ce849b6ed84374797827b86198e67901d0363')
    
      20
    
      21package() {
    
      22  # Unpack package contents
    
      23  bsdtar -xf ${srcdir}/data.tar.zst -C ${pkgdir}/
    
      24
    
      25  # Install license
    
      26  install -D -m644 ${pkgdir}/opt/bitwig-studio/EULA.rtf ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      27}
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-07-07 00:22
+++ PKGBUILD @ 2026-08-27 19:33
@@ -2,8 +2,8 @@
 # Upstream: Bitwig GmbH <support@bitwig.com>
 
 pkgname='bitwig-studio'
-pkgver='6.0.11'
-_pkgver='6.0.11'
+pkgver='6.1.0'
+_pkgver='6.1'
 pkgrel='1'
 pkgdesc='Digital audio workstation for music production, remixing and live performance'
 arch=('x86_64')
@@ -16,7 +16,7 @@
 conflicts=('bitwig-studio-legacy' 'bitwig-8-track')
 options=(!strip)
 source=("bitwig-studio-${_pkgver}.deb::https://www.bitwig.com/dl/Bitwig%20Studio/${_pkgver}/installer_linux/")
-sha256sums=('ae7aff67ccba9252ab536813e7f5d3fac46bca5fc7659674e27e7ae4bd073c4c')
+sha256sums=('7496f09fc24d1ee499fe5290578ce849b6ed84374797827b86198e67901d0363')
 
 package() {
   # Unpack package contents

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-27 19:33:23	Low	2
2026-07-07 00:22:52	Clean	2
2026-07-06 13:21:03	Low	1
2026-06-26 10:25:02	Clean	2
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Low	1