muffon-git

LOW
maintainer zxp19821005 0 votes scanned 2026-10-27 00:23:28.674093
View on AUR
Why flagged

The package builds from the project's own source via GitHub, uses system-wide Electron, and installs pnpm from npm with a version derived from the project's package.json; while a variable-controlled package install is flagged, it is constrained to a known registry and project-specified version, posing low risk.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from the project's own source via GitHub, uses system-wide Electron, and installs pnpm from npm with a version derived from the project's package.json; while a variable-controlled package install is flagged, it is constrained to a known registry and project-specified version, posing low risk.

  • PKGBUILD:95 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=muffon-git
3pkgver=2.5.0.r3.gb443eb8
4_electronversion=45
5_nodeversion=26
6pkgrel=1
7pkgdesc="Music streaming browser,retrieves audio, video and metadata from various Internet sources.(Use system-wide electron)"
8arch=('any')
9url="https://muffon.netlify.app/"
10_ghurl="https://github.com/staniel359/muffon"
11license=('AGPL-3.0-only')
12conflicts=("${pkgname%-git}")
13provides=("${pkgname%-git}=${pkgver%.r*}")
14depends=(
15 "electron${_electronversion}"
16)
17makedepends=(
18 'npm'
19 'pnpm'
20 'git'
21 'nvm'
22 'gendesk'
23 'jq'
24)
25source=(
26 "${pkgname//-/.}::git+${_ghurl}.git"
27 "${pkgname%-git}.js"
28 "${pkgname%-git}.sh"
29)
30sha256sums=('SKIP'
31 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
32 '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
33_get_project_dir() {
34 local d
35 while IFS= read -r d; do
36 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
37 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
38}
39pkgver() {
40 cd "$(_get_project_dir)"
41 set -o pipefail
42 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
43 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
44}
45_ensure_local_nvm() {
46 local NVM_DIR="${srcdir}/.nvm"
47 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
48 nvm install "${_nodeversion}"
49 nvm use "${_nodeversion}"
50}
51_get_app_dir() {
52 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
53 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
54}
55_get_electron_version() {
56 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
57 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
58 | grep -oE '[0-9]+' | head -1)
59 [[ -z "${_elec_ver}" ]] && return 1
60 (( _elec_ver == _electronversion )) && c=32 || c=31
61 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
62}
63_set_build_env() {
64 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
65 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
66 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
67 export ELECTRON_BUILDER_OFFLINE=true
68 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
69 export HOME="${srcdir}/.home"
70 export XDG_CACHE_HOME="${HOME}/.cache"
71 export XDG_CONFIG_HOME="${HOME}/.config"
72 export XDG_DATA_HOME="${HOME}/.local/share"
73 export XDG_STATE_HOME="${HOME}/.local/state"
74 export PNPM_HOME="${HOME}/.pnpm/bin"
75 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
76 export pnpm_config_store_dir="${HOME}/.pnpm_store"
77 export pnpm_config_global_dir="${HOME}/.pnpm/global"
78 export pnpm_config_state_dir="${HOME}/.pnpm/state"
79 export pnpm_config_node_linker=hoisted
80 export pnpm_config_minimum_release_age=0
81 export pnpm_config_update_notifier=false
82 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
83 export COREPACK_HOME="${HOME}/.corepack"
84 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
85 export PATH="${PNPM_HOME}:${PATH}"
86 local _pnpmver=""
87 local _pkgjson="$(_get_project_dir)/package.json"
88 if [ -f "${_pkgjson}" ]; then
89 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
90 if [ -z "${_pnpmver}" ]; then
91 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
92 fi
93 fi
94 if [ -n "${_pnpmver}" ]; then
95 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
96 --registry "${COREPACK_NPM_REGISTRY}"
97 fi
98}
99prepare() {
100 cd "$(_get_project_dir)"
101 _get_electron_version
102 sed -i -e "
103 s/@electronversion@/${_electronversion}/g
104 s/@appname@/${pkgname%-git}/g
105 " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
106 gendesk -q -f -n \
107 --pkgname="${pkgname%-git}" \
108 --pkgdesc="${pkgdesc}" \
109 --categories="AudioVideo" \
110 --name="${pkgname%-git}" \
111 --exec="${pkgname%-git} %U"
112 _ensure_local_nvm
113 _set_build_env
114 cp public/logo.png public/icons/icon.png
115 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
116 export NODE_ENV=development
117 pnpm install
118}
119build() {
120 cd "$(_get_project_dir)"
121 _ensure_local_nvm
122 _set_build_env
123 export NODE_ENV=production
124 pnpm run build:vue
125 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
126 rm -rf "$(_get_app_dir)/resources/default_app.asar"
127}
128package() {
129 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
130 install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
131 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
132 install -Dm644 "$(_get_project_dir)/build/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
133 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
134 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
135}
136

