cynthiune.app

maintainer ellenmyklebust · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code from savannah.gnu.org, a legitimate GNU project host, and a Debian archive URL which redirects to a standard Debian mirror; both sources are trustworthy and related to the project, with no evidence of malicious or unverifiable content.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from savannah.gnu.org, a legitimate GNU project host, and a Debian archive URL which redirects to a standard Debian mirror; both sources are trustworthy and related to the project, with no evidence of malicious or unverifiable content.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "http://http.debian.net/debian/pool/main/c/cynthiune.app/cynthiune.app_$pkgver-4.debian.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Michal Wojdyla < micwoj9292 at gmail dot com >
    
      2# Contributor: <mumei AT airmail DOT cc>
    
      3
    
      4_pkgname=Cynthiune
    
      5pkgname=cynthiune.app
    
      6pkgrel=5
    
      7pkgver=1.0.0
    
      8pkgdesc='Free software and romantic music player for GNUstep'
    
      9arch=('i686' 'x86_64')
    
      10url='http://gap.nongnu.org/cynthiune/index.html'
    
      11license=('GPL-2.0-or-later')
    
      12groups=('gnustep-apps')
    
      13depends=('gnustep-base' 'gnustep-gui' 'gnustep-back' 'libmad' 'pulseaudio-alsa' 'libid3tag' 'audiofile' 'libmodplug' 'libao')
    
      14optdepends=('libvorbis' 'libogg' 'libmpcdec' 'esound')
    
      15makedepends=('gcc-objc' 'gnustep-make')
    
      16source=("https://download.savannah.gnu.org/releases/gap/Cynthiune-$pkgver.tar.gz"
    
      17        "http://http.debian.net/debian/pool/main/c/cynthiune.app/cynthiune.app_$pkgver-4.debian.tar.xz")
    
      18sha256sums=('3cc5228c8cdb66256bbcec4b317bbd3853397f09ec9b7378a7f65140eff5bcaf'
    
      19            '64966bef492c4ddf4907c7c2832c4eb80d932ccee190bb3b06490f321ce5a2dd')
    
      20
    
      21prepare() {
    
      22  cd $_pkgname-$pkgver
    
      23  for patch in ../debian/patches/*.patch; do 
    
      24    patch -p1 < $patch
    
      25  done
    
      26
    
      27  # Leave out avifile library until available
    
      28  if test "$pkg-config --exists avifile" != 0; then
    
      29    sed -i '70,73{s/^.*//}' GNUmakefile
    
      30  fi
    
      31  #libmpcdec
    
      32  if test "$pkg-config --exists libmpcdec" != 0; then
    
      33    sed -i '74,76{s/^.*//}' GNUmakefile
    
      34  fi
    
      35  #esound
    
      36  if test "$pkg-config --exists esound" != 0; then
    
      37    sed -i '118,120{s/^.*//}' GNUmakefile
    
      38  fi
    
      39  # Disable taglib
    
      40  sed -i '81,83{s/^.*//}' GNUmakefile
    
      41}
    
      42
    
      43build() {
    
      44  cd $_pkgname-$pkgver
    
      45  export GNUSTEP_MAKEFILES="$(gnustep-config --variable=GNUSTEP_MAKEFILES)"
    
      46  make
    
      47}
    
      48
    
      49package() {
    
      50  cd $_pkgname-$pkgver
    
      51  make DESTDIR="$pkgdir" install
    
      52  install -Dm644 "$pkgdir/usr/lib/GNUstep/Applications/$_pkgname.app/Resources/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2