deezer
maintainer SibrenVasse
· 62 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads sources from non-whitelisted hosts like npmjs.org and raw.githubusercontent.com, but these are legitimate project and dependency sources; all downloads are checksum-verified and used to build a modified Electron wrapper for Deezer, with no evidence of malicious or unverifiable code execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads sources from non-whitelisted hosts like npmjs.org and raw.githubusercontent.com, but these are legitimate project and dependency sources; all downloads are checksum-verified and used to build a modified Electron wrapper for Deezer, with no evidence of malicious or unverifiable code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
"$pkgname-$pkgver-setup.exe::https://www.deezer.com/desktop/download/artifact-win32-x86-$pkgver"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Sibren Vasse <arch@sibrenvasse.nl>
2
# Contributor: Ilya Gulya <ilyagulya@gmail.com>
3
4
pkgname="deezer"
5
pkgver=7.1.290
6
pkgrel=1
7
8
# Keep this in sync with the formatter version used by aunetx/deezer-linux.
9
# The upstream patches are easier to apply when the extracted Deezer JS/HTML
10
# has been formatted with the same Prettier version.
11
_prettier_ver=3.5.3
12
13
# Runtime MPRIS helper injected into the Electron app.
14
_mpris_ver=2.1.5
15
16
# Commit hash for aunetx/deezer-linux patches.
17
# Pinning the commit keeps the patch contents reproducible.
18
_patch_commit=637353333e63aa120c1d29a73124449611afa53a
19
20
pkgdesc="A proprietary music streaming service"
21
arch=('any')
22
url="https://www.deezer.com/"
23
license=('custom')
24
depends=('electron41' 'hicolor-icon-theme' 'xdg-utils')
25
provides=('deezer')
26
makedepends=('7zip' 'asar' 'imagemagick' 'npm')
27
28
source=(
29
"$pkgname-$pkgver-setup.exe::https://www.deezer.com/desktop/download/artifact-win32-x86-$pkgver"
30
"$pkgname-desktop.desktop"
31
"deezer-desktop"
32
"prettierrc.json"
33
"LICENSE"
34
35
# Download the exact Prettier tarball
36
"prettier-${_prettier_ver}.tgz::https://registry.npmjs.org/prettier/-/prettier-${_prettier_ver}.tgz"
37
38
# Locked npm project for the MPRIS dependency tree.
39
"mpris-package.json"
40
"mpris-package-lock.json"
41
"mpris-service-${_mpris_ver}.tgz::https://registry.npmjs.org/@jellybrick/mpris-service/-/mpris-service-${_mpris_ver}.tgz"
42
43
# Upstream patches from aunetx/deezer-linux.
44
"01-start-in-tray-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/01-start-in-tray.patch"
45
"02-start-without-tray-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/02-start-without-tray.patch"
46
"03-disable-auto-updater-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/03-disable-auto-updater.patch"
47
"04-remove-os-information-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/04-remove-os-information.patch"
48
"05-provide-metadata-mpris-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/05-provide-metadata-mpris.patch"
49
"06-control-log-level-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/06-control-log-level.patch"
50
"07-improve-responsiveness-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/07-improve-responsiveness.patch"
51
"08-hide-offline-banner-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/08-hide-offline-banner.patch"
52
"09-disable-animations-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/09-disable-animations.patch"
53
"10-disable-notifications-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/10-disable-notifications.patch"
54
