moosic-bin

maintainer anders · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt binaries from a non-whitelisted, non-standard host (dl.moosic.now) which presents a supply-chain risk if the host were compromised or the downloads silently swapped, though checksums are provided and verified.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 source_x86_64=("${_pkgname}-${pkgver}-x86_64::https://dl.moosic.now/v${pkgver}/${_pkgname}-v${pkgver}-linux-amd64")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt binaries from a non-whitelisted, non-standard host (dl.moosic.now) which presents a supply-chain risk if the host were compromised or the downloads silently swapped, though checksums are provided and verified.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Anders Batsman <anders@andvision.se>
    
      2#
    
      3# moosic-bin — prebuilt binary release of moosic.
    
      4# Sources are closed; this PKGBUILD downloads the official tagged binary
    
      5# from dl.moosic.now and installs it system-wide.
    
      6
    
      7pkgname=moosic-bin
    
      8_pkgname=moosic
    
      9pkgver=0.1.8
    
      10pkgrel=1
    
      11pkgdesc="Lightweight cross-platform retro-style audio player with Subsonic support"
    
      12arch=('x86_64' 'aarch64')
    
      13url="https://moosic.now"
    
      14license=('custom:proprietary')
    
      15depends=(
    
      16  'alsa-lib'
    
      17  'libgl'
    
      18  'libx11'
    
      19  'libxcursor'
    
      20  'libxrandr'
    
      21  'libxi'
    
      22  'fontconfig'
    
      23)
    
      24provides=('moosic')
    
      25conflicts=('moosic')
    
      26options=('!strip' '!debug')
    
      27
    
      28# Remote binaries, named per CARCH so the same PKGBUILD covers both arches.
    
      29# The icon is also fetched from the release bucket — keeps the AUR repo
    
      30# under its 488 KiB per-blob limit and means we only ship the icon once.
    
      31source_x86_64=("${_pkgname}-${pkgver}-x86_64::https://dl.moosic.now/v${pkgver}/${_pkgname}-v${pkgver}-linux-amd64")
    
      32source_aarch64=("${_pkgname}-${pkgver}-aarch64::https://dl.moosic.now/v${pkgver}/${_pkgname}-v${pkgver}-linux-arm64")
    
      33
    
      34# moosic.desktop is tiny (~300 bytes) — keep it in the AUR repo so the
    
      35# package builds even if R2 is briefly unreachable. The icon lives at the
    
      36# bucket root (version-independent), refreshed manually when branding
    
      37# changes.
    
      38source=(
    
      39  "moosic.desktop"
    
      40  "${_pkgname}.png::https://dl.moosic.now/icon.png"
    
      41)
    
      42
    
      43# Replace SKIP values when bumping pkgver — see README.md in this directory.
    
      44sha256sums_x86_64=('fbee1f60d421d8d638ec9a22ca162867a26cd0133a4c9915d5a45b59ba9d68d4')
    
      45sha256sums_aarch64=('24173e310e2919aad2e8a133b0684eff6b8b25aef736a60e77d58a9b516a0dfd')
    
      46sha256sums=(
    
      47  'fe0f7721359cbf6c022a7be3350620df6ac9d8b85b7db2464b4260558d701ef8' # moosic.desktop
    
      48  '2397b6ad52802060ad69280ceb44ce4ebb190f53a64d87403c98ab9645b68d8d' # icon.png
    
      49)
    
      50
    
      51package() {
    
      52  # Install the binary.
    
      53  install -Dm755 "${srcdir}/${_pkgname}-${pkgver}-${CARCH}" \
    
      54    "${pkgdir}/usr/bin/${_pkgname}"
    
      55
    
      56  # Desktop entry + icon for application menus.
    
      57  install -Dm644 "${srcdir}/moosic.desktop" \
    
      58    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      59  install -Dm644 "${srcdir}/moosic.png" \
    
      60    "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png"
    
      61}
    
      62

Changes since previous scan

--- PKGBUILD @ 2026-07-27 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -6,7 +6,7 @@
 
 pkgname=moosic-bin
 _pkgname=moosic
-pkgver=0.1.7
+pkgver=0.1.8
 pkgrel=1
 pkgdesc="Lightweight cross-platform retro-style audio player with Subsonic support"
 arch=('x86_64' 'aarch64')
@@ -41,8 +41,8 @@
 )
 
 # Replace SKIP values when bumping pkgver — see README.md in this directory.
-sha256sums_x86_64=('0bd3556032a87bfac4b0b1ff30f6197d8ed6dcba4dbf96b2d65701765477a599')
-sha256sums_aarch64=('9076bfc1c0af75dae5d504ad1580628bdf1ddcb8151e300a73be7e0cf065f553')
+sha256sums_x86_64=('fbee1f60d421d8d638ec9a22ca162867a26cd0133a4c9915d5a45b59ba9d68d4')
+sha256sums_aarch64=('24173e310e2919aad2e8a133b0684eff6b8b25aef736a60e77d58a9b516a0dfd')
 sha256sums=(
   'fe0f7721359cbf6c022a7be3350620df6ac9d8b85b7db2464b4260558d701ef8' # moosic.desktop
   '2397b6ad52802060ad69280ceb44ce4ebb190f53a64d87403c98ab9645b68d8d' # icon.png

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 23:36:42	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2