kaze

MEDIUM

maintainer Godslayer 0 votes scanned 2026-11-02 08:02:24.858082

View on AUR

Why flagged

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

PKGBUILD:57 if ! rustup toolchain install stable --profile minimal --no-self-update; then

PKGBUILD

1 offending line(s) highlighted

      1# shellcheck shell=bash
    
      2# makepkg reads the annotated metadata variables after sourcing this recipe.
    
      3# Maintainer: Music Player Contributors <https://github.com/selfAnnihilator/kaze>
    
      4pkgname=kaze
    
      5pkgver=2.0.4
    
      6# shellcheck disable=SC2034
    
      7pkgrel=1
    
      8# shellcheck disable=SC2034
    
      9pkgdesc="A calm, intelligent local music player"
    
      10# shellcheck disable=SC2034
    
      11arch=('x86_64')
    
      12url="https://github.com/selfAnnihilator/kaze"
    
      13# shellcheck disable=SC2034
    
      14license=('MIT' 'Apache-2.0')
    
      15# shellcheck disable=SC2034
    
      16depends=(
    
      17    'webkit2gtk-4.1'
    
      18    'gtk3'
    
      19    'libsoup3'
    
      20    'alsa-lib'
    
      21    'openssl'
    
      22    'sqlite'
    
      23    'hicolor-icon-theme'
    
      24)
    
      25# shellcheck disable=SC2034
    
      26makedepends=(
    
      27    # Select the concrete compiler/Cargo package on fresh systems. Existing
    
      28    # Arch rustup installations also provide rust; see INSTALL.md for setup.
    
      29    'rust'
    
      30    'nodejs'
    
      31    'npm'
    
      32)
    
      33# shellcheck disable=SC2034
    
      34options=(!lto)
    
      35# shellcheck disable=SC2034
    
      36source=(
    
      37    "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      38    "kaze.desktop"
    
      39)
    
      40# shellcheck disable=SC2034
    
      41sha256sums=(
    
      42    'a35c0c8681ec937128ca5e4ec948822e176f6dfb2093f3311d2bd65f32bc9ca1'
    
      43    'eaf39dc7d4a05cefeb1543018e5a2ae84148343e3b5a8de50ba365087d43dd0c'
    
      44)
    
      45
    
      46_ensure_rust_toolchain() {
    
      47    if cargo --version >/dev/null 2>&1 && rustc --version >/dev/null 2>&1; then
    
      48        return 0
    
      49    fi
    
      50
    
      51    # Arch's rustup provides rust even when no toolchain is configured.
    
      52    # Select stable for this build without changing the user's default/overrides.
    
      53    if command -v rustup >/dev/null 2>&1; then
    
      54        export RUSTUP_TOOLCHAIN=stable
    
      55        if ! cargo --version >/dev/null 2>&1 || ! rustc --version >/dev/null 2>&1; then
    
      56            msg "Installing the stable Rust toolchain needed to build Kaze..."
    
      57            if ! rustup toolchain install stable --profile minimal --no-self-update; then
    
      58                error "Could not install stable Rust. Check the download error above and retry."
    
      59                return 1
    
      60            fi
    
      61        fi
    
      62    fi
    
      63
    
      64    if ! cargo --version >/dev/null 2>&1 || ! rustc --version >/dev/null 2>&1; then
    
      65        error "Kaze needs a working Rust toolchain (Cargo and rustc)."
    
      66        error "Fresh Arch installation: install rust with 'sudo pacman -Syu --needed rust'."
    
      67        error "Already using rustup: run 'rustup default stable', then retry."
    
      68        error "See INSTALL.md for Cargo provider selection and troubleshooting."
    
      69        return 1
    
      70    fi
    
      71}
    
      72
    
      73prepare() {
    
      74    _ensure_rust_toolchain || return 1
    
      75}
    
      76
    
      77build() {
    
      78    # makepkg may run build in a different shell from prepare (also with --noextract).
    
      79    _ensure_rust_toolchain || return 1
    
      80    cd "$pkgname-$pkgver" || return 1
    
      81    npm ci
    
      82    npm run build
    
      83    cargo build --release --locked --features tauri/custom-protocol
    
      84}
    
      85
    
      86package() {
    
      87    cd "$pkgname-$pkgver" || return 1
    
      88    local bin_dir="target/release"
    
      89    if [ ! -f "$bin_dir/kaze" ]; then
    
      90        bin_dir="src-tauri/target/release"
    
      91    fi
    
      92
    
      93    # makepkg supplies pkgdir and srcdir to package().
    
