mcplay

maintainer aksr · 5 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads the source tarball from a non-whitelisted but plausibly project-owned personal domain (yahuxo.de); however, the source is verified via multiple checksums, and the build process applies patches and compiles from source, which is standard and safe for AUR packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the source tarball from a non-whitelisted but plausibly project-owned personal domain (yahuxo.de); however, the source is verified via multiple checksums, and the build process applies patches and compiles from source, which is standard and safe for AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("http://www.yahuxo.de/$pkgname/$pkgname-$pkgver.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Anton Bazhenov <anton.bazhenov at gmail>
    
      2# Contributor: chochem <chochem@gmail.com>
    
      3# Maintainer: aksr <aksr at t-com dot me>
    
      4pkgname=mcplay
    
      5pkgver=0.3j
    
      6pkgrel=4
    
      7epoch=
    
      8pkgdesc="A ncurses audio player."
    
      9arch=('i686' 'x86_64')
    
      10url="http://www.yahuxo.de/mcplay/"
    
      11license=('GPL')
    
      12groups=()
    
      13depends=('glib2' 'ncurses' 'mpg123' 'sox')
    
      14makedepends=()
    
      15optdepends=()
    
      16checkdepends=()
    
      17provides=()
    
      18conflicts=()
    
      19replaces=()
    
      20backup=()
    
      21options=()
    
      22install=
    
      23changelog=
    
      24source=("http://www.yahuxo.de/$pkgname/$pkgname-$pkgver.tar.gz"
    
      25        'mcplay.patch'
    
      26        'remote.patch'
    
      27        'config.patch')
    
      28noextract=()
    
      29options=()
    
      30md5sums=('5d898c11da789d8beaa3fbdd2a21e238'
    
      31         'b4b865df9897e76442dcc7182d05fe6e'
    
      32         '7307195fe0513472156f55dfa50247d7'
    
      33         '4fd0d31cceb27ed9dae890afd8d90ab5')
    
      34sha1sums=('42baed9a8627e304205a24d5486e7ffb066b4d51'
    
      35          'b941265146f274f3177d5924f548da8c4176801a'
    
      36          '207b97de49626f29ee671944e6ab052b190006b8'
    
      37          '3e37c55d2534938e40c528a1e428bf56d2a0dfd2')
    
      38sha256sums=('d4840896dc78a1721b6f66112c0d7adfb7d81168d7a03aa6bd314484437e821e'
    
      39            'e6a7db4f6b75ef99a1b1e36a814899b4e280a6648b02f0a2e82d5a43b853e862'
    
      40            '61d782dc8478e016409f74d3e303ea46fbce0e62acfd9bf6f5027ab572eb6c16'
    
      41            '1def176b32a44eeb9fa334c9d1b4ae1abe239aa850e9d979eb9af820edaf958c')
    
      42
    
      43prepare() {
    
      44  cd "$srcdir/$pkgname-$pkgver"
    
      45  patch < ../mcplay.patch
    
      46  patch < ../remote.patch
    
      47}
    
      48
    
      49build() {
    
      50  cd "$srcdir/$pkgname-$pkgver"
    
      51  ./configure --prefix=/usr
    
      52  patch < ../config.patch
    
      53  make
    
      54}
    
      55
    
      56check() {
    
      57  cd "$srcdir/$pkgname-$pkgver"
    
      58  make -k check
    
      59}
    
      60
    
      61package() {
    
      62  cd "$srcdir/$pkgname-$pkgver"
    
      63  make DESTDIR="$pkgdir/" install
    
      64  install -Dm644 README $pkgdir/usr/share/doc/$pkgname/README
    
      65  install -Dm644 COPYING $pkgdir/usr/share/licenses/$pkgname/COPYING
    
      66}
    
      67
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2