netease-cloud-music-portable
maintainer Kimiblock
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a Debian package from a plausible official Netease host (d1.music.126.net) to extract and repackage for Arch; this is a common AUR pattern for proprietary software, and the source, while on a non-whitelisted domain, is plausibly official and not executing untrusted remote code.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Debian package from a plausible official Netease host (d1.music.126.net) to extract and repackage for Arch; this is a common AUR pattern for proprietary software, and the source, while on a non-whitelisted domain, is plausibly official and not executing untrusted remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
"https://d1.music.126.net/dmusic/netease-cloud-music_${pkgver}_amd64_ubuntu_${_pkgdate}.deb" -
PKGBUILD:22
"https://music.163.com/html/web2/service.html"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Kimiblock Moe
2
3
# Original PKGBUILD from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=netease-cloud-music
4
5
# Maintainer: kXuan <kxuanobj at gmail dot com>
6
# Contribuor: Peter Cai <peter at typeblog dot net>
7
8
pkgname=netease-cloud-music-portable
9
pkgver=1.2.1
10
_pkgdate=20190428
11
pkgrel=9
12
pkgdesc="Netease Cloud Music, sandboxed by Portable."
13
arch=("x86_64")
14
url="https://music.163.com"
15
provides=(netease-cloud-music)
16
conflicts=(netease-cloud-music)
17
license=('custom')
18
depends=('gtk2' 'gtk3' 'libvlc' 'taglib1' "vlc")
19
makedepends=(gcc desktop-file-utils sed)
20
source=(
21
"https://d1.music.126.net/dmusic/netease-cloud-music_${pkgver}_amd64_ubuntu_${_pkgdate}.deb"
22
"https://music.163.com/html/web2/service.html"
23
"patch.c"
24
"exclude.list"
25
"netease-cloud-music.bash"
26
"portable-config"
27
)
28
sha256sums=('1ee9f02842e6c2c8c79c48b2e932074f9c213a8eb4238e5e63f20438562fecbb'
29
'ea2a9012e8b86ca5946a43f677f64f951f24984dfec523918bfef5eb9e4f0204'
30
'27bfe871df38048dbf164dff966b38ff46654663489443ca5e2c47e2bbc6cc43'
31
'770c8faed52f67d272b061cec36fed219e1479767a97ed58f2496a948d8178c3'
32
'080a6771e74624f589ee2e0196f7e4fad741cfc048f668f47bc8621560b9dac5'
33
'f041f1256cf363a513927ff6f760fde458fd885d5cba8cd9a7fb4cfeb2471d18')
34
35
DLAGENTS=("https::/usr/bin/curl -A 'Mozilla' -fLC - --retry 3 --retry-delay 3 -o %o %u")
36
37
build() {
38
cd ${srcdir}
39
cc -O2 -fPIC -shared -I /usr/include/vlc/plugins/ -o libnetease-patch.so patch.c
40
ln -s /usr/lib/libtag.so.1 libtag.so.2
41
}
42
43
package() {
44
cd ${srcdir}
45
tar -xf data.tar.xz -C ${pkgdir} --exclude-from=exclude.list
46
install -D -m644 service.html ${pkgdir}/usr/share/licenses/$pkgname/license.html
47
install -D -m755 libnetease-patch.so ${pkgdir}/opt/netease/netease-cloud-music/libnetease-patch.so
48
install -D -m755 netease-cloud-music.bash ${pkgdir}/opt/netease/netease-cloud-music/netease-cloud-music.bash
49
install -D -m755 libtag.so.2 ${pkgdir}/opt/netease/netease-cloud-music/libs/libtag.so.2
50
install -d "${pkgdir}/opt/netease/netease-cloud-music/overlay"
51
rm -r "${pkgdir}/usr/share/applications"
52
install -d "${pkgdir}/usr/share/applications"
53
echo '''[Desktop Entry]
54
Version=1.0
55
Type=Application
56
Name=NetEase Cloud Music
57
Name[zh_CN]=网易云音乐
58
Name[zh_TW]=網易雲音樂
59
Comment=NetEase Cloud Music
60
Comment[zh_CN]=网易云音乐
61
Comment[zh_TW]=網易雲音樂
62
Icon=netease-cloud-music
63
Exec=env _portableConfig=com.netease.CloudMusic portable -- %U
64
Categories=AudioVideo;Player;
65
Terminal=false
66
StartupNotify=true
67
StartupWMClass=netease-cloud-music
68
''' >"${pkgdir}/usr/share/applications"/com.netease.CloudMusic.desktop
69
install -Dm755 "${srcdir}/portable-config" "${pkgdir}/usr/lib/portable/info/com.netease.CloudMusic/config"
70
rm -rf "${pkgdir}/usr/bin/"
71
install -d "${pkgdir}/usr/bin/"
72
echo '''#!/usr/bin/bash
73
export _portableConfig=com.netease.CloudMusic
74
exec portable -- $@''' >"${pkgdir}/usr/bin/netease-cloud-music"
75
chmod 755 "${pkgdir}/usr/bin/netease-cloud-music"
76
echo '''[Desktop Entry]
77
Type=Application
78
Name=NetEase Cloud Music
79
Name[zh_CN]=网易云音乐
80
Name[zh_TW]=網易雲音樂
81
GenericName=Stub for MPRIS
82
Icon=netease-cloud-music
83
TryExec=portable
84
Exec=env _portableConfig=com.netease.CloudMusic portable -- %U
85
Terminal=false
86
NoDisplay=true''' >"${pkgdir}/usr/share/applications/netease-cloud-music.desktop"
87
}
88
89
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |