open-orpheus-git

LOW

maintainer Misaka19465 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from a publicly accessible Git repository of the project, uses frozen JavaScript dependencies via pnpm, and installs Rust/WASM tooling only for AArch64 where system packages are unavailable; the variable-named cargo install targets a version pinned from the project's own Cargo.toml, posing low risk.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a publicly accessible Git repository of the project, uses frozen JavaScript dependencies via pnpm, and installs Rust/WASM tooling only for AArch64 where system packages are unavailable; the variable-named cargo install targets a version pinned from the project's own Cargo.toml, posing low risk.

PKGBUILD:67 cargo install --locked "wasm-bindgen-cli@${_wasm_bindgen_version}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Misaka 19465 <19465@misakanet.team>
    
      2
    
      3pkgname=open-orpheus-git
    
      4pkgver=r974.gb4508e9
    
      5pkgrel=2
    
      6pkgdesc="An open-source implementation of Netease Cloud Music's Orpheus browser host."
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/YUCLing/open-orpheus"
    
      9license=('MIT')
    
      10_srcname=open-orpheus
    
      11provides=('open-orpheus')
    
      12conflicts=('open-orpheus')
    
      13depends=(
    
      14    'alsa-lib'
    
      15    'at-spi2-core'
    
      16    'gtk3'
    
      17    'hicolor-icon-theme'
    
      18    'libdrm'
    
      19    'libnotify'
    
      20    'libxcb'
    
      21    'mesa'
    
      22    'nss'
    
      23    'xdg-utils'
    
      24)
    
      25makedepends=(
    
      26    'git'
    
      27    'pnpm'
    
      28    'python'
    
      29    'zig'
    
      30)
    
      31makedepends_x86_64=(
    
      32    'rust'
    
      33    'rust-wasm'
    
      34    'wasm-bindgen'
    
      35)
    
      36makedepends_aarch64=(
    
      37    'cargo-zigbuild'
    
      38    'rustup'
    
      39)
    
      40source=(
    
      41    "${_srcname}::git+https://github.com/YUCLing/open-orpheus.git#branch=main"
    
      42    "${_srcname}.desktop"
    
      43    "${_srcname}.sh"
    
      44)
    
      45sha256sums=(
    
      46    'SKIP'
    
      47    '56dd949cd671722ae4fbdf71ecd45c1ddafae261068843dc04891735c93bd97a'
    
      48    '728c0ebb644d19ad2679689f2df4d1b11e8c89a22ee1606b0789ce78aca4bd18'
    
      49)
    
      50
    
      51# Derives an AUR-compatible version from the latest main-branch commit.
    
      52pkgver() {
    
      53    cd "${_srcname}"
    
      54    printf 'r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      55}
    
      56
    
      57# Installs the lockfile-pinned JavaScript dependencies required for packaging.
    
      58prepare() {
    
      59    cd "${_srcname}"
    
      60    pnpm install --frozen-lockfile
    
      61    # Arch Linux ARM packages neither the wasm32-unknown-unknown target nor the
    
      62    # wasm-bindgen CLI, so provision both from the rustup toolchain, as upstream CI does.
    
      63    if [[ ${CARCH} == aarch64 ]]; then
    
      64        rustup target add wasm32-unknown-unknown
    
      65        local _wasm_bindgen_version
    
      66        _wasm_bindgen_version=$(awk '/^wasm-bindgen =/ { gsub(/"/, "", $3); print $3; exit }' Cargo.toml)
    
      67        cargo install --locked "wasm-bindgen-cli@${_wasm_bindgen_version}"
    
      68    fi
    
      69}
    
      70
    
      71# Compiles native modules and produces the Linux Electron application bundle.
    
      72build() {
    
      73    cd "${_srcname}"
    
      74    pnpm build:modules
    
      75    pnpm package
    
      76}
    
      77
    
      78# Installs the bundled application and its desktop integration in standard paths.
    
      79package() {
    
      80    # Electron Forge names the packaged bundle after the build host's architecture.
    
      81    local electron_arch
    
      82    case "${CARCH}" in
    
      83        x86_64) electron_arch=x64 ;;
    
      84        aarch64) electron_arch=arm64 ;;
    
      85    esac
    
      86    local appdir="${srcdir}/${_srcname}/out/${_srcname}-linux-${electron_arch}"
    
      87
    
      88    install -d "${pkgdir}/usr/lib/${_srcname}"
    
      89    cp -a "${appdir}/." "${pkgdir}/usr/lib/${_srcname}/"
    
      90    # Electron Forge can retain a restrictive build-directory mode; installed payloads must be readable and traversable by every user.
    
      91    chmod -R a+rX "${pkgdir}/usr/lib/${_srcname}"
    
      92    install -Dm755 "${srcdir}/${_srcname}.sh" "${pkgdir}/usr/bin/${_srcname}"
    
      93    install -Dm644 "${srcdir}/${_srcname}.desktop" \
    
      94        "${pkgdir}/usr/share/applications/${_srcname}.desktop"
    
      95    install -Dm644 "${_srcname}/assets/icon_512.png" \
    
      96        "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${_srcname}.png"
    
      97    install -Dm644 "${_srcname}/LICENSE" \
    
      98        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      99}
    
      100

Changes since previous scan

--- PKGBUILD @ 2026-09-11 15:22
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,9 +2,9 @@
 
 pkgname=open-orpheus-git
 pkgver=r974.gb4508e9
-pkgrel=1
+pkgrel=2
 pkgdesc="An open-source implementation of Netease Cloud Music's Orpheus browser host."
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://github.com/YUCLing/open-orpheus"
 license=('MIT')
 _srcname=open-orpheus
@@ -26,9 +26,16 @@
     'git'
     'pnpm'
     'python'
+    'zig'
+)
+makedepends_x86_64=(
     'rust'
     'rust-wasm'
     'wasm-bindgen'
+)
+makedepends_aarch64=(
+    'cargo-zigbuild'
+    'rustup'
 )
 source=(
     "${_srcname}::git+https://github.com/YUCLing/open-orpheus.git#branch=main"
@@ -51,6 +58,14 @@
 prepare() {
     cd "${_srcname}"
     pnpm install --frozen-lockfile
+    # Arch Linux ARM packages neither the wasm32-unknown-unknown target nor the
+    # wasm-bindgen CLI, so provision both from the rustup toolchain, as upstream CI does.
+    if [[ ${CARCH} == aarch64 ]]; then
+        rustup target add wasm32-unknown-unknown
+        local _wasm_bindgen_version
+        _wasm_bindgen_version=$(awk '/^wasm-bindgen =/ { gsub(/"/, "", $3); print $3; exit }' Cargo.toml)
+        cargo install --locked "wasm-bindgen-cli@${_wasm_bindgen_version}"
+    fi
 }
 
 # Compiles native modules and produces the Linux Electron application bundle.
@@ -62,7 +77,13 @@
 
 # Installs the bundled application and its desktop integration in standard paths.
 package() {
-    local appdir="${srcdir}/${_srcname}/out/${_srcname}-linux-x64"
+    # Electron Forge names the packaged bundle after the build host's architecture.
+    local electron_arch
+    case "${CARCH}" in
+        x86_64) electron_arch=x64 ;;
+        aarch64) electron_arch=arm64 ;;
+    esac
+    local appdir="${srcdir}/${_srcname}/out/${_srcname}-linux-${electron_arch}"
 
     install -d "${pkgdir}/usr/lib/${_srcname}"
     cp -a "${appdir}/." "${pkgdir}/usr/lib/${_srcname}/"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	1
2026-10-16 00:12:47	Low	1
2026-10-15 00:28:05	Low	1
2026-10-14 00:06:47	Low	1
2026-10-13 00:23:45	Low	1
2026-10-12 00:18:51	Low	1
2026-10-11 15:10:51	Low	1
2026-09-11 15:22:58	Clean	0
2026-08-19 00:15:45	Clean	2
2026-08-18 13:39:48	Low	1