netease-cloud-music-portable
LOW
maintainer Kimiblock
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a Debian package from a plausible official Netease host (d1.music.126.net) to extract and repackage for Arch; this is a common AUR pattern for proprietary software, and the source, while on a non-whitelisted domain, is plausibly official and not executing untrusted remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Debian package from a plausible official Netease host (d1.music.126.net) to extract and repackage for Arch; this is a common AUR pattern for proprietary software, and the source, while on a non-whitelisted domain, is plausibly official and not executing untrusted remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
"https://d1.music.126.net/dmusic/netease-cloud-music_${pkgver}_amd64_ubuntu_${_pkgdate}.deb" -
PKGBUILD:22
"https://music.163.com/html/web2/service.html"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Kimiblock Moe
2
3
# Original PKGBUILD from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=netease-cloud-music
4
5
# Maintainer: kXuan <kxuanobj at gmail dot com>
6
# Contribuor: Peter Cai <peter at typeblog dot net>
7
8
pkgname=netease-cloud-music-portable
9
pkgver=1.2.1
10
_pkgdate=20190428
11
pkgrel=9
12
pkgdesc="Netease Cloud Music, sandboxed by Portable."
13
arch=("x86_64")
14
url="https://music.163.com"
15
provides=(netease-cloud-music)
16
conflicts=(netease-cloud-music)
17
license=('custom')
18
depends=('gtk2' 'gtk3' 'libvlc' 'taglib1' "vlc")
19
makedepends=(gcc desktop-file-utils sed)
20
source=(
21
"https://d1.music.126.net/dmusic/netease-cloud-music_${pkgver}_amd64_ubuntu_${_pkgdate}.deb"
22
"https://music.163.com/html/web2/service.html"
23
"patch.c"
24
"exclude.list"
25
"netease-cloud-music.bash"
26
"portable-config"
27
)
28
sha256sums=('1ee9f02842e6c2c8c79c48b2e932074f9c213a8eb4238e5e63f20438562fecbb'
29
'ea2a9012e8b86ca5946a43f677f64f951f24984dfec523918bfef5eb9e4f0204'
30
'27bfe871df38048dbf164dff966b38ff46654663489443ca5e2c47e2bbc6cc43'
31
'770c8faed52f67d272b061cec36fed219e1479767a97ed58f2496a948d8178c3'
32
'080a6771e74624f589ee2e0196f7e4fad741cfc048f668f47bc8621560b9dac5'
33
'f041f1256cf363a513927ff6f760fde458fd885d5cba8cd9a7fb4cfeb2471d18')
34
35
DLAGENTS=("https::/usr/bin/curl -A 'Mozilla' -fLC - --retry 3 --retry-delay 3 -o %o %u")
36
37
build() {
38
cd ${srcdir}
39
cc -O2 -fPIC -shared -I /usr/include/vlc/plugins/ -o libnetease-patch.so patch.c
40
ln -s /usr/lib/libtag.so.1 libtag.so.2
41
}
42
43
package() {
44
cd ${srcdir}
45
tar -xf data.tar.xz -C ${pkgdir} --exclude-from=exclude.list
46
install -D -m644 service.html ${pkgdir}/usr/share/licenses/$pkgname/license.html
47
install -D -m755 libnetease-patch.so ${pkgdir}/opt/netease/netease-cloud-music/libnetease-patch.so
48
install -D -m755 netease-cloud-music.bash ${pkgdir}/opt/netease/netease-cloud-music/netease-cloud-music.bash
49
install -D -m755 libtag.so.2 ${pkgdir}/opt/netease/netease-cloud-music/libs/libtag.so.2
50
install -d "${pkgdir}/opt/netease/netease-cloud-music/overlay"
51
rm -r "${pkgdir}/usr/share/applications"
52
install -d "${pkgdir}/usr/share/applications"
53
echo '''[Desktop Entry]
54
Version=1.0
55
Type=Application
56
Name=NetEase Cloud Music
57
Name[zh_CN]=网易云音乐
58
Name[zh_TW]=網易雲音樂
59
Comment=NetEase Cloud Music
60
Comment[zh_CN]=网易云音乐
61
Comment[zh_TW]=網易雲音樂
62
Icon=netease-cloud-music
63
Exec=env _portableConfig=com.netease.CloudMusic portable -- %U
64
Categories=AudioVideo;Player;
65
Terminal=false
66
StartupNotify=true
67
StartupWMClass=netease-cloud-music
68
''' >"${pkgdir}/usr/share/applications"/com.netease.CloudMusic.desktop
69
install -Dm755 "${srcdir}/portable-config" "${pkgdir}/usr/lib/portable/info/com.netease.CloudMusic/config"
70
rm -rf "${pkgdir}/usr/bin/"
71
install -d "${pkgdir}/usr/bin/"
72
echo '''#!/usr/bin/bash
73
export _portableConfig=com.netease.CloudMusic
74
exec portable -- $@''' >"${pkgdir}/usr/bin/netease-cloud-music"
75
chmod 755 "${pkgdir}/usr/bin/netease-cloud-music"
76
echo '''[Desktop Entry]
77
Type=Application
78
Name=NetEase Cloud Music
79
Name[zh_CN]=网易云音乐
80
Name[zh_TW]=網易雲音樂
81
GenericName=Stub for MPRIS
82
Icon=netease-cloud-music
83
TryExec=portable
84
Exec=env _portableConfig=com.netease.CloudMusic portable -- %U
85
Terminal=false
86
NoDisplay=true''' >"${pkgdir}/usr/share/applications/netease-cloud-music.desktop"
87
}
88
89
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |