mixtapes-git
MEDIUM
maintainer pocoguy
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package installs Python packages yt-dlp-get-pot and yt-dlp-get-pot-rustypipe via pip from PyPI during packaging, which introduces a supply-chain risk if those packages are compromised, though they are legitimate and minimal in scope.
Triggered rules
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:38
pip install nuitka
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs Python packages yt-dlp-get-pot and yt-dlp-get-pot-rustypipe via pip from PyPI during packaging, which introduces a supply-chain risk if those packages are compromised, though they are legitimate and minimal in scope.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Mohamad Obeid <mobeid nine nine nine nine at gmail dot com>
2
# Contributor: Keo Ponleou Sok <dev.ponleousk@gmail.com>
3
pkgname=mixtapes-git
4
pkgver=2026.09.12.0
5
pkgrel=1
6
pkgdesc="A modern, Linux-first YouTube Music player"
7
arch=('x86_64' 'aarch64')
8
url="https://github.com/m-obeid/Mixtapes"
9
license=('GPL3')
10
# Note: webkitgtk-6.0 must come from the 'extra' repository. The CachyOS build
11
# is known to malfunction with Mixtapes - see the install hook below.
12
depends=('python' 'python-gobject' 'gtk4' 'libadwaita' 'webkitgtk-6.0' 'nodejs' 'gst-plugins-base' 'gst-plugins-good' 'gst-plugins-bad' 'gst-plugins-ugly' 'yt-dlp' 'yt-dlp-ejs' 'python-requests' 'python-ytmusicapi' 'python-mprisify' 'python-mutagen')
13
makedepends=('git' 'clang' 'python-pip')
14
optdepends=('ffmpeg: for downloading music')
15
provides=("mixtapes")
16
conflicts=("mixtapes")
17
install="${pkgname}.install"
18
_botguard_ver=0.1.2
19
source=("${pkgname}::git+https://github.com/m-obeid/Mixtapes.git")
20
source_x86_64=("rustypipe-botguard-${_botguard_ver}-x86_64.tar.xz::https://codeberg.org/ThetaDev/rustypipe-botguard/releases/download/v${_botguard_ver}/rustypipe-botguard-v${_botguard_ver}-x86_64-unknown-linux-gnu.tar.xz")
21
source_aarch64=("rustypipe-botguard-${_botguard_ver}-aarch64.tar.xz::https://codeberg.org/ThetaDev/rustypipe-botguard/releases/download/v${_botguard_ver}/rustypipe-botguard-v${_botguard_ver}-aarch64-unknown-linux-gnu.tar.xz")
22
sha256sums=('SKIP')
23
sha256sums_x86_64=('4f2ec561e8f9fadece7deadc6ce0624fbdedd852222c3eb194c22153b1323129')
24
sha256sums_aarch64=('4d038857374a69aea9be8ded981d93a776dc88d4e254f5c6d292746099abf69a')
25
26
pkgver() {
27
cd "$pkgname"
28
grep -oP '(?<=<release version=")[^"]+' com.pocoguy.Muse.metainfo.xml | head -1 | tr '-' '.'
29
}
30
31
build() {
32
cd "$pkgname"
33
glib-compile-resources --sourcedir=. src/muse.gresource.xml --target=src/muse.gresource
34
35
# setup venv to use pip nuitka (instead of aur)
36
python -m venv .venv
37
source .venv/bin/activate
38
pip install nuitka
39
VENV_SITE_PACKAGES=$(python -c "import sysconfig; print(sysconfig.get_path('purelib'))")
40
deactivate
41
42
export PYTHONPATH="$VENV_SITE_PACKAGES:$PYTHONPATH"
43
cd src
44
45
# build with nuitka
46
python -m nuitka --clang \
47
--file-reference-choice=runtime \
48
--include-package=ui \
49
--include-package=api \
50
--include-package=player \
51
--include-module=logger \
52
--output-filename=mixtapes \
53
main.py
54
}
55
56
package() {
57
cd "$pkgname"
58
59
# install data files in the correct runtime directories
60
install -d "$pkgdir/usr/lib/mixtapes"
61
cp -r assets "$pkgdir/usr/lib/mixtapes/"
62
63
install -d "$pkgdir/usr/lib/mixtapes/src"
64
cp src/muse.gresource "$pkgdir/usr/lib/mixtapes/src/"
65
cp src/mixtapes "$pkgdir/usr/lib/mixtapes/src/"
66
67
install -d "$pkgdir/usr/lib/mixtapes/src/ui"
68
cp src/ui/style.css "$pkgdir/usr/lib/mixtapes/src/ui/"
