cider

LOW

maintainer jasongodev 31 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The pnpm install is part of building the project from its own source (git checkout), which is a normal AUR practice; the added dev dependency (electron-builder@26.0.0) pins a known version to avoid a build issue and is not an undeclared external package in a malicious sense.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pnpm install is part of building the project from its own source (git checkout), which is a normal AUR practice; the added dev dependency (electron-builder@26.0.0) pins a known version to avoid a build issue and is not an undeclared external package in a malicious sense.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:36 pnpm add -D electron-builder@26.0.0

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jason Go <jasongo@jasongo.net>
    
      2# Contributor: Core_UK <dev@coredev.uk>
    
      3
    
      4pkgname=cider
    
      5pkgver=1.6.3.20260321034536
    
      6pkgrel=2
    
      7pkgdesc='An abandoned Apple Music player using a fork of Cider v1 from taoky/Cider'
    
      8arch=('x86_64')
    
      9url='https://github.com/taoky/Cider'
    
      10license=('AGPL-3.0-only')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'gtk3'
    
      14  'libxcrypt-compat'
    
      15  'nss'
    
      16)
    
      17makedepends=('git' 'nodejs' 'pnpm' 'python')
    
      18optdepends=(
    
      19  'libnotify: Send playback notifications'
    
      20  'gnome-shell-extension-appindicator: Show tray icon in GNOME'
    
      21)
    
      22options=(!buildflags !debug !makeflags !strip)
    
      23source=("git+$url.git#tag=${pkgver##*.}")
    
      24b2sums=('6896547b5cfcc9de8c12d90c32ec4edd9086dab2910d65e7070671f535842b08b5a61b16303901a98d94d73bc7d6c4c68a5a800cb6af3f6a0785eb6d1a3265d5')
    
      25install=cider.install
    
      26
    
      27prepare() {
    
      28  cd Cider
    
      29
    
      30  # Use TOKEN environment variable
    
      31  echo 'localStorage.setItem("lastToken", process.env.TOKEN);' >> ./src/preload/cider-preload.js
    
      32  sed -i "/var prompt = \`Cider is not responding/c\\var prompt = \`Your Apple Music TOKEN is expired or invalid. Edit /usr/share/applications/sh.cider.Cider.desktop and modify the TOKEN value in the Exec line then restart Cider. (Current value of TOKEN=\${lastToken}).\`;" ./src/renderer/main/events.js
    
      33
    
      34  # Prevent weird "SyntaxError: Unexpected end of JSON input" as described here:
    
      35  # https://github.com/electron-userland/electron-builder/issues/9020#issuecomment-2989607912
    
      36  pnpm add -D electron-builder@26.0.0
    
      37
    
      38  pnpm install
    
      39}
    
      40
    
      41build() {
    
      42  cd Cider
    
      43  pnpm run build
    
      44  pnpm exec electron-builder --linux deb --publish=never
    
      45
    
      46  # Extract the deb file
    
      47  bsdtar -xf ./dist/cider*_amd64.deb --include='data.tar*' -O | bsdtar -xf - -C "$srcdir"
    
      48
    
      49  # Add TOKEN environment variable to .desktop file
    
      50  sed -i 's|Exec=/opt/Cider/sh.cider.Cider|Exec=env TOKEN=none CIDER_PORT=9000 /usr/bin/cider|' "$srcdir/usr/share/applications/sh.cider.Cider.desktop"
    
      51
    
      52  # Modify apparmor-profile to include cider link
    
      53  sed -i 's|"/opt/Cider/sh.cider.Cider"|("/opt/Cider/sh.cider.Cider" "/usr/bin/cider")|' "$srcdir/opt/Cider/resources/apparmor-profile"
    
      54}
    
      55
    
      56package() {
    
      57  # 1. CREATE BINARY LINK
    
      58  install -d "$pkgdir/usr/bin/"
    
      59  ln -sf /opt/Cider/sh.cider.Cider "$pkgdir/usr/bin/cider"
    
      60
    
      61  # 2. COPY DEB FILES
    
      62  cp -dr --no-preserve=ownership ./{opt,usr} "$pkgdir"
    
      63
    
      64  # 3. COPY LICENSE AND DOCS
    
      65  install -Dm644 -t "$pkgdir/usr/share/licenses/cider/" ./Cider/LICENSE
    
      66  install -Dm644 -t "$pkgdir/usr/share/doc/cider/" ./Cider/{CODE_OF_CONDUCT.md,README.md}
    
      67
    
      68  # 4. COPY APPARMOR PROFILE
    
      69  install -Dm644 ./opt/Cider/resources/apparmor-profile "$pkgdir/etc/apparmor.d/cider"
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2