moosic-bin

MEDIUM

maintainer anders 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt binaries from a non-whitelisted, non-standard host (dl.moosic.now), which presents a supply-chain risk if the domain is compromised or controlled by an unrelated party, though checksums are provided and the source is otherwise plausibly official.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 source_x86_64=("${_pkgname}-${pkgver}-x86_64::https://dl.moosic.now/v${pkgver}/${_pkgname}-v${pkgver}-linux-amd64")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt binaries from a non-whitelisted, non-standard host (dl.moosic.now), which presents a supply-chain risk if the domain is compromised or controlled by an unrelated party, though checksums are provided and the source is otherwise plausibly official.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Anders Batsman <anders@andvision.se>
    
      2#
    
      3# moosic-bin — prebuilt binary release of moosic.
    
      4# Sources are closed; this PKGBUILD downloads the official tagged binary
    
      5# from dl.moosic.now and installs it system-wide.
    
      6
    
      7pkgname=moosic-bin
    
      8_pkgname=moosic
    
      9pkgver=0.1.13
    
      10pkgrel=1
    
      11pkgdesc="Lightweight cross-platform retro-style audio player with Subsonic support"
    
      12arch=('x86_64' 'aarch64')
    
      13url="https://moosic.now"
    
      14license=('custom:proprietary')
    
      15depends=(
    
      16  'alsa-lib'
    
      17  'libgl'
    
      18  'libx11'
    
      19  'libxcursor'
    
      20  'libxrandr'
    
      21  'libxi'
    
      22  'fontconfig'
    
      23)
    
      24provides=('moosic')
    
      25conflicts=('moosic')
    
      26options=('!strip' '!debug')
    
      27
    
      28# Remote binaries, named per CARCH so the same PKGBUILD covers both arches.
    
      29# The icon is also fetched from the release bucket — keeps the AUR repo
    
      30# under its 488 KiB per-blob limit and means we only ship the icon once.
    
      31source_x86_64=("${_pkgname}-${pkgver}-x86_64::https://dl.moosic.now/v${pkgver}/${_pkgname}-v${pkgver}-linux-amd64")
    
      32source_aarch64=("${_pkgname}-${pkgver}-aarch64::https://dl.moosic.now/v${pkgver}/${_pkgname}-v${pkgver}-linux-arm64")
    
      33
    
      34# moosic.desktop is tiny (~300 bytes) — keep it in the AUR repo so the
    
      35# package builds even if R2 is briefly unreachable. The icon lives at the
    
      36# bucket root (version-independent), refreshed manually when branding
    
      37# changes.
    
      38source=(
    
      39  "moosic.desktop"
    
      40  "${_pkgname}.png::https://dl.moosic.now/icon.png"
    
      41)
    
      42
    
      43# Replace SKIP values when bumping pkgver — see README.md in this directory.
    
      44sha256sums_x86_64=('4bbcde6431a7c958523ba6b214f6095edc4bfdac032f91ca793c213bd1112f6b')
    
      45sha256sums_aarch64=('b1fd1b67f7b4bd452800d755433e6b8ea0bf3dddee399da6c62f661555bc70e7')
    
      46sha256sums=(
    
      47  'fe0f7721359cbf6c022a7be3350620df6ac9d8b85b7db2464b4260558d701ef8' # moosic.desktop
    
      48  '2397b6ad52802060ad69280ceb44ce4ebb190f53a64d87403c98ab9645b68d8d' # icon.png
    
      49)
    
      50
    
      51package() {
    
      52  # Install the binary.
    
      53  install -Dm755 "${srcdir}/${_pkgname}-${pkgver}-${CARCH}" \
    
      54    "${pkgdir}/usr/bin/${_pkgname}"
    
      55
    
      56  # Desktop entry + icon for application menus.
    
      57  install -Dm644 "${srcdir}/moosic.desktop" \
    
      58    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      59  install -Dm644 "${srcdir}/moosic.png" \
    
      60    "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2