69
70
# PO-Token provider binary _find_botguard_bin() in player.py probes this
71
# exact path (/usr/lib/mixtapes/bin) so we don't collide with a standalone
72
# rustypipe-botguard package on /usr/bin. The tarball is a single bare file.
73
install -Dm755 "$srcdir/rustypipe-botguard" "$pkgdir/usr/lib/mixtapes/bin/rustypipe-botguard"
74
75
# PO-Token provider plugins. Without these yt-dlp mints no PO token and
76
# YouTube 403s the gated (seekable Opus / itag 251) formats. Neither is
77
# cleanly installable from the AUR: the AUR `yt-dlp-get-pot` (the GetPOT
78
# framework) hard-depends on an unsatisfiable virtual `YT-DLP-GET-POT-PROVIDER`
79
# that nothing provides, and `yt-dlp-get-pot-rustypipe` (the glue that drives
80
# our bundled rustypipe-botguard binary) isn't packaged at all. Both are
81
# single pure-Python files whose only runtime dep is yt-dlp (already a
82
# dependency), so install them straight from PyPI, without deps, into the
83
# system site-packages the app's interpreter loads yt-dlp plugins from.
84
# --ignore-installed is essential: `pip install --root` otherwise SKIPS a
85
# package it considers "already satisfied" in whatever interpreter pip runs
86
# under (e.g. a builder with an active venv), leaving $pkgdir without the
87
# plugin files and shipping a package that silently 403s. Force the copy.
88
pip install --root="$pkgdir" --prefix=/usr --no-deps --ignore-installed --break-system-packages \
89
"yt-dlp-get-pot>=0.3.0" "yt-dlp-get-pot-rustypipe>=0.2.0"
90
91
# Install desktop file, metainfo and icons
92
install -Dm644 com.pocoguy.Muse.desktop "$pkgdir/usr/share/applications/com.pocoguy.Muse.desktop"
93
install -Dm644 com.pocoguy.Muse.metainfo.xml "$pkgdir/usr/share/metainfo/com.pocoguy.Muse.metainfo.xml"
94
install -Dm644 assets/icons/hicolor/scalable/apps/com.pocoguy.Muse.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/com.pocoguy.Muse.svg"
95
install -Dm644 assets/icons/hicolor/symbolic/apps/com.pocoguy.Muse-symbolic.svg "$pkgdir/usr/share/icons/hicolor/symbolic/apps/com.pocoguy.Muse-symbolic.svg"
96
97
# symlink binary to exported path bin
98
install -d "$pkgdir/usr/bin"
99
ln -sf /usr/lib/mixtapes/src/mixtapes "$pkgdir/usr/bin/mixtapes"
100
101
# Also provide 'muse' as an alias
102
ln -sf /usr/bin/mixtapes "$pkgdir/usr/bin/muse"
103
}
104
Changes since previous scan
--- PKGBUILD @ 2026-09-12 00:25+++ PKGBUILD @ 2026-09-17 00:27@@ -1,7 +1,7 @@ # Maintainer: Mohamad Obeid <mobeid nine nine nine nine at gmail dot com> # Contributor: Keo Ponleou Sok <dev.ponleousk@gmail.com> pkgname=mixtapes-git-pkgver=2026.09.04.0+pkgver=2026.09.12.0 pkgrel=1 pkgdesc="A modern, Linux-first YouTube Music player" arch=('x86_64' 'aarch64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 15:12:25 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 21:58:42 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |