doughmination-music
LOW
maintainer doughmination
0 votes
scanned 2026-08-24 19:24:22.399485
Why flagged
The package repackages a prebuilt AppImage from the project's official GitHub release, which is a normal practice for AUR packages; the source is verifiable and the checksums are provided, making it low risk despite the AppImage being unstripped and from a non-whitelisted host.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package repackages a prebuilt AppImage from the project's official GitHub release, which is a normal practice for AUR packages; the source is verifiable and the checksums are provided, making it low risk despite the AppImage being unstripped and from a non-whitelisted host.
PKGBUILD
1
# Maintainer: Clove Twilight <clovetwilight3@outlook.com>
2
#
3
# This is the source of truth for the AUR package `doughmination-music`.
4
# The release workflow (.github/workflows/release.yml, job `aur`) copies this
5
# file, rewrites `pkgver` / `_appimagefile` for the tag being released, fills
6
# the checksums with `updpkgsums`, regenerates .SRCINFO and pushes the result
7
# to the AUR — so edit it HERE, never in the AUR repo, or the next release
8
# will overwrite your change. `pkgrel` is likewise reset to 1 every release;
9
# a pkgrel-only bump means bumping it here and re-running the workflow.
10
#
11
# It repackages the published AppImage rather than building from source:
12
# building here would mean fetching the proprietary Discord Social SDK from
13
# our own CDN mid-build and compiling the whole Tauri/Rust tree on the user's
14
# machine. Note that Arch's naming guidelines would call this a `-bin`
15
# package; the unsuffixed name is a deliberate maintainer preference.
16
#
17
# The AppImage deliberately bundles no system libraries (see the "unbundle the
18
# GTK/WebKitGTK stack" step in the release workflow), so this really is just
19
# the app binary plus the Discord SDK — `depends` below is the whole runtime.
20
21
pkgname=doughmination-music
22
pkgver=2.2.0
23
pkgrel=1
24
pkgdesc="Desktop client for Doughmination Music, a self-hosted Pocket ID music library"
25
arch=('x86_64')
26
url="https://github.com/Clove-Web/pocket-id-music-player"
27
license=('LicenseRef-DASL-1.0')
28
depends=(
29
# Linked by the app binary itself.
30
'webkit2gtk-4.1'
31
'gtk3'
32
'libsoup3'
33
'glib2'
34
'gdk-pixbuf2'
35
'cairo'
36
'dbus'
37
'gcc-libs'
38
'glibc'
39
# Linked by libdiscord_partner_sdk.so — all DT_NEEDED entries, so the app
40
# fails to start outright if any are missing, not just Rich Presence.
41
'alsa-lib'
42
'libpulse'
43
'libx11'
44
'libatomic'
45
# Owns the /usr/share/icons/hicolor hierarchy this package drops icons into.
46
'hicolor-icon-theme'
47
# Sign-in hands the OIDC flow to the system browser via tauri-plugin-opener,
48
# which shells out to xdg-open.
49
'xdg-utils'
50
)
51
# Prebuilt upstream binaries: nothing to strip, no debug package to split out.
52
options=('!strip' '!debug')
53
54
# Tauri names the artifact from `productName` + the version in
55
# tauri.conf.json, which is not necessarily the git tag — the workflow
56
# overwrites this line with the asset name it actually finds on the release.
57
_appimagefile="Doughmination.Music_1.0.0_amd64.AppImage"
58
59
source=(
60
"$pkgname-$pkgver.AppImage::$url/releases/download/v$pkgver/$_appimagefile"
61
"LICENCE-$pkgver.md::https://raw.githubusercontent.com/Clove-Web/pocket-id-music-player/v$pkgver/LICENCE.md"
62
)
63
# An AppImage is an ELF with a squashfs glued on; makepkg must not try to
64
# unpack it itself — prepare() uses the AppImage's own extractor.
65
noextract=("$pkgname-$pkgver.AppImage")
66
sha256sums=('d81b67e0ef31e26145e4c63d4856c7e0e4f4f7401807842dd9c19e446cef6f06'
67
'93aa15616c8d2ad987372388e9cc1cd360501a98bc9cebd656acfa938368f538')
68
69
prepare() {
70
chmod +x "$pkgname-$pkgver.AppImage"
71
"./$pkgname-$pkgver.AppImage" --appimage-extract >/dev/null
72
}
73
74
package() {
75
cd "$srcdir/squashfs-root"
76
77
# The binary finds libdiscord_partner_sdk.so through a `$ORIGIN/../lib`
78
# RUNPATH (see apps/desktop/src-tauri/build.rs), so bin/ and lib/ have to
79
# stay siblings under /opt — hence no plain /usr/bin install.
80
install -Dm755 "usr/bin/$pkgname" "$pkgdir/opt/$pkgname/bin/$pkgname"
81
install -Dm755 usr/lib/libdiscord_partner_sdk.so \
82
"$pkgdir/opt/$pkgname/lib/libdiscord_partner_sdk.so"
83
install -dm755 "$pkgdir/usr/bin"
84
ln -s "/opt/$pkgname/bin/$pkgname" "$pkgdir/usr/bin/$pkgname"
85
86
install -Dm644 usr/share/applications/*.desktop \
87
"$pkgdir/usr/share/applications/$pkgname.desktop"
88
89
local icon dir
90
for icon in usr/share/icons/hicolor/*/apps/"$pkgname".png; do
91
dir="${icon#usr/share/icons/hicolor/}"
92
dir="${dir%%/*}"
93
# Tauri emits a "256x256@2" directory; hicolor's scaled-icon dirs are
94
# named "...@2x", and anything else is ignored by the icon cache.
95
[[ $dir == *@2 ]] && dir="${dir}x"
96
install -Dm644 "$icon" "$pkgdir/usr/share/icons/hicolor/$dir/apps/$pkgname.png"
97
done
98
99
install -Dm644 "$srcdir/LICENCE-$pkgver.md" \
100
"$pkgdir/usr/share/licenses/$pkgname/LICENCE.md"
101
}
102
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-24 19:24:22 | Low | 2 |