oxitide-bin

MEDIUM

maintainer yelanxin 0 votes scanned 2026-08-23 09:20:24.806442

View on AUR

Why flagged

The package downloads a prebuilt Arch binary from a GitHub release, which is an unverifiable executable from a potentially swappable source, posing a supply-chain risk despite the project being on a trusted platform.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt Arch binary from a GitHub release, which is an unverifiable executable from a potentially swappable source, posing a supply-chain risk despite the project being on a trusted platform.

PKGBUILD

      1# Maintainer: Eason <yelanxin@gmail.com>
    
      2#
    
      3# Binary package for OxiTide. The application is proprietary freeware
    
      4# (source is not public), so this repackages the x86_64 Arch build
    
      5# published on the release hub.
    
      6pkgname=oxitide-bin
    
      7_pkgname=oxitide
    
      8# Upstream tags are v0.1-betaN; pacman forbids '-' in pkgver.
    
      9pkgver=0.1beta3
    
      10_tag="v0.1-beta3"
    
      11pkgrel=1
    
      12pkgdesc="High-resolution TIDAL player for Linux, written in Rust. Bit-perfect USB output."
    
      13arch=('x86_64')
    
      14url="https://github.com/yelanxin/OxiTide-release"
    
      15license=('LicenseRef-Proprietary')
    
      16depends=(
    
      17  'gtk4'
    
      18  'libadwaita'
    
      19  'webkitgtk-6.0'
    
      20  'pipewire'
    
      21  'libpulse'
    
      22  'alsa-lib'
    
      23  'libusb'
    
      24  'openssl'
    
      25)
    
      26provides=("${_pkgname}")
    
      27conflicts=("${_pkgname}")
    
      28install="${_pkgname}.install"
    
      29options=('!strip' '!debug')
    
      30source=("${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst::${url}/releases/download/${_tag}/${_pkgname}-${pkgver}-1-x86_64_archlinux.pkg.tar.zst")
    
      31sha256sums=('ecba1efefc9e516d7362c4f15dc8e92f2b035fd083f0dfaebac4f3c6192a8af5')
    
      32noextract=("${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
    
      33
    
      34package() {
    
      35  # Unpack only the payload; the upstream package's own .PKGINFO /
    
      36  # .INSTALL / .MTREE must not leak into $pkgdir.
    
      37  bsdtar -xf "${srcdir}/${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst" -C "${pkgdir}" \
    
      38    --exclude '.PKGINFO' --exclude '.INSTALL' --exclude '.MTREE' --exclude '.BUILDINFO'
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-23 09:20:24	Medium	2
2026-08-23 07:20:18	Medium	2