fastpotify-git

LOW

maintainer crmne 0 votes scanned 2026-08-27 13:32:42.941682

View on AUR

Why flagged

The package builds from source hosted on the maintainer's GitHub, which is normal for AUR-git packages; the only concerns are low votes and a SKIP'd checksum, but it does not execute untrusted prebuilt code or exfiltrate data.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on the maintainer's GitHub, which is normal for AUR-git packages; the only concerns are low votes and a SKIP'd checksum, but it does not execute untrusted prebuilt code or exfiltrate data.

PKGBUILD

      1# Maintainer: Carmine Paolino <carmine@paolino.me>
    
      2pkgname=fastpotify-git
    
      3pkgver=0.1.1.r0.5ada9aa
    
      4pkgrel=1
    
      5pkgdesc="Fast native Spotify client with local playback and Spotify Connect"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/crmne/fastpotify"
    
      8license=('MIT')
    
      9install="${pkgname}.install"
    
      10depends=('alsa-lib' 'libpulse' 'libglvnd' 'libxkbcommon' 'wayland' 'libx11')
    
      11makedepends=('git' 'cargo')
    
      12optdepends=('libxkbcommon-x11: keyboard handling in X11 sessions'
    
      13            'pipewire-pulse: PipeWire as the PulseAudio server')
    
      14provides=('fastpotify')
    
      15conflicts=('fastpotify')
    
      16# !lto because ring compiles its own C and Arch's default CFLAGS put LTO
    
      17# objects in the archive, which lld then cannot resolve: the link fails on
    
      18# undefined ring_core_* symbols. The stable package is prebuilt and never
    
      19# meets this.
    
      20options=('!debug' '!lto')
    
      21source=("${pkgname}::git+https://github.com/crmne/fastpotify.git")
    
      22sha256sums=('SKIP')
    
      23
    
      24pkgver() {
    
      25  cd "${srcdir}/${pkgname}"
    
      26  git describe --long --tags --abbrev=7 | sed 's/^v//;s/\-/.r/;s/\-g/./'
    
      27}
    
      28
    
      29prepare() {
    
      30  cd "${srcdir}/${pkgname}"
    
      31  export RUSTUP_TOOLCHAIN=stable
    
      32  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      33}
    
      34
    
      35build() {
    
      36  cd "${srcdir}/${pkgname}"
    
      37  export RUSTUP_TOOLCHAIN=stable
    
      38  export CARGO_TARGET_DIR=target
    
      39  # Generated bindings inside glutin carry the path they were built at, which
    
      40  # ends up in the binary and makes makepkg warn about a reference to $srcdir.
    
      41  # Appended rather than assigned, so the distro's own flags survive.
    
      42  export RUSTFLAGS="${RUSTFLAGS:-} --remap-path-prefix=${srcdir}=/"
    
      43  cargo build --frozen --release
    
      44}
    
      45
    
      46check() {
    
      47  cd "${srcdir}/${pkgname}"
    
      48  export RUSTUP_TOOLCHAIN=stable
    
      49  # The demo feature carries the headless render test, which lays out every
    
      50  # page without a display and talks to nothing.
    
      51  cargo test --frozen --features demo
    
      52}
    
      53
    
      54package() {
    
      55  cd "${srcdir}/${pkgname}"
    
      56
    
      57  install -Dm755 "target/release/fastpotify" "${pkgdir}/usr/bin/fastpotify"
    
      58  install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      59  install -Dm644 "README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      60  install -Dm644 "packaging/applications/fastpotify.desktop" \
    
      61    "${pkgdir}/usr/share/applications/fastpotify.desktop"
    
      62  install -Dm644 "packaging/icons/fastpotify.svg" \
    
      63    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/fastpotify.svg"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-27 13:32:42	Low	2