mygo-cloudmusic

LOW

maintainer xmengnet 0 votes scanned 2026-10-26 15:45:54.756943

View on AUR

Why flagged

The package builds from source using a tagged GitHub release, which is normal for AUR packages; the low severity is due to few votes and recent upload, not malicious content.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source using a tagged GitHub release, which is normal for AUR packages; the low severity is due to few votes and recent upload, not malicious content.

PKGBUILD

      1# Maintainer: xmengnet <my@liyp.cc>
    
      2
    
      3pkgname=mygo-cloudmusic
    
      4pkgver=0.1.13
    
      5pkgrel=2
    
      6pkgdesc='MyGo 云音乐 - 第三方网易云音乐原生客户端'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://music.egoist.dev'
    
      9license=('AGPL-3.0-only')
    
      10depends=('gtk3' 'libsecret')
    
      11optdepends=(
    
      12  'libpulse: PulseAudio 音频输出'
    
      13  'alsa-lib: ALSA 音频输出（PulseAudio 不可用时）'
    
      14)
    
      15makedepends=('go' 'gcc' 'git')
    
      16options=('!debug')
    
      17
    
      18source=("git+https://github.com/egoist/mygo-cloudmusic.git#tag=v${pkgver}")
    
      19sha256sums=('SKIP')
    
      20
    
      21_srcname=mygo-cloudmusic
    
      22
    
      23if [[ $CARCH == x86_64 ]]; then
    
      24  _goarch=amd64
    
      25elif [[ $CARCH == aarch64 ]]; then
    
      26  _goarch=arm64
    
      27else
    
      28  echo "Unsupported architecture: $CARCH" >&2
    
      29  exit 1
    
      30fi
    
      31
    
      32build() {
    
      33  cd "${_srcname}"
    
      34
    
      35  # cgo and external linking, as Arch's Go packages do, for a PIE with
    
      36  # full RELRO; mygo build passes MYGO_LDFLAGS through last.
    
      37  export CGO_ENABLED=1
    
      38  export GOFLAGS="-buildvcs=false -buildmode=pie"
    
      39  # The hardening flags Arch builds with, kept free of spaces: mygo build
    
      40  # re-quotes the value of -extldflags.
    
      41  export MYGO_LDFLAGS="-linkmode=external -extldflags=-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now,-z,pack-relative-relocs"
    
      42
    
      43  # Writes the executable, its desktop entry and icons, and a Debian
    
      44  # package carrying the 256 and 512 icons hicolor registers.
    
      45  go tool mygo build -platform "linux/${_goarch}" -o "${srcdir}/build"
    
      46}
    
      47
    
      48package() {
    
      49  cd "${_srcname}"
    
      50
    
      51  local _stage="${srcdir}/build/linux-${_goarch}"
    
      52  local _deb="mygo-cloudmusic_${pkgver}_${_goarch}.deb"
    
      53
    
      54  install -Dm755 "${_stage}/mygo-cloudmusic" "${pkgdir}/usr/bin/mygo-cloudmusic"
    
      55
    
      56  install -Dm644 "${_stage}/mygo-cloudmusic.desktop" \
    
      57    "${pkgdir}/usr/share/applications/mygo-cloudmusic.desktop"
    
      58
    
      59  mkdir -p "${srcdir}/deb"
    
      60  bsdtar -xf "${_stage}/${_deb}" -C "${srcdir}/deb" data.tar.gz
    
      61  bsdtar -xf "${srcdir}/deb/data.tar.gz" -C "${srcdir}/deb"
    
      62  for _size in 256 512; do
    
      63    install -Dm644 "${srcdir}/deb/usr/share/icons/hicolor/${_size}x${_size}/apps/mygo-cloudmusic.png" \
    
      64      "${pkgdir}/usr/share/icons/hicolor/${_size}x${_size}/apps/mygo-cloudmusic.png"
    
      65  done
    
      66
    
      67  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 15:45:54	Low	2