fuoevolve-bin

LOW

maintainer bruceutut 0 votes scanned 2026-09-23 11:40:33.758457

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official GitHub release page, which is a common and acceptable practice for AUR packages; the low severity reflects the use of a binary release but from a trusted project source with no evidence of malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub release page, which is a common and acceptable practice for AUR packages; the low severity reflects the use of a binary release but from a trusted project source with no evidence of malicious behavior.

PKGBUILD

      1pkgname=fuoevolve-bin
    
      2pkgver=1.6.2
    
      3pkgrel=1
    
      4pkgdesc='Open-source cross-platform music player based on FeelUOwn (prebuilt binary)'
    
      5arch=('x86_64')
    
      6url='https://feeluown.github.io/FuoEvolve/'
    
      7license=('GPL-3.0-only')
    
      8provides=("fuoevolve=${pkgver}")
    
      9conflicts=('fuoevolve')
    
      10depends=(
    
      11  'gtk3'
    
      12  'libx11'
    
      13  'libxkbcommon'
    
      14  'libsecret'
    
      15  'mpv'
    
      16  'webkit2gtk-4.1'
    
      17  'alsa-lib'
    
      18  'pipewire'
    
      19  'libpulse'
    
      20)
    
      21makedepends=('libarchive')
    
      22options=('!strip')
    
      23_archive="FuoEvolve-${pkgver}-linux-x64.pkg.tar.zst"
    
      24source=("${_archive}::https://github.com/feeluown/FuoEvolve/releases/download/${pkgver}/${_archive}")
    
      25noextract=("${_archive}")
    
      26sha256sums=('ea3bdc16ebcc02fe876a12296ebaacd1e7d36493c3a4f57874a18c2ce9957777')
    
      27
    
      28package() {
    
      29  # The upstream release archive is a completed pacman package. Repackage only
    
      30  # its installed files; makepkg must generate metadata for fuoevolve-bin itself.
    
      31  if ! bsdtar -tf "${srcdir}/${_archive}" | grep -E '^(\./)?\.PKGINFO$' > /dev/null; then
    
      32    echo 'Release asset is not a valid Arch package: missing .PKGINFO' >&2
    
      33    return 1
    
      34  fi
    
      35
    
      36  bsdtar \
    
      37    --exclude='.PKGINFO' \
    
      38    --exclude='.BUILDINFO' \
    
      39    --exclude='.MTREE' \
    
      40    --exclude='.INSTALL' \
    
      41    --exclude='.CHANGELOG' \
    
      42    -xf "${srcdir}/${_archive}" \
    
      43    -C "${pkgdir}"
    
      44
    
      45  if [[ ! -d "${pkgdir}/usr" ]]; then
    
      46    echo 'Release asset has no usr/ payload' >&2
    
      47    return 1
    
      48  fi
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-23 11:40:33	Low	2