      94    # shellcheck disable=SC2154
    
      95    install -Dm755 "$bin_dir/kaze" "$pkgdir/usr/bin/kaze"
    
      96    install -Dm755 "$bin_dir/music-player-cli" "$pkgdir/usr/bin/music-player-cli"
    
      97
    
      98    # shellcheck disable=SC2154
    
      99    install -Dm644 "$srcdir/kaze.desktop" "$pkgdir/usr/share/applications/kaze.desktop"
    
      100
    
      101    install -Dm644 src-tauri/icons/32x32.png "$pkgdir/usr/share/icons/hicolor/32x32/apps/kaze.png"
    
      102    install -Dm644 src-tauri/icons/128x128.png "$pkgdir/usr/share/icons/hicolor/128x128/apps/kaze.png"
    
      103    install -Dm644 src-tauri/icons/256x256.png "$pkgdir/usr/share/icons/hicolor/256x256/apps/kaze.png"
    
      104    install -Dm644 src-tauri/icons/512x512.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/kaze.png"
    
      105}
    
      106

Changes since previous scan

--- PKGBUILD @ 2026-11-02 00:26
+++ PKGBUILD @ 2026-11-02 08:02
@@ -1,11 +1,18 @@
+# shellcheck shell=bash
+# makepkg reads the annotated metadata variables after sourcing this recipe.
 # Maintainer: Music Player Contributors <https://github.com/selfAnnihilator/kaze>
 pkgname=kaze
-pkgver=2.0.2
-pkgrel=2
+pkgver=2.0.4
+# shellcheck disable=SC2034
+pkgrel=1
+# shellcheck disable=SC2034
 pkgdesc="A calm, intelligent local music player"
+# shellcheck disable=SC2034
 arch=('x86_64')
 url="https://github.com/selfAnnihilator/kaze"
+# shellcheck disable=SC2034
 license=('MIT' 'Apache-2.0')
+# shellcheck disable=SC2034
 depends=(
     'webkit2gtk-4.1'
     'gtk3'
@@ -15,6 +22,7 @@
     'sqlite'
     'hicolor-icon-theme'
 )
+# shellcheck disable=SC2034
 makedepends=(
     # Select the concrete compiler/Cargo package on fresh systems. Existing
     # Arch rustup installations also provide rust; see INSTALL.md for setup.
@@ -22,13 +30,16 @@
     'nodejs'
     'npm'
 )
+# shellcheck disable=SC2034
 options=(!lto)
+# shellcheck disable=SC2034
 source=(
     "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
     "kaze.desktop"
 )
+# shellcheck disable=SC2034
 sha256sums=(
-    '3bd67cded1216ebd18a7da712e39cb347beaa2787134050089d618391a694ae1'
+    'a35c0c8681ec937128ca5e4ec948822e176f6dfb2093f3311d2bd65f32bc9ca1'
     'eaf39dc7d4a05cefeb1543018e5a2ae84148343e3b5a8de50ba365087d43dd0c'
 )
 
@@ -66,22 +77,25 @@
 build() {
     # makepkg may run build in a different shell from prepare (also with --noextract).
     _ensure_rust_toolchain || return 1
-    cd "$pkgname-$pkgver"
+    cd "$pkgname-$pkgver" || return 1
     npm ci
     npm run build
     cargo build --release --locked --features tauri/custom-protocol
 }
 
 package() {
-    cd "$pkgname-$pkgver"
+    cd "$pkgname-$pkgver" || return 1
     local bin_dir="target/release"
     if [ ! -f "$bin_dir/kaze" ]; then
         bin_dir="src-tauri/target/release"
     fi
 
+    # makepkg supplies pkgdir and srcdir to package().
+    # shellcheck disable=SC2154
     install -Dm755 "$bin_dir/kaze" "$pkgdir/usr/bin/kaze"
     install -Dm755 "$bin_dir/music-player-cli" "$pkgdir/usr/bin/music-player-cli"
 
+    # shellcheck disable=SC2154
     install -Dm644 "$srcdir/kaze.desktop" "$pkgdir/usr/share/applications/kaze.desktop"
 
     install -Dm644 src-tauri/icons/32x32.png "$pkgdir/usr/share/icons/hicolor/32x32/apps/kaze.png"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 08:02:24	Medium	1
2026-11-02 00:26:00	Low	2
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 07:55:24	Medium	1
2026-10-29 15:52:51	Clean	0
2026-10-28 19:50:31	Clean	0
2026-10-28 17:50:30	Clean	0
2026-10-28 15:50:30	Clean	0
2026-10-21 09:31:11	Clean	0
2026-10-20 11:27:57	Clean	0
2026-10-18 17:22:42	Clean	0
2026-10-18 09:21:55	Clean	0
2026-10-13 11:16:23	Clean	0
2026-10-12 09:12:50	Clean	0
2026-10-12 07:12:50	Clean	0
2026-10-05 23:40:58	Clean	0
2026-09-19 00:25:36	Clean	2
2026-09-18 09:28:06	Low	1