pipeasioer-bin

maintainer he11ah0und · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs prebuilt binaries from a GitHub release, which is a supply-chain risk if the host is compromised, but the source is from the project's own official repository and the binaries are not executed during build; worst case is local code execution via a malicious binary, not remote code execution or data exfiltration.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs prebuilt binaries from a GitHub release, which is a supply-chain risk if the host is compromised, but the source is from the project's own official repository and the binaries are not executed during build; worst case is local code execution via a malicious binary, not remote code execution or data exfiltration.

PKGBUILD

      1# Maintainer: he11ah0und
    
      2# shellcheck shell=bash disable=SC2034,SC2154
    
      3
    
      4pkgname=pipeasioer-bin
    
      5pkgver=1.2.4
    
      6pkgrel=1
    
      7# Upstream tags use semver prerelease hyphens (v1.0.0-rc1); pkgver maps '-' to '_'.
    
      8_pkgtag="v${pkgver//_/-}"
    
      9pkgdesc="ASIO driver for Wine that talks directly to PipeWire (no libjack dependency) (prebuilt binaries, PipeASIOEr fork)"
    
      10arch=('x86_64')
    
      11url="https://github.com/he11ah0und/PipeASIOEr"
    
      12license=('GPL-3.0-or-later')
    
      13depends=(wine pipewire qt6-base hicolor-icon-theme)
    
      14provides=("pipeasio=${pkgver}")
    
      15# Same on-disk driver files (pipeasio64.dll etc.) as the upstream packages.
    
      16conflicts=(pipeasio pipeasio-bin pipeasio-git)
    
      17# !strip: the PE halves are not ELF, and stripping the .so halves breaks the
    
      18# Wine unixlib exports. !debug: nothing to split out of a prebuilt tarball.
    
      19options=('!strip' '!debug')
    
      20# The release tarball ships no licence text, so take it from the same tag.
    
      21source=("${pkgname}-${pkgver}.tar.gz::${url}/releases/download/${_pkgtag}/pipeasio-${_pkgtag}-archlinux-x86_64.tar.gz"
    
      22        "${pkgname}-${pkgver}-COPYING::${url}/raw/${_pkgtag}/COPYING")
    
      23noextract=()
    
      24b2sums=('b4911ffe6d469e9279494aeeda6f0933db64d5d02387938f0c4d15f82423b8f5066b778f57a5f1dca346561bbeec643f04da46ff023362c2a2768fd20b4b3fe8'
    
      25        '74915e048cf8b5207abf603136e7d5fcf5b8ad512cce78a2ebe3c88fc3150155893bf9824e6ed6a86414bbe4511a6bd4a42e8ec643c63353dc8eea4a44a021cd')
    
      26
    
      27package() {
    
      28  cd "${srcdir}"
    
      29
    
      30  # The tarball is rooted at the install prefix: bin/, lib/, share/.
    
      31  # cp -a keeps the pipeasio.dll / pipeasio.dll.so symlinks Wine 10+ looks up.
    
      32  install -dm755 "${pkgdir}/usr"
    
      33  cp -a --no-preserve=ownership bin lib share "${pkgdir}/usr/"
    
      34
    
      35  install -Dm644 "${pkgname}-${pkgver}-COPYING" \
    
      36    "${pkgdir}/usr/share/licenses/${pkgname}/COPYING"
    
      37
    
      38  # Records the exact Wine, glibc, PipeWire and MinGW the binaries were built
    
      39  # against; the driver may fail to load (c0000135) on an older glibc.
    
      40  install -Dm644 BUILD-INFO.txt -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      41}
    
      42# vim:set ts=2 sw=2 et:
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 15:18:17	LOW	2
2026-07-31 13:18:10	LOW	2