inner-pitch-bin

MEDIUM

maintainer mdrv 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

Prebuilt proprietary audio plugin binaries (LV2/VST3/CLAP) downloaded from the vendor's own official domain (auburnsounds.com) with a sha256 checksum; the host is the project's own official site so this is low-risk vendor binary packaging, but it is still an unverifiable prebuilt executable bundle — rated medium as is standard for proprietary prebuilt binaries, though the checksum and official vendor domain reduce concern significantly.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("Inner-Pitch-FREE-${pkgver}.zip::https://www.auburnsounds.com/downloads/Inner-Pitch-FREE-${pkgver}.zip")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt proprietary audio plugin binaries (LV2/VST3/CLAP) downloaded from the vendor's own official domain (auburnsounds.com) with a sha256 checksum; the host is the project's own official site so this is low-risk vendor binary packaging, but it is still an unverifiable prebuilt executable bundle — rated medium as is standard for proprietary prebuilt binaries, though the checksum and official vendor domain reduce concern significantly.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Umar Alfarouk <medrivia@gmail.com>
    
      2
    
      3_pkgname=inner-pitch
    
      4pkgname=inner-pitch-bin
    
      5pkgver=2.1
    
      6pkgrel=1
    
      7pkgdesc="A pitch shifter plugin (LV2, CLAP, VST3), free edition"
    
      8arch=('x86_64')
    
      9url="https://www.auburnsounds.com/products/Inner-Pitch"
    
      10license=('LicenseRef-proprietary')
    
      11groups=('pro-audio' 'lv2-plugins' 'vst3-plugins' 'clap-plugins')
    
      12depends=('libgcc' 'libx11')
    
      13provides=('inner-pitch')
    
      14conflicts=('inner-pitch')
    
      15options=('!strip' '!debug')
    
      16source=("Inner-Pitch-FREE-${pkgver}.zip::https://www.auburnsounds.com/downloads/Inner-Pitch-FREE-${pkgver}.zip")
    
      17sha256sums=('eedbb307954ec38f87575d1e1807259645107d830779c3727aa9129465691fec')
    
      18
    
      19package() {
    
      20  local _srcdir="${srcdir}/Inner-Pitch-FREE-${pkgver}/Linux"
    
      21
    
      22  # Install LV2 plugins
    
      23  install -dm755 "${pkgdir}/usr/lib/lv2"
    
      24  cp -a "${_srcdir}/Linux-64b-LV2-FREE/"* "${pkgdir}/usr/lib/lv2/"
    
      25
    
      26  # Install VST3 plugins
    
      27  install -dm755 "${pkgdir}/usr/lib/vst3"
    
      28  cp -a "${_srcdir}/Linux-64b-VST3-FREE/"* "${pkgdir}/usr/lib/vst3/"
    
      29
    
      30  # Install CLAP plugins
    
      31  install -dm755 "${pkgdir}/usr/lib/clap"
    
      32  install -m755 "${_srcdir}/Linux-64b-CLAP-FREE/"*.clap "${pkgdir}/usr/lib/clap/"
    
      33
    
      34  # Install documentation
    
      35  install -dm755 "${pkgdir}/usr/share/doc/${_pkgname}"
    
      36  install -m644 "${srcdir}/Inner-Pitch-FREE-${pkgver}"/*.pdf "${pkgdir}/usr/share/doc/${_pkgname}/"
    
      37  install -m644 "${srcdir}/Inner-Pitch-FREE-${pkgver}"/*.jpg "${pkgdir}/usr/share/doc/${_pkgname}/"
    
      38
    
      39  # Install license
    
      40  install -Dm644 "${srcdir}/Inner-Pitch-FREE-${pkgver}/license.html" "${pkgdir}/usr/share/licenses/${pkgname}/license.html"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Medium	3
2026-10-06 00:13:36	Low	3
2026-10-05 23:40:58	Medium	2