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-27 00:23
@@ -1,8 +1,8 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=muffon-git
-pkgver=2.4.0.r21.g1c9282d
-_electronversion=40
-_nodeversion=25
+pkgver=2.5.0.r3.gb443eb8
+_electronversion=45
+_nodeversion=26
pkgrel=1
pkgdesc="Music streaming browser,retrieves audio, video and metadata from various Internet sources.(Use system-wide electron)"
arch=('any')
@@ -13,7 +13,6 @@
provides=("${pkgname%-git}=${pkgver%.r*}")
depends=(
"electron${_electronversion}"
- 'python'
)
makedepends=(
'npm'
@@ -21,97 +20,117 @@
'git'
'nvm'
'gendesk'
- 'curl'
'jq'
)
source=(
"${pkgname//-/.}::git+${_ghurl}.git"
+ "${pkgname%-git}.js"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- '31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname//-/.}"
- set -o pipefail
- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
+}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
- _elec_ver=$(jq -r '.devDependencies["electron"] // .dependencies["electron"]' "${srcdir}/${pkgname//-/.}/package.json" | tr -d '^')
- _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
- echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
+}
+_set_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
prepare() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${pkgname%-git}/g
- s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
- " "${srcdir}/${pkgname%-git}.sh"
+ " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
--pkgdesc="${pkgdesc}" \
--categories="AudioVideo" \
--name="${pkgname%-git}" \
--exec="${pkgname%-git} %U"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- HOME="${srcdir}/.electron-gyp"
- {
- echo -e '\n'
- #echo 'build_from_source=true'
- echo 'link-workspace-packages=true'
- echo 'fetch-retry-maxtimeout=10000'
- echo "cache-dir=${srcdir}/.pnpm_cache"
- echo "store-dir=${srcdir}/.pnpm_store"
- echo "virtual-store-dir=${srcdir}/.pnpm_store"
- echo "shamefully-hoist=true"
- echo "virtual-store-dir-max-length=80"
- echo "node-linker=hoisted"
- echo "network-concurrency=32"
- } >> .npmrc
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
- export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- }
- fi
_ensure_local_nvm
+ _set_build_env
cp public/logo.png public/icons/icon.png
- sed -i "s/icon\.icns/icon\.png/g;s/build_electron/release/g" electron-builder.json
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development pnpm install
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ export NODE_ENV=development
+ pnpm install
}
build() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
_ensure_local_nvm
- local electronDist="/usr/lib/electron${_electronversion}"
- NODE_ENV=production pnpm run build
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${electronDist}"
+ _set_build_env
+ export NODE_ENV=production
+ pnpm run build:vue
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- find "${srcdir}/${pkgname//-/.}/release/linux-"*"/resources" -maxdepth 1 -type f -exec install -Dm644 -t "${pkgdir}/usr/lib/${pkgname}" {} +
- if find "${srcdir}/${pkgname//-/.}/release/linux-"*"/resources" -mindepth 1 -maxdepth 1 -type d | read; then
- for _subdir in "${srcdir}/${pkgname//-/.}/release/linux-"*"/resources/"*; do
- if [ -d "${_subdir}" ]; then
- cp -Pr --no-preserve=ownership "${_subdir}" "${pkgdir}/usr/lib/${pkgname}"
- fi
- done
- fi
- install -Dm644 "${srcdir}/${pkgname//-/.}/build/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
- install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ install -Dm644 "$(_get_project_dir)/build/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-10-27 00:23:28 Low 1
2026-10-26 23:46:04 Low 1
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion