lx-music-shell

maintainer existyay · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate source on the maintainer's GitHub, installs only shell scripts and config files, and has no obfuscated or unverifiable remote code execution; the 'SKIP' checksum is a concern but the overall risk is low given the transparency and nature of the scripts.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a legitimate source on the maintainer's GitHub, installs only shell scripts and config files, and has no obfuscated or unverifiable remote code execution; the 'SKIP' checksum is a concern but the overall risk is low given the transparency and nature of the scripts.

PKGBUILD

      1# Maintainer: existyay <liujam826@gmail.com>
    
      2pkgname=lx-music-shell
    
      3pkgver=2.2.1
    
      4pkgrel=1
    
      5pkgdesc="Terminal music player with multi-source support and auto-reconnect"
    
      6arch=("any")
    
      7url="https://github.com/existyay/LX-Music-Shell"
    
      8license=("MIT")
    
      9depends=("bash>=4.4"
    
      10         "coreutils"
    
      11         "curl"
    
      12         "glibc"
    
      13         "grep"
    
      14         "gawk"
    
      15         "ncurses"
    
      16         "procps-ng")
    
      17optdepends=("alsa-utils: ALSA audio control"
    
      18            "bluez: bluetooth support and monitoring"
    
      19            "bluez-utils: bluetoothctl for bluetooth device management"
    
      20            "ffmpeg: ffplay backend support and audio tools"
    
      21            "iputils: ping for network connectivity monitoring"
    
      22            "jq: enhanced JSON parsing for music APIs"
    
      23            "mplayer: alternative audio player backend"
    
      24            "mpv: recommended audio player backend"
    
      25            "networkmanager: network management integration"
    
      26            "pipewire: PipeWire audio system support"
    
      27            "pulseaudio: PulseAudio audio system support"
    
      28            "wireless_tools: WiFi connection monitoring")
    
      29makedepends=()
    
      30checkdepends=("shellcheck")
    
      31provides=()
    
      32conflicts=()
    
      33replaces=()
    
      34backup=("etc/skel/.config/lx-music-shell/config"
    
      35        "etc/skel/.config/lx-music-shell/sources.list")
    
      36options=()
    
      37install=lx-music-shell.install
    
      38source=("lx-music-shell-source-v2.2.1.tar.gz::https://github.com/existyay/LX-Music-Shell/archive/refs/tags/v2.2.1.tar.gz")
    
      39sha256sums=("SKIP")
    
      40
    
      41prepare() {
    
      42    cd "$srcdir/LX-Music-Shell-$pkgver"
    
      43}
    
      44
    
      45build() {
    
      46    cd "$srcdir/LX-Music-Shell-$pkgver"
    
      47    true
    
      48}
    
      49
    
      50check() {
    
      51    cd "$srcdir/LX-Music-Shell-$pkgver"
    
      52    local s
    
      53    for s in lx-music-shell sources-update.sh uninstall.sh install.sh install-aur.sh; do
    
      54        bash -n "$s" || return 1
    
      55    done
    
      56    if command -v shellcheck &>/dev/null; then
    
      57        shellcheck -e SC1091,SC2155 lx-music-shell || true
    
      58    fi
    
      59}
    
      60
    
      61package() {
    
      62    cd "$srcdir/LX-Music-Shell-$pkgver"
    
      63
    
      64    # Install main executable
    
      65    install -Dm755 lx-music-shell "$pkgdir/usr/bin/lx-music-shell"
    
      66
    
      67    # Install source update tool
    
      68    install -Dm755 sources-update.sh "$pkgdir/usr/bin/lx-music-sources"
    
      69
    
      70    # Install uninstaller
    
      71    install -Dm755 uninstall.sh "$pkgdir/usr/bin/lx-music-shell-uninstall"
    
      72
    
      73    # Install additional install scripts (for reference)
    
      74    install -Dm755 install.sh "$pkgdir/usr/share/$pkgname/install.sh"
    
      75    install -Dm755 install-aur.sh "$pkgdir/usr/share/$pkgname/install-aur.sh"
    
      76
    
      77    # Create config directory skeleton
    
      78    install -dm755 "$pkgdir/etc/skel/.config/lx-music-shell"
    
      79
    
      80    # Default configuration
    
      81    cat > "$pkgdir/etc/skel/.config/lx-music-shell/config" << 'EOFCONFIG'
    
      82# LX-Music-Shell Configuration
    
      83PLAYER_BACKEND="mpv"
    
      84DEFAULT_SOURCE="kugou"
    
