liner-bin

MEDIUM

maintainer Felitendo 0 votes scanned 2026-10-23 00:02:19.781852

View on AUR

Why flagged

The package installs a prebuilt binary from a non-whitelisted GitHub release without source verification, which could be replaced with malicious code, though it is from the project's own repository.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a non-whitelisted GitHub release without source verification, which could be replaced with malicious code, though it is from the project's own repository.

PKGBUILD

      1# Maintainer: Felitendo
    
      2# This PKGBUILD is updated automatically:
    
      3# https://github.com/Felitendo/PKGBUILDS
    
      4
    
      5pkgname=liner-bin
    
      6pkgver=0.1.40
    
      7pkgrel=1
    
      8pkgdesc="Music player that pulls your music and playlists from other platforms into one app, with synced lyrics (upstream binary)"
    
      9arch=('x86_64')
    
      10url="https://github.com/tryliner/desktop"
    
      11license=('LicenseRef-Liner')
    
      12# The libraries the Electron bundle links (readelf -d), plus what it loads at
    
      13# run time: libnotify for notifications, libpulse for sound and xdg-utils to
    
      14# open links.
    
      15depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'glibc'
    
      16         'gtk3' 'hicolor-icon-theme' 'libcups' 'libgcc' 'libnotify' 'libpulse'
    
      17         'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes'
    
      18         'libxkbcommon' 'libxrandr' 'mesa' 'nspr' 'nss' 'pango' 'systemd-libs'
    
      19         'xdg-utils')
    
      20optdepends=('traceroute: route check in the network diagnostics')
    
      21provides=('liner')
    
      22conflicts=('liner')
    
      23options=('!strip' '!debug')
    
      24source=("${pkgname}-${pkgver}.deb::${url}/releases/download/v${pkgver}/liner_${pkgver}_amd64.deb"
    
      25        "${pkgname}-${pkgver}-LICENSE::https://raw.githubusercontent.com/tryliner/desktop/v${pkgver}/LICENSE")
    
      26noextract=("${pkgname}-${pkgver}.deb")
    
      27sha256sums=('9319ff9cc22c062343532b23add6c72c811b27cda7b865d122092445e765d8ed' '81f3f6b06e8d932ea52b9e0a2ff221aa2400e1fb73ae667431080f03da770940')
    
      28
    
      29package() {
    
      30  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}.deb" 'data.tar.*' \
    
      31    | bsdtar -xpf - -C "$pkgdir" --exclude './usr/share/doc' ./opt ./usr
    
      32
    
      33  install -d "$pkgdir/usr/bin"
    
      34  ln -s /opt/Liner/liner "$pkgdir/usr/bin/liner"
    
      35
    
      36  # Without this file the app's updater stays off. With it, the updater
    
      37  # installs upstream's .deb through dpkg, behind pacman's back.
    
      38  rm "$pkgdir/opt/Liner/resources/package-type"
    
      39
    
      40  # "Audio" alone is not a valid main category
    
      41  sed -i 's|^Categories=.*|Categories=AudioVideo;Audio;Player;|' \
    
      42    "$pkgdir/usr/share/applications/liner.desktop"
    
      43
    
      44  install -Dm644 "$srcdir/${pkgname}-${pkgver}-LICENSE" \
    
      45    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      46  ln -s /opt/Liner/LICENSE.electron.txt \
    
      47    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
    
      48  ln -s /opt/Liner/LICENSES.chromium.html \
    
      49    "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 00:02:19	Medium	2
2026-10-22 21:36:17	Medium	2