lastwave-bin

MEDIUM

maintainer rimehrab 0 votes scanned 2026-11-06 08:11:27.004022

View on AUR

Why flagged

The package installs a prebuilt binary .deb from a GitHub release, which is unverifiable and could be silently replaced; while the project appears legitimate, the use of a non-source build with a skipped integrity check on the host creates a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt binary .deb from a GitHub release, which is unverifiable and could be silently replaced; while the project appears legitimate, the use of a non-source build with a skipped integrity check on the host creates a supply-chain risk.

PKGBUILD

      1# Maintainer: rimehrab <contact@rimehrab.is-a.dev>
    
      2
    
      3pkgname=lastwave-bin
    
      4_pkgname=lastwave
    
      5pkgver=2.0.1
    
      6pkgrel=1
    
      7pkgdesc='Next-Gen Lossless Music player with Algorithmic Smart Playlist Generator, Real-Time Synced Lyrics & Last.fm Scrobbler for Desktop.'
    
      8arch=('x86_64')
    
      9url='https://github.com/Clash-Projects/LastWave-Desktop'
    
      10license=('LicenseRef-unknown')
    
      11depends=(
    
      12  'ayatana-ido'
    
      13  'gtk3'
    
      14  'libayatana-appindicator'
    
      15  'libayatana-indicator'
    
      16  'libkeybinder3'
    
      17  'libsecret'
    
      18  'mpv'
    
      19  'webkit2gtk-4.1'
    
      20)
    
      21makedepends=('patchelf')
    
      22provides=("$_pkgname")
    
      23conflicts=("$_pkgname" 'lastwave-desktop')
    
      24options=('!strip' '!debug')
    
      25_deb="$_pkgname-$pkgver-$CARCH.deb"
    
      26source=("$_deb::$url/releases/download/v$pkgver/${_pkgname}_${pkgver}_amd64.deb")
    
      27noextract=("$_deb")
    
      28sha256sums=('833369c06a343d45e0db0cd3070d665c01ac30f0cc215dfeeae5e4330d382ac4')
    
      29
    
      30package() {
    
      31  bsdtar -xOf "$_deb" data.tar.gz | bsdtar -xf - -C "$pkgdir"
    
      32
    
      33  chmod 644 "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_pkgname.png"
    
      34
    
      35  for f in "$pkgdir"/opt/lastwave/lib/*.so; do
    
      36    if readelf -d "$f" 2>/dev/null | grep -q '/home/runner'; then
    
      37      patchelf --set-rpath '$ORIGIN' "$f"
    
      38    fi
    
      39  done
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 08:11:27	Medium	2