plasma-lyrics-bin

LOW

maintainer TheSw1m 0 votes scanned 2026-09-24 13:43:45.914206

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official GitHub releases, which is normal for -bin packages; the low severity is due to few votes and recent upload, not malicious content.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases, which is normal for -bin packages; the low severity is due to few votes and recent upload, not malicious content.

PKGBUILD

      1# Maintainer: swim <swim853279614@163.com>
    
      2pkgname=plasma-lyrics-bin
    
      3pkgver=0.4.2
    
      4pkgrel=1
    
      5pkgdesc='Native synchronized desktop lyrics widget for Plasma 6 (prebuilt)'
    
      6arch=('x86_64')
    
      7url='https://github.com/swim233/plasma-lyrics'
    
      8license=('GPL-2.0-only')
    
      9# Generated by packaging/aur/generate.sh -- depends is copied verbatim from
    
      10# packaging/aur/PKGBUILD. A prebuilt package saves the build, not one single
    
      11# runtime dependency, so this array has to stay identical to the source one.
    
      12depends=('plasma-workspace' 'libplasma' 'kirigami' 'ksvg' 'ki18n' 'kdeclarative'
    
      13         'qt6-base' 'qt6-declarative' 'zlib' 'fontconfig' 'glibc' 'libgcc' 'libstdc++')
    
      14provides=("plasma-lyrics=$pkgver")
    
      15# plasma-lyrics-git provides plasma-lyrics, so pacman resolves this against it
    
      16# too; naming the -git package as well would be redundant.
    
      17conflicts=('plasma-lyrics')
    
      18# The payload is makepkg's own $pkgdir from the source package, already
    
      19# stripped. Without !strip an installing user whose makepkg.conf enables debug
    
      20# re-strips binaries that carry nothing and gets an empty -debug- package.
    
      21options=('!strip' '!debug')
    
      22source=("$pkgname-$pkgver.tar.gz::https://github.com/swim233/plasma-lyrics/releases/download/v0.4.2/plasma-lyrics-0.4.2-x86_64-bin.tar.gz")
    
      23sha256sums=('c097cbb7898546ce55fc147c949d6d2373a2daf1acf61694e5e6712deb961cfc')
    
      24
    
      25package() {
    
      26  cp -a usr "$pkgdir/"
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-24 13:43:45	Low	2