osu-radio-git

LOW

maintainer Markizzzzz 0 votes scanned 2026-10-31 20:02:55.268531

View on AUR

Why flagged

Builds from the project's own GitHub repository; the flagged 'privileged install' is a false positive as the PKGBUILD only installs files under standard /usr paths with normal permissions (no sudoers, setuid, or self-update mechanisms). SKIP'd checksum on a git source is normal for VCS packages. Low concern due to few votes/recent upload but no actual malicious behaviour.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Builds from the project's own GitHub repository; the flagged 'privileged install' is a false positive as the PKGBUILD only installs files under standard /usr paths with normal permissions (no sudoers, setuid, or self-update mechanisms). SKIP'd checksum on a git source is normal for VCS packages. Low concern due to few votes/recent upload but no actual malicious behaviour.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:33 rustup toolchain install --no-self-update

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vasiliy <ldzkeymylp@gmail.com>
    
      2pkgname=osu-radio-git
    
      3pkgver=0.1.0alpha.r55.g3cf6e1c
    
      4pkgrel=1
    
      5pkgdesc='Desktop music player for local osu! libraries (development version)'
    
      6arch=('x86_64')
    
      7url='https://github.com/Jayko321/osu-radio'
    
      8license=('MIT')
    
      9depends=('glibc' 'libgcc' 'libstdc++' 'alsa-lib' 'qt6-base>=6.8' 'qt6-declarative>=6.8' 'qt6-svg' 'qt6-wayland' 'dotnet-runtime-10.0' 'xdg-desktop-portal' 'xdg-desktop-portal-impl')
    
      10makedepends=('git' 'rustup' 'dotnet-sdk-10.0' 'lld' 'pkgconf' 'clang')
    
      11optdepends=('osu: osu!stable library' 'osu-lazer-bin: osu!lazer library')
    
      12provides=('osu-radio')
    
      13conflicts=('osu-radio' 'osu-radio-bin')
    
      14options=('!lto' '!debug')
    
      15source=("osu-radio::git+$url.git#branch=main")
    
      16sha256sums=('SKIP')
    
      17
    
      18pkgver() {
    
      19  cd "$srcdir/osu-radio"
    
      20  printf '0.1.0alpha.r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      21}
    
      22
    
      23build() {
    
      24  cd "$srcdir/osu-radio"
    
      25  export CARGO_HOME="$srcdir/cargo-home" RUSTUP_HOME="$srcdir/rustup-home"
    
      26  export CARGO_TARGET_DIR="$srcdir/target-production" DOTNET_CLI_HOME="$srcdir/dotnet-home"
    
      27  export NUGET_PACKAGES="$srcdir/nuget-packages" NUGET_HTTP_CACHE_PATH="$srcdir/nuget-http-cache"
    
      28  export XDG_CACHE_HOME="$srcdir/cache" XDG_CONFIG_HOME="$srcdir/config"
    
      29  export DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1 QMAKE=/usr/bin/qmake6
    
      30  export RUSTFLAGS='-C link-arg=-fuse-ld=lld'
    
      31  export OSU_LAZER_REALM_PARSER_PATH=/usr/lib/osu-radio/osu-lazer-realm-parser
    
      32  unset RUSTUP_TOOLCHAIN CARGO_ENCODED_RUSTFLAGS
    
      33  rustup toolchain install --no-self-update
    
      34  local sdk
    
      35  sdk=$(dotnet --list-sdks | awk '/^10\./ { version=$1 } END { print version }')
    
      36  [[ -n $sdk ]] || { echo 'dotnet-sdk-10.0 is required' >&2; return 1; }
    
      37  printf '{"sdk":{"version":"%s","rollForward":"latestPatch"}}\n' "$sdk" > tools/osu-lazer-realm-parser/global.json
    
      38  (cd tools/osu-lazer-realm-parser && dotnet publish --configuration Release --runtime linux-x64 --self-contained false --output "$srcdir/helper-publish")
    
      39  cargo build --release --locked -p osu-radio-qt -p osu-radio-server
    
      40}
    
      41
    
      42package() {
    
      43  cd "$srcdir/osu-radio"
    
      44  install -Dm755 "$srcdir/target-production/release/osu-radio-qt" "$pkgdir/usr/bin/osu-radio-qt"
    
      45  ln -s osu-radio-qt "$pkgdir/usr/bin/osu-radio"
    
      46  install -Dm755 "$srcdir/target-production/release/osu-radio-server" "$pkgdir/usr/bin/osu-radio-server"
    
      47  install -d "$pkgdir/usr/lib/osu-radio"
    
      48  cp -r "$srcdir/helper-publish/." "$pkgdir/usr/lib/osu-radio/"
    
      49  find "$pkgdir/usr/lib/osu-radio" -type f -exec chmod 644 {} +
    
      50  chmod 755 "$pkgdir/usr/lib/osu-radio/osu-lazer-realm-parser" "$pkgdir/usr/lib/osu-radio/librealm-wrappers.so"
    
      51  install -Dm644 packaging/arch/osu-radio.desktop "$pkgdir/usr/share/applications/osu-radio.desktop"
    
      52  install -d "$pkgdir/usr/share/icons"
    
      53  cp -r packaging/icons/hicolor "$pkgdir/usr/share/icons/"
    
      54  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/osu-radio/LICENSE"
    
      55  install -m644 packaging/arch/licenses/* "$pkgdir/usr/share/licenses/osu-radio/"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-31 20:02:55	Low	3
2026-10-31 19:58:49	Medium	2