mpf3

MEDIUM

maintainer ArchPenguin 0 votes scanned 2026-09-19 11:32:14.537847

View on AUR

Why flagged

Prebuilt tarball containing Python scripts downloaded from a personal/project-specific host (penguiner.eu) that is not an established forge or vendor infrastructure; the source is unverifiable beyond a single sha256 checksum, and the package has few votes/is recently uploaded, making silent substitution a realistic supply-chain concern — though no obfuscation or exfiltration is visible in the PKGBUILD itself.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("https://penguiner.eu/planetmpf3/downloads/mpf3-5.10.019.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 60%): Prebuilt tarball containing Python scripts downloaded from a personal/project-specific host (penguiner.eu) that is not an established forge or vendor infrastructure; the source is unverifiable beyond a single sha256 checksum, and the package has few votes/is recently uploaded, making silent substitution a realistic supply-chain concern — though no obfuscation or exfiltration is visible in the PKGBUILD itself.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Fred BotAIro
    
      2
    
      3pkgname=mpf3
    
      4pkgver=5.10.019
    
      5pkgrel=1
    
      6pkgdesc="Local and network music player/control point with UPnP/DLNA, SMB and gapless playback"
    
      7arch=('any')
    
      8url="https://planetmpf3.penguiner.eu/"
    
      9license=('GPL-3.0-only')
    
      10depends=(
    
      11  'python'
    
      12  'python-gobject'
    
      13  'gtk3'
    
      14  'webkit2gtk-4.1'
    
      15  'python-mutagen'
    
      16  'python-smbprotocol'
    
      17  'ffmpeg'
    
      18  'smbclient'
    
      19  'avahi'
    
      20  'zenity'
    
      21)
    
      22optdepends=(
    
      23  'nss-mdns: mDNS hostname resolution on compatible networks'
    
      24)
    
      25source=("https://penguiner.eu/planetmpf3/downloads/mpf3-5.10.019.tar.gz")
    
      26sha256sums=('d68fa038f9aabf02186cb381c7945eca7919dcafe6c52af12967feaa012ec46d')
    
      27
    
      28package() {
    
      29  cd "${srcdir}/${pkgname}-${pkgver}"
    
      30
    
      31  install -d "${pkgdir}/usr/lib/mpf3"
    
      32  install -m644 mp3f.py mp3f_gtk.py fredplayer_stitch_engine_v0_3.py     "${pkgdir}/usr/lib/mpf3/"
    
      33  cp -a assets "${pkgdir}/usr/lib/mpf3/"
    
      34
    
      35  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/mpf3" <<'LAUNCHER'
    
      36#!/usr/bin/env bash
    
      37exec /usr/bin/python /usr/lib/mpf3/mp3f_gtk.py "$@"
    
      38LAUNCHER
    
      39
    
      40  install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/mpf3.desktop" <<'DESKTOP'
    
      41[Desktop Entry]
    
      42Type=Application
    
      43Name=MPF³
    
      44Comment=Bibliothèque musicale et Control Point réseau
    
      45Exec=mpf3
    
      46TryExec=mpf3
    
      47Icon=mpf3
    
      48Terminal=false
    
      49Categories=AudioVideo;Audio;Player;
    
      50StartupNotify=true
    
      51DESKTOP
    
      52
    
      53  for size in 64 128 256 512; do
    
      54    install -Dm644 "assets/mpf3-${size}.png"       "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/mpf3.png"
    
      55  done
    
      56
    
      57  install -Dm644 README.md "${pkgdir}/usr/share/doc/mpf3/README.md"
    
      58  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/mpf3/LICENSE"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-19 11:32:14	Medium	3
2026-09-19 11:30:33	Medium	2