"11-fix-thumbar-actions-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/11-fix-thumbar-actions.patch"
55
"12-adjust-volume-on-wheel-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/12-adjust-volume-on-wheel.patch"
56
"13-disable-hardware-acceleration-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/13-disable-hardware-acceleration.patch"
57
"15-sync-theme-${_patch_commit}.patch::https://raw.githubusercontent.com/aunetx/deezer-linux/${_patch_commit}/patches/15-sync-theme.patch"
58
59
# Local patches
60
"99-systray-icon.patch"
61
)
62
63
noextract=(
64
"prettier-${_prettier_ver}.tgz"
65
"mpris-service-${_mpris_ver}.tgz"
66
)
67
68
sha256sums=('33c1205aaa9f6622c10cda3a5271bd951a85cf040e8dda8e6621abdbf8995c22'
69
'c33b398d8ae279a620cf2914c806f7ee00c47519e4f404874cfd90a68fc8d80f'
70
'3a23339b7b00d5d6d59768699f585d2565fc1cd7d2c43a254206de3840546eb6'
71
'951c80c9dc4848b31a5fcc9655b005f3a218b1ff735396168c13922ac658c83b'
72
'fe9bab50ef433516105ed2f2c349736c0be87c2f75f8d18bf1f011b2115019c1'
73
'14841de7b71a93123d22997db22d088debb13976778d869e3622199108e85b4b'
74
'c08a3e4550f216423ff6ebcb11f5af7268065efb5580b74e370aa40b9919cdb6'
75
'b8acd7522c20212e725db4116e666b97822a835028c7e208f3fac39d4b4b1868'
76
'181016c614fc62595d604d336cdb43c40645d7cc66a35acaf562c9af26177a6e'
77
'4a8bc8187e69f388e202507608e1fd9c41e15ad827d7bd98c57349c531106f00'
78
'171fd58d2eed2ea90ae0a50e867625203c9042e65ab9c9ce07c5e3ad3e6754bb'
79
'd0c246522cdf5c253f7a0583097337ef8c03c558b129f28d4fe29ee26eaacb01'
80
'2fe0cc68f05cf9655183766644ce5e81c59990d6ff6fcadbd295291f3f7c5421'
81
'16f555b4bc79117f82b7735b7c25ef87b336805e1c77325fddd4fcbac380ab58'
82
'f0415fa2c62140d971285dce56c8faabfa3fc79d97e72460efa5ce0ae2b8f3ec'
83
'f8af7fe9b406b945f23e3a52b68ac5e9d04ecfef99930c20c591daa01766c2b2'
84
'707579ffc8d413099e1976b8210fa41722590780f92a5df01e5c23b6405c5ece'
85
'9e21290520323503d2e02788ba4bfb85fd44613e4d500ff7943aaab26c41a002'
86
'100cf38e92898afbc332f1be1be25f19d515ea4cbcbfbfeb88444b53abb4a568'
87
'593eaa17fae1360ebd2ace36c4760ac7ef8bb6696db9e1d70983d916f5c69f6e'
88
'e5297d5f6eb0cd159b63afb363a98080ed32da20f151ec347407dfbd8bbdbe43'
89
'02f8fb4b8101d7a856cdd82ef17a54bb4de02adcc1de89c5ec7d8bfd9293d65d'
90
'e4f23d9a77bf0682ad3d1e20c4e98e68ae42d12110f9088496c85ef5c9e7cb9d'
91
'2362c52147cf67759388ba6685e2add32c5bcfcdbdbca8e0990f58cafa0392de')
92
93
_setup_prettier() {
94
# Extract the prettier tarball into a stable location.
95
rm -rf "$srcdir/prettier"
96
mkdir -p "$srcdir/prettier"
97
98
bsdtar -xzf "$srcdir/prettier-${_prettier_ver}.tgz" \
99
-C "$srcdir/prettier" \
100
--strip-components=1
101
}
102
103
_prettier() {
104
# Wrapper around the pinned Prettier CLI.
105
node "$srcdir/prettier/bin/prettier.cjs" "$@"
106
}
107
108
_setup_mpris() {
109
# Install MPRIS support from a locked npm dependency tree.
110
#
111
# mpris-service itself is downloaded through source=() and verified by
112
# sha256sums. The lockfile pins all transitive dependency versions and npm
113
# integrity hashes.
114
rm -rf "$srcdir/mpris-vendor"
115
mkdir -p "$srcdir/mpris-vendor"
116
117
cp "$srcdir/mpris-package.json" "$srcdir/mpris-vendor/package.json"
118
cp "$srcdir/mpris-package-lock.json" "$srcdir/mpris-vendor/package-lock.json"
119
cp "$srcdir/mpris-service-${_mpris_ver}.tgz" "$srcdir/mpris-vendor/"
120
121
npm ci \
122
--prefix "$srcdir/mpris-vendor" \
123
--cache "$srcdir/npm-cache" \
124
--omit=dev \
125
--no-audit \
126
--no-fund \
127
--ignore-scripts
128
129
mkdir -p "$srcdir/resources/app/node_modules"
130
cp -a "$srcdir/mpris-vendor/node_modules/." "$srcdir/resources/app/node_modules/"
