mixtapes-git

maintainer pocoguy · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs two Python packages (yt-dlp-get-pot and yt-dlp-get-pot-rustypipe) via pip from PyPI into the system during packaging, which introduces a supply-chain risk if those packages are compromised, though they are used as intended plugins for yt-dlp and not obfuscated.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:38 pip install nuitka

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs two Python packages (yt-dlp-get-pot and yt-dlp-get-pot-rustypipe) via pip from PyPI into the system during packaging, which introduces a supply-chain risk if those packages are compromised, though they are used as intended plugins for yt-dlp and not obfuscated.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mohamad Obeid <mobeid nine nine nine nine at gmail dot com>
    
      2# Contributor: Keo Ponleou Sok <dev.ponleousk@gmail.com>
    
      3pkgname=mixtapes-git
    
      4pkgver=2026.26.05.0
    
      5pkgrel=1
    
      6pkgdesc="A modern, Linux-first YouTube Music player"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/m-obeid/Mixtapes"
    
      9license=('GPL3')
    
      10# Note: webkitgtk-6.0 must come from the 'extra' repository. The CachyOS build
    
      11# is known to malfunction with Mixtapes - see the install hook below.
    
      12depends=('python' 'python-gobject' 'gtk4' 'libadwaita' 'webkitgtk-6.0' 'nodejs' 'gst-plugins-base' 'gst-plugins-good' 'gst-plugins-bad' 'gst-plugins-ugly' 'yt-dlp' 'yt-dlp-ejs' 'python-requests' 'python-ytmusicapi' 'python-mprisify' 'python-mutagen')
    
      13makedepends=('git' 'clang' 'python-pip')
    
      14optdepends=('ffmpeg: for downloading music')
    
      15provides=("mixtapes")
    
      16conflicts=("mixtapes")
    
      17install="${pkgname}.install"
    
      18_botguard_ver=0.1.2
    
      19source=("${pkgname}::git+https://github.com/m-obeid/Mixtapes.git")
    
      20source_x86_64=("rustypipe-botguard-${_botguard_ver}-x86_64.tar.xz::https://codeberg.org/ThetaDev/rustypipe-botguard/releases/download/v${_botguard_ver}/rustypipe-botguard-v${_botguard_ver}-x86_64-unknown-linux-gnu.tar.xz")
    
      21source_aarch64=("rustypipe-botguard-${_botguard_ver}-aarch64.tar.xz::https://codeberg.org/ThetaDev/rustypipe-botguard/releases/download/v${_botguard_ver}/rustypipe-botguard-v${_botguard_ver}-aarch64-unknown-linux-gnu.tar.xz")
    
      22sha256sums=('SKIP')
    
      23sha256sums_x86_64=('4f2ec561e8f9fadece7deadc6ce0624fbdedd852222c3eb194c22153b1323129')
    
      24sha256sums_aarch64=('4d038857374a69aea9be8ded981d93a776dc88d4e254f5c6d292746099abf69a')
    
      25
    
      26pkgver() {
    
      27  cd "$pkgname"
    
      28  grep -oP '(?<=<release version=")[^"]+' com.pocoguy.Muse.metainfo.xml | head -1 | tr '-' '.'
    
      29}
    
      30
    
      31build() {
    
      32  cd "$pkgname"
    
      33  glib-compile-resources --sourcedir=. src/muse.gresource.xml --target=src/muse.gresource
    
      34
    
      35  # setup venv to use pip nuitka (instead of aur)
    
      36  python -m venv .venv
    
      37  source .venv/bin/activate
    
      38  pip install nuitka
    
      39  VENV_SITE_PACKAGES=$(python -c "import sysconfig; print(sysconfig.get_path('purelib'))")
    
      40  deactivate
    
      41
    
      42  export PYTHONPATH="$VENV_SITE_PACKAGES:$PYTHONPATH"
    
