musicbee

maintainer adro · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD uses a custom 'manual://' DLAGENT that explicitly refuses to download anything and instead prints a message telling the user to download MusicBee manually from the official site (getmusicbee.com). This is a well-known AUR pattern for packages whose upstream prohibits automated downloads. The file must be placed in the source directory by the user themselves, so there is no automated fetch from an unofficial host. The checksums are present and cover all sources including the manually-placed archive. The only external automated download is bass_aac24.zip from un4seen.com, which is the official BASS audio library vendor site — a legitimate and well-known source for audio codec DLLs used widely in Wine-based audio players. The sha256sum for that zip is provided. The package installs a Windows executable run under Wine, which is normal for this category. No obfuscation, no unofficial binary host, no missing checksums. The cheaper model misread the manual:// pattern as an actual download from getmusicbee.com.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD uses a custom 'manual://' DLAGENT that explicitly refuses to download anything and instead prints a message telling the user to download MusicBee manually from the official site (getmusicbee.com). This is a well-known AUR pattern for packages whose upstream prohibits automated downloads. The file must be placed in the source directory by the user themselves, so there is no automated fetch from an unofficial host. The checksums are present and cover all sources including the manually-placed archive. The only external automated download is bass_aac24.zip from un4seen.com, which is the official BASS audio library vendor site — a legitimate and well-known source for audio codec DLLs used widely in Wine-based audio players. The sha256sum for that zip is provided. The package installs a Windows executable run under Wine, which is normal for this category. No obfuscation, no unofficial binary host, no missing checksums. The cheaper model misread the manual:// pattern as an actual download from getmusicbee.com.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "https://www.un4seen.com/files/z/2/bass_aac24.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Adrià Cabello <adro.cc79 at protonmail dot com>
    
      2
    
      3pkgname=musicbee
    
      4_pkgver_major=3
    
      5_pkgver_minor=6
    
      6_pkgver_build=9202
    
      7pkgver=${_pkgver_major}.${_pkgver_minor}.${_pkgver_build}
    
      8pkgrel=2
    
      9pkgdesc="Advanced, feature-rich freeware audio player (uses Wine)"
    
      10arch=(x86_64)
    
      11url=https://getmusicbee.com
    
      12license=(custom)
    
      13depends=(wine
    
      14		winetricks
    
      15		lib32-libpulse
    
      16		wine-mono
    
      17		bash)
    
      18makedepends=(p7zip)
    
      19DLAGENTS+=('manual::/usr/bin/echo \ \ Note: Please download the package manually from here: https://www.getmusicbee.com/downloads/ or https://www.majorgeeks.com/files/details/musicbee_portable.html')
    
      20source=("manual://MusicBeePortable_${_pkgver_major}_${_pkgver_minor}.zip"
    
      21		"${pkgname}.desktop"
    
      22		"${pkgname}.sh"
    
      23		"https://www.un4seen.com/files/z/2/bass_aac24.zip") #M4A/AAC Support
    
      24sha256sums=('aff35dc919b4a620847ca0c5269d1d75e93bf96bcabcbbdc0d058ce3e1d82c5d'
    
      25            '42e9670e70a37837a026df7d1f3aa89b5247a09927a15204f8dcc95a551b5fab'
    
      26            '28b4fcee5f7e88dfa8a8b3846a085167d475bd7c7da4680a8009da792addffd5'
    
      27            '782ec4f3758fc715d29ceab332103266df4000dd413a477901dccb8c9bac2090')
    
      28
    
      29package() {
    
      30	install -d -m755 ${pkgdir}/usr/share/$pkgname
    
      31
    
      32	cd ${srcdir}
    
      33	7z x MusicBeePortable_${_pkgver_major}_${_pkgver_minor}.exe -o$pkgname -y
    
      34
    
      35	rm -r $pkgname/*PLUGINSDIR
    
      36
    
      37	cp -ra "$srcdir/$pkgname/"* "${pkgdir}/usr/share/${pkgname}"
    
      38	cp -ra "$srcdir/bass_aac.dll" "${pkgdir}/usr/share/${pkgname}/"
    
      39
    
      40	find "${pkgdir}/usr/share/${pkgname}" -type f -exec chmod 644 "{}" \;
    
      41	find "${pkgdir}/usr/share/${pkgname}" -type d -exec chmod 755 "{}" \;
    
      42	
    
      43	install -Dm644 ${pkgdir}/usr/share/$pkgname/License.rtf ${pkgdir}/usr/share/licenses/$pkgname/License.rtf
    
      44	rm ${pkgdir}/usr/share/$pkgname/License.rtf
    
      45
    
      46	install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      47
    
      48	install -Dm644 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      49	chmod +x "${pkgdir}/usr/bin/${pkgname}"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2