      85SEARCH_LIMIT="20"
    
      86PLAY_MODE="list"
    
      87VOLUME="80"
    
      88AUTO_UPDATE_SOURCES="true"
    
      89UI_COLOR="true"
    
      90NETWORK_CHECK_INTERVAL="3"
    
      91MAX_RECONNECT_ATTEMPTS="5"
    
      92RECONNECT_DELAY="2"
    
      93
    
      94# LX-Music 聚合 API 服务器 (用于解析 5 大音源真实 URL)
    
      95LX_API_URL="https://lxmusicapi.onrender.com"
    
      96LX_API_KEY="share-v3"
    
      97LX_API_TIMEOUT="15"
    
      98
    
      99# 音质与保底 (hires/flac/320/128, highest/balanced/fastest)
    
      100QUALITY_MODE="highest"
    
      101DEFAULT_QUALITY="flac"
    
      102
    
      103# TUI 模式 (auto/on/off)
    
      104UI_TUI="auto"
    
      105UI_MOUSE="auto"
    
      106AUTO_RECONNECT="true"
    
      107WATCH_BLUETOOTH="true"
    
      108EOFCONFIG
    
      109
    
      110    # Default music sources
    
      111    cat > "$pkgdir/etc/skel/.config/lx-music-shell/sources.list" << 'EOFSOURCES'
    
      112# LX-Music-Shell Music Sources Configuration
    
      113SOURCE_KUGOU="https://www.kugou.com/yy/index.php"
    
      114SOURCE_KUWO="http://www.kuwo.cn/api/www/search/searchMusicBykeyWord"
    
      115SOURCE_QQ="https://c.y.qq.com/soso/fcgi-bin/client_search_cp"
    
      116SOURCE_NETEASE="https://music.163.com/api/search/get/web"
    
      117SOURCE_MIGU="https://music.migu.cn/v1/api/search/search"
    
      118SOURCE_XIMALAYA="https://www.ximalaya.com/revision/search"
    
      119EOFSOURCES
    
      120
    
      121    # Install man pages
    
      122    install -Dm644 aur/lx-music-shell.1 \
    
      123        "$pkgdir/usr/share/man/man1/lx-music-shell.1"
    
      124    install -Dm644 aur/lx-music-sources.1 \
    
      125        "$pkgdir/usr/share/man/man1/lx-music-sources.1"
    
      126    install -Dm644 aur/lx-music-shell-uninstall.1 \
    
      127        "$pkgdir/usr/share/man/man1/lx-music-shell-uninstall.1"
    
      128
    
      129    # Install bash completion
    
      130    install -Dm644 aur/lx-music-shell.bash \
    
      131        "$pkgdir/usr/share/bash-completion/completions/lx-music-shell"
    
      132
    
      133    # Install desktop entry
    
      134    install -Dm644 aur/lx-music-shell.desktop \
    
      135        "$pkgdir/usr/share/applications/lx-music-shell.desktop"
    
      136
    
      137    # Install license
    
      138    install -Dm644 LICENSE \
    
      139        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      140
    
      141    # Install documentation
    
      142    install -Dm644 README.md \
    
      143        "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      144    install -Dm644 aur/README.md \
    
      145        "$pkgdir/usr/share/doc/$pkgname/AUR-README.md"
    
      146}

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: existyay <liujam826@gmail.com>
 pkgname=lx-music-shell
-pkgver=2.1.0
+pkgver=2.2.1
 pkgrel=1
 pkgdesc="Terminal music player with multi-source support and auto-reconnect"
 arch=("any")
@@ -35,7 +35,7 @@
         "etc/skel/.config/lx-music-shell/sources.list")
 options=()
 install=lx-music-shell.install
-source=("lx-music-shell-source-v2.1.0.tar.gz::https://github.com/existyay/LX-Music-Shell/archive/refs/tags/v2.1.0.tar.gz")
+source=("lx-music-shell-source-v2.2.1.tar.gz::https://github.com/existyay/LX-Music-Shell/archive/refs/tags/v2.2.1.tar.gz")
 sha256sums=("SKIP")
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 01:36:52	LOW	2
2026-07-28 00:07:28	CLEAN	2
2026-07-27 13:35:00	LOW	1
2026-07-27 09:34:56	LOW	1
2026-07-27 01:34:00	LOW	1
2026-07-27 00:24:32	CLEAN	2
2026-07-26 19:33:02	LOW	1
2026-07-26 17:32:42	LOW	2
2026-07-26 15:32:35	LOW	2