      43  cd src
    
      44  
    
      45  # build with nuitka
    
      46  python -m nuitka --clang \
    
      47  --file-reference-choice=runtime \
    
      48  --include-package=ui \
    
      49  --include-package=api \
    
      50  --include-package=player \
    
      51  --include-module=logger \
    
      52  --output-filename=mixtapes \
    
      53  main.py
    
      54}
    
      55
    
      56package() {
    
      57  cd "$pkgname"
    
      58
    
      59  # install data files in the correct runtime directories
    
      60  install -d "$pkgdir/usr/lib/mixtapes"
    
      61  cp -r assets "$pkgdir/usr/lib/mixtapes/"
    
      62
    
      63  install -d "$pkgdir/usr/lib/mixtapes/src"
    
      64  cp src/muse.gresource "$pkgdir/usr/lib/mixtapes/src/"
    
      65  cp src/mixtapes "$pkgdir/usr/lib/mixtapes/src/"
    
      66
    
      67  install -d "$pkgdir/usr/lib/mixtapes/src/ui"
    
      68  cp src/ui/style.css "$pkgdir/usr/lib/mixtapes/src/ui/"
    
      69
    
      70  # PO-Token provider binary _find_botguard_bin() in player.py probes this
    
      71  # exact path (/usr/lib/mixtapes/bin) so we don't collide with a standalone
    
      72  # rustypipe-botguard package on /usr/bin. The tarball is a single bare file.
    
      73  install -Dm755 "$srcdir/rustypipe-botguard" "$pkgdir/usr/lib/mixtapes/bin/rustypipe-botguard"
    
      74
    
      75  # PO-Token provider plugins. Without these yt-dlp mints no PO token and
    
      76  # YouTube 403s the gated (seekable Opus / itag 251) formats. Neither is
    
      77  # cleanly installable from the AUR: the AUR `yt-dlp-get-pot` (the GetPOT
    
      78  # framework) hard-depends on an unsatisfiable virtual `YT-DLP-GET-POT-PROVIDER`
    
      79  # that nothing provides, and `yt-dlp-get-pot-rustypipe` (the glue that drives
    
      80  # our bundled rustypipe-botguard binary) isn't packaged at all. Both are
    
      81  # single pure-Python files whose only runtime dep is yt-dlp (already a
    
      82  # dependency), so install them straight from PyPI, without deps, into the
    
      83  # system site-packages the app's interpreter loads yt-dlp plugins from.
    
      84  # --ignore-installed is essential: `pip install --root` otherwise SKIPS a
    
      85  # package it considers "already satisfied" in whatever interpreter pip runs
    
      86  # under (e.g. a builder with an active venv), leaving $pkgdir without the
    
      87  # plugin files and shipping a package that silently 403s. Force the copy.
    
      88  pip install --root="$pkgdir" --prefix=/usr --no-deps --ignore-installed --break-system-packages \
    
      89    "yt-dlp-get-pot>=0.3.0" "yt-dlp-get-pot-rustypipe>=0.2.0"
    
      90
    
      91  # Install desktop file, metainfo and icons
    
      92  install -Dm644 com.pocoguy.Muse.desktop "$pkgdir/usr/share/applications/com.pocoguy.Muse.desktop"
    
      93  install -Dm644 com.pocoguy.Muse.metainfo.xml "$pkgdir/usr/share/metainfo/com.pocoguy.Muse.metainfo.xml"
    
      94  install -Dm644 assets/icons/hicolor/scalable/apps/com.pocoguy.Muse.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/com.pocoguy.Muse.svg"
    
      95  install -Dm644 assets/icons/hicolor/symbolic/apps/com.pocoguy.Muse-symbolic.svg "$pkgdir/usr/share/icons/hicolor/symbolic/apps/com.pocoguy.Muse-symbolic.svg"
    
      96
    
      97  # symlink binary to exported path bin
    
      98  install -d "$pkgdir/usr/bin"
    
      99  ln -sf /usr/lib/mixtapes/src/mixtapes "$pkgdir/usr/bin/mixtapes"
    
      100  
    
      101  # Also provide 'muse' as an alias
    
      102  ln -sf /usr/bin/mixtapes "$pkgdir/usr/bin/muse"
    
      103}
    
      104

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2