cider

maintainer jasongodev · 30 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pnpm install is part of building the project from its own source (git checkout), which is a normal AUR practice; the added dev dependency (electron-builder@26.0.0) pins a known version to avoid a build issue and is not an undeclared external package in a malicious sense.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pnpm install is part of building the project from its own source (git checkout), which is a normal AUR practice; the added dev dependency (electron-builder@26.0.0) pins a known version to avoid a build issue and is not an undeclared external package in a malicious sense.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:36 pnpm add -D electron-builder@26.0.0

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jason Go <jasongo@jasongo.net>
    
      2# Contributor: Core_UK <dev@coredev.uk>
    
      3
    
      4pkgname=cider
    
      5pkgver=1.6.3.20260321034536
    
      6pkgrel=2
    
      7pkgdesc='An abandoned Apple Music player using a fork of Cider v1 from taoky/Cider'
    
      8arch=('x86_64')
    
      9url='https://github.com/taoky/Cider'
    
      10license=('AGPL-3.0-only')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'gtk3'
    
      14  'libxcrypt-compat'
    
      15  'nss'
    
      16)
    
      17makedepends=('git' 'nodejs' 'pnpm' 'python')
    
      18optdepends=(
    
      19  'libnotify: Send playback notifications'
    
      20  'gnome-shell-extension-appindicator: Show tray icon in GNOME'
    
      21)
    
      22options=(!buildflags !debug !makeflags !strip)
    
      23source=("git+$url.git#tag=${pkgver##*.}")
    
      24b2sums=('6896547b5cfcc9de8c12d90c32ec4edd9086dab2910d65e7070671f535842b08b5a61b16303901a98d94d73bc7d6c4c68a5a800cb6af3f6a0785eb6d1a3265d5')
    
      25install=cider.install
    
      26
    
      27prepare() {
    
      28  cd Cider
    
      29
    
      30  # Use TOKEN environment variable
    
      31  echo 'localStorage.setItem("lastToken", process.env.TOKEN);' >> ./src/preload/cider-preload.js
    
      32  sed -i "/var prompt = \`Cider is not responding/c\\var prompt = \`Your Apple Music TOKEN is expired or invalid. Edit /usr/share/applications/sh.cider.Cider.desktop and modify the TOKEN value in the Exec line then restart Cider. (Current value of TOKEN=\${lastToken}).\`;" ./src/renderer/main/events.js
    
      33
    
      34  # Prevent weird "SyntaxError: Unexpected end of JSON input" as described here:
    
      35  # https://github.com/electron-userland/electron-builder/issues/9020#issuecomment-2989607912
    
      36  pnpm add -D electron-builder@26.0.0
    
      37
    
      38  pnpm install
    
      39}
    
      40
    
      41build() {
    
      42  cd Cider
    
      43  pnpm run build
    
      44  pnpm exec electron-builder --linux deb --publish=never
    
      45
    
      46  # Extract the deb file
    
      47  bsdtar -xf ./dist/cider*_amd64.deb --include='data.tar*' -O | bsdtar -xf - -C "$srcdir"
    
      48
    
      49  # Add TOKEN environment variable to .desktop file
    
      50  sed -i 's|Exec=/opt/Cider/sh.cider.Cider|Exec=env TOKEN=none CIDER_PORT=9000 /usr/bin/cider|' "$srcdir/usr/share/applications/sh.cider.Cider.desktop"
    
      51
    
      52  # Modify apparmor-profile to include cider link
    
      53  sed -i 's|"/opt/Cider/sh.cider.Cider"|("/opt/Cider/sh.cider.Cider" "/usr/bin/cider")|' "$srcdir/opt/Cider/resources/apparmor-profile"
    
      54}
    
      55
    
      56package() {
    
      57  # 1. CREATE BINARY LINK
    
      58  install -d "$pkgdir/usr/bin/"
    
      59  ln -sf /opt/Cider/sh.cider.Cider "$pkgdir/usr/bin/cider"
    
      60
    
      61  # 2. COPY DEB FILES
    
      62  cp -dr --no-preserve=ownership ./{opt,usr} "$pkgdir"
    
      63
    
      64  # 3. COPY LICENSE AND DOCS
    
      65  install -Dm644 -t "$pkgdir/usr/share/licenses/cider/" ./Cider/LICENSE
    
      66  install -Dm644 -t "$pkgdir/usr/share/doc/cider/" ./Cider/{CODE_OF_CONDUCT.md,README.md}
    
      67
    
      68  # 4. COPY APPARMOR PROFILE
    
      69  install -Dm644 ./opt/Cider/resources/apparmor-profile "$pkgdir/etc/apparmor.d/cider"
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2