pipedal-bin

maintainer xpufx · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package repacks a legitimate upstream .deb from the project's official GitHub release page; it does not execute arbitrary remote code or introduce untrusted binaries beyond the original deb, which is checksum-verified and from a known source.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package repacks a legitimate upstream .deb from the project's official GitHub release page; it does not execute arbitrary remote code or introduce untrusted binaries beyond the original deb, which is checksum-verified and from a known source.

PKGBUILD

      1# Maintainer: xpufx <github@xpufx.com>
    
      2#
    
      3# PiPedal only ships .deb packages; this PKGBUILD repacks the upstream
    
      4# amd64 deb into an Arch package. The package is deliberately inert:
    
      5# the deb's postinst step (pipedalconfig --install) enables and starts
    
      6# services, so it is NOT run automatically.
    
      7# pipedal-bin.install only prints guidance; see README.md.
    
      8
    
      9pkgname=pipedal-bin
    
      10pkgver=2.0.110
    
      11pkgrel=2
    
      12pkgdesc="IoT guitar effect pedal for Raspberry Pi, with phone-friendly web interface"
    
      13arch=('x86_64')
    
      14url="https://rerdavies.github.io/pipedal/"
    
      15license=('MIT')
    
      16depends=(
    
      17  'alsa-lib'
    
      18  'alsa-utils'
    
      19  'avahi'
    
      20  'bzip2'
    
      21  'cairo'
    
      22  'curl'
    
      23  'dbus'
    
      24  'ffmpeg'
    
      25  'gcc-libs'
    
      26  'gdk-pixbuf2'
    
      27  'glib2'
    
      28  'gnupg'
    
      29  'icu'
    
      30  'iw'
    
      31  'jack' # virtual: provided by jack2 or pipewire-jack (pacman prompts)
    
      32  'libbsd'
    
      33  'libcap'
    
      34  'libgcrypt'
    
      35  'libgpg-error'
    
      36  'libjpeg-turbo'
    
      37  'libx11'
    
      38  'libxrandr'
    
      39  'librsvg'
    
      40  'lilv'
    
      41  'lz4'
    
      42  'openssl'
    
      43  'pango'
    
      44  'systemd-libs'
    
      45  'util-linux-libs'
    
      46  'xz'
    
      47  'zlib'
    
      48  'zstd'
    
      49)
    
      50optdepends=(
    
      51  'authbind: only needed when the web UI serves on a port below 1024 (the default is port 80); use `pipedalconfig --install --port 8080` to avoid it (AUR)'
    
      52  'networkmanager: Wi-Fi hotspot and P2P session features'
    
      53  'lv2: use third-party LV2 effects plugins in addition to the bundled ToobAmp set'
    
      54)
    
      55makedepends=('binutils')
    
      56install='pipedal-bin.install'
    
      57source=("https://github.com/rerdavies/pipedal/releases/download/v${pkgver}/pipedal_${pkgver}_amd64.deb")
    
      58sha256sums=('e0e49988ec3f0d63168e82a24345e44f1f06b71f5545f5f2417de609ea695a8b')
    
      59
    
      60package() {
    
      61  cd "${srcdir}"
    
      62
    
      63  # Unpack the deb's data payload. `ar` (binutils) splits the deb into
    
      64  # debian-binary, control.tar.gz and data.tar.gz; the data payload maps
    
      65  # onto the Arch FHS (etc/, usr/).
    
      66  ar x "pipedal_${pkgver}_amd64.deb"
    
      67  tar -xf data.tar.gz -C "${pkgdir}"
    
      68
    
      69  # Arch merged /usr/sbin into /usr/bin (usrmerge): /usr/sbin is a
    
      70  # symlink owned by the filesystem package, so a directory entry for it
    
      71  # would conflict. Move the admin binaries to usr/bin (same location at
    
      72  # runtime) and drop the directory.
    
      73  mv "${pkgdir}"/usr/sbin/* "${pkgdir}"/usr/bin/ 2>/dev/null || true
    
      74  rmdir "${pkgdir}"/usr/sbin 2>/dev/null || true
    
      75
    
      76  # Ship the upstream license bundle (Debian-style copyright file listing
    
      77  # the Expat/MIT main license plus BSD/Apache/MPL/GPL component licenses)
    
      78  # at the Arch-mandated location.
    
      79  install -Dm644 "${pkgdir}/usr/share/doc/pipedal/copyright" \
    
      80    "${pkgdir}/usr/share/licenses/pipedal/LICENSE"
    
      81
    
      82  # Default the web server to a high port: upstream ships
    
      83  # "socketServerAddress": "0.0.0.0:80", which forces the authbind
    
      84  # dependency and root port binding. Serving on 8080 needs neither.
    
      85  # Users can still override via /var/pipedal/config/config.json or by
    
      86  # re-running `pipedalconfig --install --port <n>`.
    
      87  sed -i 's|"socketServerAddress": "0.0.0.0:80"|"socketServerAddress": "0.0.0.0:8080"|' \
    
      88    "${pkgdir}/etc/pipedal/config/config.json"
    
      89
    
      90  # The deb's postinst runs `pipedalconfig --install` (service enablement
    
      91  # + boot config edits). That is intentionally NOT replicated here;
    
      92  # pipedal-bin.install only prints guidance.
    
      93  true
    
      94}
    
      95

Changes since previous scan

--- PKGBUILD @ 2026-08-15 09:30
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,13 +2,13 @@
 #
 # PiPedal only ships .deb packages; this PKGBUILD repacks the upstream
 # amd64 deb into an Arch package. The package is deliberately inert:
-# the deb's postinst step (pipedalconfig --install) enables services and
-# edits the GRUB boot configuration, so it is NOT run automatically.
+# the deb's postinst step (pipedalconfig --install) enables and starts
+# services, so it is NOT run automatically.
 # pipedal-bin.install only prints guidance; see README.md.
 
 pkgname=pipedal-bin
 pkgver=2.0.110
-pkgrel=1
+pkgrel=2
 pkgdesc="IoT guitar effect pedal for Raspberry Pi, with phone-friendly web interface"
 arch=('x86_64')
 url="https://rerdavies.github.io/pipedal/"
@@ -28,6 +28,7 @@
   'gnupg'
   'icu'
   'iw'
+  'jack' # virtual: provided by jack2 or pipewire-jack (pacman prompts)
   'libbsd'
   'libcap'
   'libgcrypt'
@@ -48,8 +49,6 @@
 )
 optdepends=(
   'authbind: only needed when the web UI serves on a port below 1024 (the default is port 80); use `pipedalconfig --install --port 8080` to avoid it (AUR)'
-  'jack2: low-latency JACK audio daemon (jackd) used by pipedal'
-  'pipewire-jack: alternative JACK implementation'
   'networkmanager: Wi-Fi hotspot and P2P session features'
   'lv2: use third-party LV2 effects plugins in addition to the bundled ToobAmp set'
 )

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 17:30:51	LOW	2
2026-08-15 15:30:38	LOW	2
2026-08-15 09:30:19	LOW	2