netmusic-webplayer-bin

LOW

maintainer knight731 0 votes scanned 2026-10-22 15:35:25.555348

View on AUR

Why flagged

Package downloads a prebuilt binary from the project's own GitHub release, which is a normal AUR practice; the binary is unpacked and installed without executing arbitrary remote code, and the source is properly checksummed.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package downloads a prebuilt binary from the project's own GitHub release, which is a normal AUR practice; the binary is unpacked and installed without executing arbitrary remote code, and the source is properly checksummed.

PKGBUILD

      1# Maintainer: lxp731 <lxp731@users.noreply.github.com>
    
      2# Contributor: netcloud-music contributors
    
      3pkgname=netmusic-webplayer-bin
    
      4pkgver=0.1.0
    
      5pkgrel=2
    
      6pkgdesc="网易云音乐官方网页版的非官方 Linux 桌面外壳"
    
      7arch=('x86_64')
    
      8url="https://github.com/lxp731/NetCloudMusic-Webplayer"
    
      9license=('MIT')
    
      10depends=(
    
      11  'alsa-lib' 'at-spi2-core' 'c-ares' 'gtk3' 'http-parser'
    
      12  'libayatana-appindicator' 'libevent' 'libnotify' 'libpulse' 'libxss'
    
      13  'libxslt' 'minizip' 'nss' 're2' 'snappy' 'xdg-utils'
    
      14)
    
      15makedepends=('libarchive')  # bsdtar
    
      16provides=('netcloud-music')
    
      17conflicts=('netcloud-music')
    
      18source=(
    
      19  "netcloud-music-${pkgver}.pacman::https://github.com/lxp731/NetCloudMusic-Webplayer/releases/download/v${pkgver}/netcloud-music-${pkgver}-x64.pacman"
    
      20)
    
      21sha256sums=('558ccbd303e6f40129e43eac3865c73cdc9315a98d7b3c54ba38b27372074f8d')
    
      22
    
      23package() {
    
      24  # 上游的 .pacman 是 electron-builder 产物，内部就是 usr/ + opt/ 布局；
    
      25  # 解包后只保留实际安装文件，元数据（.PKGINFO 等）由 makepkg 重新生成。
    
      26  bsdtar -xf "${srcdir}/netcloud-music-${pkgver}.pacman" -C "$pkgdir" \
    
      27    --exclude='.PKGINFO' --exclude='.INSTALL' --exclude='.MTREE' --exclude='.BUILDINFO'
    
      28
    
      29  # .pacman 的 post_install 负责建 /usr/bin 软链，解包不执行它，这里补上。
    
      30  install -d "$pkgdir/usr/bin"
    
      31  ln -s "/opt/NetCloud Music/netcloud-music" "$pkgdir/usr/bin/netcloud-music"
    
      32
    
      33  # Arch 默认开启用户命名空间，Electron 用非 setuid 沙箱即可（与官方 electron 包一致）。
    
      34  chmod 0755 "$pkgdir/opt/NetCloud Music/chrome-sandbox"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-22 15:35:25	Low	2