bitwig-studio-beta
LOW
maintainer clpwn
6 votes
scanned 2026-10-03 00:23:04.761738
Why flagged
The package downloads a Debian installer from a non-whitelisted but official Bitwig domain (bitwig.com) for building; this is the project's own release infrastructure, so despite the non-standard URL pattern, it poses no supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Debian installer from a non-whitelisted but official Bitwig domain (bitwig.com) for building; this is the project's own release infrastructure, so despite the non-standard URL pattern, it poses no supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:28
source=("$_pkgname-$pkgver.deb::https://www.bitwig.com/dl/Bitwig%20Studio/${_pkgver}%20Beta%20${pkgver##*.}/installer_linux/")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jake McGinty <me@jakebot.org>
2
# Co-Maintainer: storbake
3
# Contributor: Jonathon Fernyhough <jonathon at_m2x+dev>
4
# Contributor: Aleksej Komarov <stylemistake@gmail.com>
5
# Contributor: MKzero <info[at]linux-web-development[dot]de>
6
# Upstream: Bitwig GmbH <support@bitwig.com>
7
8
# Original PKGBUILD taken wholesale from stylemistake's bitwig-studio package
9
# JF added a prepare() to allow side-by-side installation with release version
10
11
pkgname=bitwig-studio-beta
12
_pkgname=bitwig-studio
13
_pkgver=6.1
14
pkgver=${_pkgver}.6
15
pkgrel=1
16
pkgdesc='Digital audio workstation for music production, remixing and live performance'
17
arch=('x86_64')
18
url='https://www.bitwig.com/'
19
license=('custom')
20
# Deps from bitwig-studio package
21
#depends=('jack' 'xdg-utils' 'zenity' 'xcb-util-wm' 'libbsd')
22
# Deps as suggested by namcap...
23
depends=('gtk3' 'lib32-libx11' 'lib32-libxkbcommon' 'libxkbcommon-x11' 'xcb-util' 'xcb-util-wm')
24
optdepends=('alsa-lib' 'jack' 'oss' 'ffmpeg: MP3 support')
25
provides=('bitwig-studio')
26
options=(!strip)
27
#source=("$_pkgname-$pkgver.deb::https://downloads.bitwig.com/${_pkgver}%20Beta%20${pkgver#*beta}/bitwig-studio-${pkgver}.deb")
28
source=("$_pkgname-$pkgver.deb::https://www.bitwig.com/dl/Bitwig%20Studio/${_pkgver}%20Beta%20${pkgver##*.}/installer_linux/")
29
b2sums=('5195c2ad4f2a92d384310f60737e3e28d32bec4a7f083450ea99a1967b2f22a9e190b31ec8296ea034e22c234a0f2285c4daeeabb98068d777ee98722f52b03e')
30
31
prepare() {
32
msg2 "Unpacking archive contents..."
33
bsdtar -xf "${srcdir}/data.tar.zst" -C ${srcdir}/
34
35
msg2 "Moving things around so we can install side-by-side with bitwig-studio..."
36
cd ${srcdir}/opt/
37
mv ${_pkgname} ${pkgname}
38
39
cd ${srcdir}/usr/
40
rm bin/${_pkgname}
41
ln -s /opt/${pkgname}/${_pkgname} bin/${pkgname}
42
43
cd share/
44
mv applications/com.bitwig.BitwigStudio.desktop applications/com.bitwig.BitwigStudioBeta.desktop
45
sed -i "s|${_pkgname}|${pkgname}|g;
46
s|Bitwig Studio|Bitwig Studio Beta|g;
47
s|BitwigStudio|BitwigStudioBeta|g;
48
12s|bitwig-|bitwig-beta-|g;" applications/com.bitwig.BitwigStudioBeta.desktop
49
50
mv metainfo/com.bitwig.BitwigStudio.appdata.xml metainfo/com.bitwig.BitwigStudioBeta.appdata.xml
51
sed -i "5s|BitwigStudio|BitwigStudioBeta|;
52
8s|Bitwig Studio|Bitwig Studio Beta|;
53
s|application/bitwig-|application/bitwig-beta-|g" metainfo/com.bitwig.BitwigStudioBeta.appdata.xml
54
55
mv mime/packages/com.bitwig.BitwigStudio.xml mime/packages/com.bitwig.BitwigStudioBeta.xml
56
sed -i "s|bitwig-|bitwig-beta-|g;
57
s|BitwigStudio|BitwigStudioBeta|g;
58
s|Studio |Studio Beta |g" mime/packages/com.bitwig.BitwigStudioBeta.xml
59
60
cd icons/hicolor/
61
for icon in 48x48/apps/*.png 128x128/apps/*png scalable/apps/*.svg; do
62
mv "$icon" "${icon/Studio/StudioBeta}"
63
done
64
for icon in scalable/mimetypes/*.svg; do
65
mv "$icon" "${icon/Studio/StudioBeta}"
66
done
67
}
68
69
package() {
70
mv ${srcdir}/{opt,usr} ${pkgdir}/
71
72
# Install license
73
install -D -m644 ${pkgdir}/opt/${pkgname}/EULA.rtf ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
74
}
75
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |