deezer
LOW
maintainer SibrenVasse
62 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source files and patches from legitimate project hosts (GitHub, npmjs.org, deezer.com) which are not on the whitelist but are plausibly official; all downloads are checksum-verified and used to build a modified Electron wrapper, with no evidence of remote code execution or malicious behavior.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files and patches from legitimate project hosts (GitHub, npmjs.org, deezer.com) which are not on the whitelist but are plausibly official; all downloads are checksum-verified and used to build a modified Electron wrapper, with no evidence of remote code execution or malicious behavior.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
"$pkgname-$pkgver-setup.exe::https://www.deezer.com/desktop/download/artifact-win32-x86-$pkgver"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Sibren Vasse <arch@sibrenvasse.nl>
2
# Contributor: Ilya Gulya <ilyagulya@gmail.com>
3
4
pkgname="deezer"
5
pkgver=7.1.300
6
pkgrel=1
7
8
# Keep this in sync with the formatter version used by aunetx/deezer-linux.
9
# The upstream patches are easier to apply when the extracted Deezer JS/HTML
10
# has been formatted with the same Prettier version.
11
_prettier_ver=3.5.3
12
13
# Runtime MPRIS helper injected into the Electron app.
14
_mpris_ver=2.2.3
15
16
# Commit hash for aunetx/deezer-linux patches.
17
# Pinning the commit keeps the patch contents reproducible.
18
_patch_commit=95b02d57381c4e55fedb0bf14066ff9edd7962ee
19
20
pkgdesc="A proprietary music streaming service"
21
arch=('any')
22
url="https://www.deezer.com/"
23
license=('custom')
24
depends=('electron42' 'hicolor-icon-theme' 'xdg-utils')
25
provides=('deezer')
26
makedepends=('7zip' 'asar' 'imagemagick' 'npm')
27
28
source=(
29
"$pkgname-$pkgver-setup.exe::https://www.deezer.com/desktop/download/artifact-win32-x86-$pkgver"
30
"$pkgname-desktop.desktop"
31
"deezer-desktop"
32
"prettierrc.json"
33
"LICENSE"
34
35
# Download the exact Prettier tarball
36
"prettier-${_prettier_ver}.tgz::https://registry.npmjs.org/prettier/-/prettier-${_prettier_ver}.tgz"
37
38
# Locked npm project for the MPRIS dependency tree.
39
"mpris-package.json"
40
"mpris-package-lock.json"
41
"mpris-service-${_mpris_ver}.tgz::https://registry.npmjs.org/@jellybrick/mpris-service/-/mpris-service-${_mpris_ver}.tgz"
42
43
# Upstream patches from aunetx/deezer-linux.
44
"01-start-in-tray-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/01-start-in-tray.patch"
45
"02-start-without-tray-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/02-start-without-tray.patch"
46
"03-disable-auto-updater-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/03-disable-auto-updater.patch"
47
"04-remove-os-information-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/04-remove-os-information.patch"
48
"05-provide-metadata-mpris-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/05-provide-metadata-mpris.patch"
49
"06-control-log-level-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/06-control-log-level.patch"
50
"07-improve-responsiveness-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/07-improve-responsiveness.patch"
51
"08-hide-offline-banner-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/08-hide-offline-banner.patch"
52
"09-disable-animations-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/09-disable-animations.patch"
53
"10-disable-notifications-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/10-disable-notifications.patch"
54
"11-fix-thumbar-actions-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/11-fix-thumbar-actions.patch"
55
"12-adjust-volume-on-wheel-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/12-adjust-volume-on-wheel.patch"
56
"13-disable-hardware-acceleration-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/13-disable-hardware-acceleration.patch"
57
"15-sync-theme-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/15-sync-theme.patch"
58
59
# Local patches
60
"99-systray-icon.patch"
61
)
62
63
noextract=(
64
"prettier-${_prettier_ver}.tgz"
65
"mpris-service-${_mpris_ver}.tgz"
66
)
67
68
sha256sums=('9bccf2bc2a08a778feadea0db03a4194a62b9c63d4517ae6e46bc94d8236467b'
69
'c33b398d8ae279a620cf2914c806f7ee00c47519e4f404874cfd90a68fc8d80f'
70
'3a23339b7b00d5d6d59768699f585d2565fc1cd7d2c43a254206de3840546eb6'
71
'951c80c9dc4848b31a5fcc9655b005f3a218b1ff735396168c13922ac658c83b'
72
'fe9bab50ef433516105ed2f2c349736c0be87c2f75f8d18bf1f011b2115019c1'
73
'14841de7b71a93123d22997db22d088debb13976778d869e3622199108e85b4b'
74
'1c2449ab478c99ad8b5f6ba545eeb778d279f20a72e64bd6694485c7766d1876'
75
'c18f6d106d5a9320b520c441c5d232ff8f8ce61a98babfd1eb29378e8b68f803'
76
'20c3254c49975b05fe76b6ef650c9db93c5f028ac9e9c9e62c89762acc7076d0'
77
'655681a094721af8fba69b729b8276ee345e5aac99239726c3e53039b0811cef'
78
'd1d2914e4bc9826acd139108ff2010eb3dc51154e35079612bacbf77a8a1d326'
79
'f07df06e56552116ad15bb8ee1c01dede0947dcfeb763a0ddeb8d87732c37f40'
80
'37ba808250e59821b5265a4900c56820e40e2b7ebb295fcac05375eca0daee5b'
81
'd1651ab48109a512fd63c5dab43812bbf3d08d9ff81ddae4ed0ec1cfa9d1d31e'
82
'a88886df73b38a23fd8fac931cad86f7b7d6fb4b51697ba236311869ab09180d'
83
'56a745ec9ab1ba86c8f5dfbba65195fc143e29a6bf28f040034867ee9a8e2154'
84
'b85d40aab533f29cc74d4869363ad4c2bf610d9663e6c48ffcc774542bf70349'
85
'4f59009fac59a740fd053edd6e68c881db97e270430c4be9de19c389908b8545'
86
'2095217bee000f1950d39a7592831fb2640e7f8f7d0c5eff14baa87960072dfe'
87
'a1b13d97b8618e7fb9d3a3376b2cf59aea5260b0fb429fce8fb20b1ead977304'
88
'f3d9a4b13f639260b4147dfe94694ab29448aa254d65748b4f20129d10fe4fb7'
89
'22f55ee12eb4c4d678eabc91d4e6520a9c0381560a74cc51f097ddce8b317673'
90
'bf033d4448546d730db7f19519518e8d6f7fd3498c71d02825ae21e96a798441'
91
'2362c52147cf67759388ba6685e2add32c5bcfcdbdbca8e0990f58cafa0392de')