131
}
132
133
prepare() {
134
# Extract the Electron app payload from Deezer's Windows installer.
135
7z x -so "$pkgname-$pkgver-setup.exe" "\$PLUGINSDIR/app-32.7z" > app-32.7z
136
137
# Extract the app archive so resources/app.asar can be modified.
138
7z x -y -bsp0 -bso0 app-32.7z
139
140
# Extract PNG icons from Deezer's Windows .ico file.
141
magick resources/win/app.ico resources/win/deezer-%d.png
142
143
# Set up the exact Prettier version used to normalize Deezer's JS/HTML
144
# before applying aunetx/deezer-linux patches.
145
_setup_prettier
146
147
cd resources/
148
149
# Unpack Electron's asar bundle so we can patch the app contents.
150
asar extract app.asar app
151
152
cd "$srcdir/resources/app"
153
mkdir -p resources/linux/
154
155
# Generate small tray icons.
156
for size in 24 48; do
157
magick "$srcdir/resources/win/deezer-8.png" -resize "${size}x${size}" -strip \
158
-define png:compression-filter=5 -define png:compression-level=9 \
159
"resources/linux/systray-${size}.png"
160
done
161
162
# Use the project-specific Prettier config so the generated formatting
163
# matches what the upstream patches expect.
164
cp "$srcdir/prettierrc.json" .prettierrc
165
_prettier --write "build/*.{js,html}"
166
167
# Apply every patch listed in source=().
168
local src
169
for src in "${source[@]}"; do
170
src="${src%%::*}"
171
src="${src##*/}"
172
173
[[ $src = *.patch ]] || continue
174
175
echo "Applying patch ${src}..."
176
patch -Np1 -l -F3 < "${srcdir}/${src}"
177
done
178
179
# Add MPRIS runtime dependencies to the unpacked app.
180
_setup_mpris
181
182
cd "$srcdir/resources/"
183
184
# Repack the modified Electron app.
185
asar pack app app.asar
186
}
187
188
package() {
189
mkdir -p "$pkgdir/usr/share/deezer"
190
mkdir -p "$pkgdir/usr/share/applications"
191
mkdir -p "$pkgdir/usr/bin/"
192
193
for size in 16 22 24 32 48 64 128 256 512; do
194
install -d "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/"
195
196
magick resources/win/deezer-8.png -resize "${size}x${size}" -strip \
197
-define png:compression-filter=5 -define png:compression-level=9 \
198
"$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/deezer-desktop.png"
199
200
chmod 644 "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/deezer-desktop.png"
201
done
202
203
install -Dm644 resources/app.asar "$pkgdir/usr/share/deezer/app.asar"
204
install -Dm644 "$pkgname-desktop.desktop" "$pkgdir/usr/share/applications/$pkgname-desktop.desktop"
205
install -Dm755 deezer-desktop "$pkgdir/usr/bin/deezer-desktop"
206
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
207
}
208
Changes since previous scan
--- PKGBUILD @ 2026-07-25 00:13+++ PKGBUILD @ 2026-08-03 00:08@@ -2,7 +2,7 @@ # Contributor: Ilya Gulya <ilyagulya@gmail.com> pkgname="deezer"-pkgver=7.1.280+pkgver=7.1.290 pkgrel=1 # Keep this in sync with the formatter version used by aunetx/deezer-linux.@@ -65,7 +65,7 @@ "mpris-service-${_mpris_ver}.tgz" ) -sha256sums=('f3e8a4ca8a7f25652d1142dabd4992641223a44270d32e667b0b6a0faaa5c44f'+sha256sums=('33c1205aaa9f6622c10cda3a5271bd951a85cf040e8dda8e6621abdbf8995c22' 'c33b398d8ae279a620cf2914c806f7ee00c47519e4f404874cfd90a68fc8d80f' '3a23339b7b00d5d6d59768699f585d2565fc1cd7d2c43a254206de3840546eb6' '951c80c9dc4848b31a5fcc9655b005f3a218b1ff735396168c13922ac658c83b'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 19:30:43 | MEDIUM | 1 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 17:52:43 | MEDIUM | 1 |