pianoteq8

LOW

maintainer SpotlightKid 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs a prebuilt binary from a local source file (user-downloaded), not automatically fetched; the non-standard host flag is a false positive since the source is not downloaded by the PKGBUILD itself.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a prebuilt binary from a local source file (user-downloaded), not automatically fetched; the non-standard host flag is a false positive since the source is not downloaded by the PKGBUILD itself.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 'https://www.pianoteq.com/images/logo/pianoteq_icon_128.png')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christopher Arndt <aur -at- chrisarndt -dot- de>
    
      2# Maintainer: napaalm <nap@napaalm.xyz>
    
      3# Contributor: spider-mario <spidermario@free.fr>
    
      4
    
      5pkgname=pianoteq8
    
      6pkgver=8.4.3
    
      7_name="Pianoteq ${pkgver%%.*}"
    
      8pkgrel=1
    
      9pkgdesc="Physical modelling piano instrument as a standalone program, VST2 and LV2 plugin (Legacy STANDARD version 8)"
    
      10arch=(aarch64 armv7h x86_64)
    
      11url='https://www.modartt.com/pianoteq'
    
      12license=(LicenseRef-EULA)
    
      13groups=(lv2-plugins pro-audio vst-plugins)
    
      14depends=(alsa-lib freetype2 gcc-libs glibc libglvnd ttf-font)
    
      15makedepends=(gendesk)
    
      16optdepends=(
    
      17  'jack: JACK support for stand-alone application'
    
      18  'lv2-host: for loading the LV2 plugin'
    
      19  'vst-host: for loading the VST2 plugin'
    
      20)
    
      21conflicts=(pianoteq-standard-trial-bin)
    
      22# The source package must be downloaded manually.
    
      23# This can be done by going to the link here:
    
      24# https://www.modartt.com/download?file=pianoteq_linux_v843.7z
    
      25source=("local://pianoteq_linux_v${pkgver//./}.7z"
    
      26        'https://www.pianoteq.com/images/logo/pianoteq_icon_128.png')
    
      27sha256sums=('ef6795f9dde3c116494ace88e1ed39e59ad1fddbe787001a33adde644400b4e8'
    
      28            '94ee64cf6688a49d74f0bf70d811e7466abac103feeab17496a89f828afcc6d3')
    
      29
    
      30prepare() {
    
      31  gendesk -f -n \
    
      32    --pkgname="$pkgname" \
    
      33    --pkgdesc="$pkgdesc" \
    
      34    --name="$_name" \
    
      35    --exec="${pkgname}${pkgver%%.*}" \
    
      36    --categories='Audio;AudioVideo;AudioVideoEditing;Midi;Music;Sequencer;'
    
      37}
    
      38
    
      39package() {
    
      40  depends+=(libfreetype.so libasound.so)
    
      41  cd "$_name"
    
      42
    
      43  # Define architecture specific directory
    
      44  # (i686 is no longer supported):
    
      45  if [[ "$CARCH" == x86_64 ]]; then
    
      46    _archdir=x86-64bit
    
      47  elif [[ "$CARCH" == armv7h ]]; then
    
      48    _archdir=arm-32bit
    
      49  elif [[ "$CARCH" == aarch64 ]]; then
    
      50    _archdir=arm-64bit
    
      51  fi
    
      52
    
      53  # Install the standalone executable and symlink
    
      54  install -Dm 755 "$_archdir/$_name" -t "$pkgdir"/usr/bin
    
      55  ln -sf "$_name" "$pkgdir"/usr/bin/${pkgname}${pkgver%%.*}
    
      56
    
      57  # Install the LV2 plugin bundle
    
      58  install -Dm644 "$_archdir/$_name.lv2"/*.ttl -t "$pkgdir/usr/lib/lv2/$_name.lv2"
    
      59  install -Dm755 "$_archdir/$_name.lv2"/${_name/ /_}.so -t "$pkgdir/usr/lib/lv2/$_name.lv2"
    
      60
    
      61  # Install the VST2 plugin (same binary as the one in the LV2 bundle)
    
      62  install -dm755 "$pkgdir"/usr/lib/vst
    
      63  ln -sf "../lv2/$_name.lv2/${_name/ /_}.so" "$pkgdir/usr/lib/vst/$_name.so"
    
      64
    
      65  # Install desktop launcher
    
      66  install -Dm 644 "$srcdir"/pianoteq_icon_128.png "$pkgdir"/usr/share/pixmaps/$pkgname.png
    
      67  install -Dm 644 "$srcdir"/$pkgname.desktop -t "$pkgdir"/usr/share/applications/
    
      68
    
      69  # Install license
    
      70  install -Dm644 Licence* -t "$pkgdir"/usr/share/licenses/$pkgname
    
      71
    
      72  # Install documentation
    
      73  install -Dm644 README_LINUX.txt Documentation/* -t "$pkgdir"/usr/share/doc/$pkgname
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2