mpv-music-bin

LOW

maintainer mdrv 0 votes scanned 2026-08-30 11:42:29.053600

View on AUR

Why flagged

The package installs a prebuilt static binary from GitHub Releases, which is a common but unverifiable practice; however, it comes from the project's official repository and uses fixed-version sources with valid checksums, limiting supply-chain risk to typical AUR levels.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt static binary from GitHub Releases, which is a common but unverifiable practice; however, it comes from the project's official repository and uses fixed-version sources with valid checksums, limiting supply-chain risk to typical AUR levels.

PKGBUILD

      1# Maintainer: Umar Alfarouk <medrivia@gmail.com>
    
      2
    
      3_pkgname=mpv-music
    
      4pkgname=$_pkgname-bin
    
      5pkgver=0.27.1
    
      6pkgrel=1
    
      7pkgdesc='Blazing-fast, terminal-native music player and library browser for mpv (prebuilt, static musl)'
    
      8arch=(x86_64 aarch64)
    
      9url='https://github.com/FurqanHun/mpv-music'
    
      10license=(MIT)
    
      11depends=('mpv')
    
      12optdepends=('yt-dlp: for playing URLs'
    
      13            'deno: JS runtime for YouTube playback (recommended)'
    
      14            'nodejs: alternative JS runtime for YouTube playback')
    
      15provides=("$_pkgname=$pkgver")
    
      16conflicts=("$_pkgname")
    
      17options=('!debug')
    
      18source=("LICENSE-$pkgver::https://raw.githubusercontent.com/FurqanHun/$_pkgname/v$pkgver/LICENSE")
    
      19source_x86_64=("$_pkgname-$pkgver-x86_64.tar.gz::$url/releases/download/v$pkgver/$_pkgname-v$pkgver-x86_64-unknown-linux-musl.tar.gz")
    
      20source_aarch64=("$_pkgname-$pkgver-aarch64.tar.gz::$url/releases/download/v$pkgver/$_pkgname-v$pkgver-aarch64-unknown-linux-musl.tar.gz")
    
      21sha256sums=('a45fa2598cba03440691efa1ea743252a7651963808921e5627f7845696a0689')
    
      22sha256sums_x86_64=('7d1e32302ed61294d46b2e3ebbf2f4916a0ab353e9f7964c9f5f1e65266808f7')
    
      23sha256sums_aarch64=('ddf4082cbcfdc0b9d2fc7c20268e0f4a514a327c1833c8fcacee8ba35c07a072')
    
      24
    
      25package() {
    
      26	install -Dm755 "$srcdir/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      27	install -Dm644 "$srcdir/LICENSE-$pkgver" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-30 11:42:29	Low	2