92
93
_setup_prettier() {
94
# Extract the prettier tarball into a stable location.
95
rm -rf "$srcdir/prettier"
96
mkdir -p "$srcdir/prettier"
97
98
bsdtar -xzf "$srcdir/prettier-${_prettier_ver}.tgz" \
99
-C "$srcdir/prettier" \
100
--strip-components=1
101
}
102
103
_prettier() {
104
# Wrapper around the pinned Prettier CLI.
105
node "$srcdir/prettier/bin/prettier.cjs" "$@"
106
}
107
108
_setup_mpris() {
109
# Install MPRIS support from a locked npm dependency tree.
110
#
111
# mpris-service itself is downloaded through source=() and verified by
112
# sha256sums. The lockfile pins all transitive dependency versions and npm
113
# integrity hashes.
114
rm -rf "$srcdir/mpris-vendor"
115
mkdir -p "$srcdir/mpris-vendor"
116
117
cp "$srcdir/mpris-package.json" "$srcdir/mpris-vendor/package.json"
118
cp "$srcdir/mpris-package-lock.json" "$srcdir/mpris-vendor/package-lock.json"
119
cp "$srcdir/mpris-service-${_mpris_ver}.tgz" "$srcdir/mpris-vendor/"
120
121
npm ci \
122
--prefix "$srcdir/mpris-vendor" \
123
--cache "$srcdir/npm-cache" \
124
--omit=dev \
125
--no-audit \
126
--no-fund \
127
--ignore-scripts
128
129
mkdir -p "$srcdir/resources/app/node_modules"
130
cp -a "$srcdir/mpris-vendor/node_modules/." "$srcdir/resources/app/node_modules/"
131
}
132
133
prepare() {
134
# Extract the Electron app payload from Deezer's Windows installer.
135
7z x -so "$pkgname-$pkgver-setup.exe" "\$PLUGINSDIR/app-32.7z" > app-32.7z
136
137
# Extract the app archive so resources/app.asar can be modified.
138
7z x -y -bsp0 -bso0 app-32.7z
139
140
# Extract PNG icons from Deezer's Windows .ico file.
141
magick resources/win/app.ico resources/win/deezer-%d.png
142
143
# Set up the exact Prettier version used to normalize Deezer's JS/HTML
144
# before applying aunetx/deezer-linux patches.
145
_setup_prettier
146
147
cd resources/
148
149
# Unpack Electron's asar bundle so we can patch the app contents.
150
asar extract app.asar app
151
152
cd "$srcdir/resources/app"
153
mkdir -p resources/linux/
154
155
# Generate small tray icons.
156
for size in 24 48; do
157
magick "$srcdir/resources/win/deezer-8.png" -resize "${size}x${size}" -strip \
158
-define png:compression-filter=5 -define png:compression-level=9 \
159
"resources/linux/systray-${size}.png"
160
done
161
162
# Use the project-specific Prettier config so the generated formatting
163
# matches what the upstream patches expect.
164
cp "$srcdir/prettierrc.json" .prettierrc
165
_prettier --write "build/*.{js,html}"
166
167
# Apply every patch listed in source=().
168
local src
169
for src in "${source[@]}"; do
170
src="${src%%::*}"
171
src="${src##*/}"
172
173
[[ $src = *.patch ]] || continue
174
175
echo "Applying patch ${src}..."
176
patch -Np1 -l -F3 < "${srcdir}/${src}"
177
done
178
179
# Add MPRIS runtime dependencies to the unpacked app.
180
_setup_mpris
181
182
cd "$srcdir/resources/"
183
184
# Repack the modified Electron app.
185
asar pack app app.asar
186
}
187
188
package() {
189
mkdir -p "$pkgdir/usr/share/deezer"
190
mkdir -p "$pkgdir/usr/share/applications"
191
mkdir -p "$pkgdir/usr/bin/"
192
193
for size in 16 22 24 32 48 64 128 256 512; do
194
install -d "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/"
195
196
magick resources/win/deezer-8.png -resize "${size}x${size}" -strip \
197
-define png:compression-filter=5 -define png:compression-level=9 \
198
"$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/deezer-desktop.png"
199
200
chmod 644 "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/deezer-desktop.png"
201
done
202
203
install -Dm644 resources/app.asar "$pkgdir/usr/share/deezer/app.asar"
204
install -Dm644 "$pkgname-desktop.desktop" "$pkgdir/usr/share/applications/$pkgname-desktop.desktop"
205
install -Dm755 deezer-desktop "$pkgdir/usr/bin/deezer-desktop"
206
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
207
}
208
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |