playback-flatpak

maintainer Durag · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package wraps an official prebuilt Flatpak from the vendor's domain, installs it verifiably via checksums, and does not execute untrusted remote code; the low severity is due to the closed-source nature and lack of build-from-source, not active risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package wraps an official prebuilt Flatpak from the vendor's domain, installs it verifiably via checksums, and does not execute untrusted remote code; the low severity is due to the closed-source nature and lack of build-from-source, not active risk.

PKGBUILD

      1# Maintainer: Marc Straube <email@marcstraube.de>
    
      2
    
      3# Playback is closed-source and Epilogue ships it for Linux only as a prebuilt
    
      4# single-file Flatpak bundle (and an AppImage). There is no source release to
    
      5# build from, so this package wraps the official .flatpak bundle: package()
    
      6# stages the bundle into the filesystem, and the install scriptlet registers
    
      7# it with the system-wide Flatpak installation on install/upgrade and removes
    
      8# it again on uninstall. Flathub is added as a remote so the required runtime
    
      9# (org.kde.Platform//6.8) can be pulled — installing therefore needs network
    
      10# access, which is inherent to single-file Flatpak bundles.
    
      11
    
      12_appid=co.epilogue.Playback
    
      13pkgname=playback-flatpak
    
      14# Pinned to 1.9.0: Playback 1.10.0 upgraded the bundled mGBA libretro core and
    
      15# now calls retro_load_external_save, which the shipped mgba.linux.so does not
    
      16# export — the app SIGSEGVs the moment a GB/SN Operator is connected. 1.9.0 is
    
      17# the last release whose app code and core match. Bump to 1.10.x once Epilogue
    
      18# fixes the regression. (1.9.0 shipped as Flatpak only; there is no AppImage.)
    
      19pkgver=1.9.0
    
      20pkgrel=1
    
      21pkgdesc='Retro cartridge software for the Epilogue GB/GBA/SN Operator (official Flatpak bundle)'
    
      22arch=('x86_64' 'aarch64')
    
      23url='https://www.epilogue.co/software/playback'
    
      24license=('LicenseRef-proprietary')
    
      25depends=('flatpak')
    
      26makedepends=('imagemagick')        # renders smaller icon sizes from the 512px source
    
      27conflicts=('playback-appimage')
    
      28options=('!strip' '!debug')        # payload is an opaque OSTree bundle, nothing to strip
    
      29install="$pkgname.install"
    
      30
    
      31_baseurl="https://releases.epilogue.co/desktop/playback/$pkgver/release/linux"
    
      32source=("$pkgname.desktop"
    
      33        "$_appid.png")
    
      34source_x86_64=("$pkgname-$pkgver-x86_64.flatpak::$_baseurl/$_appid.amd64.flatpak")
    
      35source_aarch64=("$pkgname-$pkgver-aarch64.flatpak::$_baseurl/$_appid.arm64.flatpak")
    
      36sha256sums=('b2ecf29507a7972111caf9959fc12fdb8f56510cb4db4461a46829bfb44d318d'
    
      37            '06d4ef6af6e87aaa0e363a4ab9ffd53c8dc211adf884adf120628860ab99f427')
    
      38sha256sums_x86_64=('4e62c01fb2098cc71484b4819d27bc0cb99ce418dfe9aa7f4ddd24ae279ae82c')
    
      39sha256sums_aarch64=('190c4a77f42494c6ff4c98420effd3252d4a6a010aa9b1c427a7dbf167e2892f')
    
      40# A .flatpak bundle is an opaque OSTree archive; never let makepkg unpack it.
    
      41noextract=("$pkgname-$pkgver-x86_64.flatpak"
    
      42           "$pkgname-$pkgver-aarch64.flatpak")
    
      43
    
      44package() {
    
      45  # Stage the bundle where the install scriptlet expects it. $CARCH resolves to
    
      46  # the arch makepkg is building for, so only the matching bundle is shipped.
    
      47  install -Dm644 "$srcdir/$pkgname-$pkgver-$CARCH.flatpak" \
    
      48    "$pkgdir/usr/lib/$pkgname/$_appid.flatpak"
    
      49
    
      50  # Convenience launcher so `playback` stays a plain command instead of forcing
    
      51  # `flatpak run co.epilogue.Playback`. This is why we conflict with
    
      52  # playback-appimage, which ships the same /usr/bin/playback path.
    
      53  install -d "$pkgdir/usr/bin"
    
      54  printf '#!/bin/sh\nexec flatpak run %s "$@"\n' "$_appid" \
    
      55    > "$pkgdir/usr/bin/playback"
    
      56  chmod 755 "$pkgdir/usr/bin/playback"
    
      57
    
      58  # Desktop entry + icon in /usr/share (always on XDG_DATA_DIRS), so the launcher
    
      59  # shows in menus even when the Flatpak exports dir is not wired into the
    
      60  # session — which is the norm here. Same desktop-file id as the Flatpak's own
    
      61  # export, so there is no duplicate entry if that dir later joins the search
    
      62  # path. The icon (pacman-managed; hicolor's alpm hook refreshes the cache) is a
    
      63  # verbatim copy of the one the Flatpak ships.
    
      64  install -Dm644 "$srcdir/$pkgname.desktop" \
    
      65    "$pkgdir/usr/share/applications/$_appid.desktop"
    
      66
    
      67  # Playback ships only a 512px icon; render the common smaller sizes too, so
    
      68  # launchers that don't downscale a lone 512px icon (many wlroots menus) still
    
      69  # show one. hicolor's alpm hook rebuilds the icon cache on install.
    
      70  install -Dm644 "$srcdir/$_appid.png" \
    
      71    "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_appid.png"
    
      72  local px
    
      73  for px in 32 48 64 128 256; do
    
      74    magick "$srcdir/$_appid.png" -resize "${px}x${px}" "$srcdir/icon-$px.png"
    
      75    install -Dm644 "$srcdir/icon-$px.png" \
    
      76      "$pkgdir/usr/share/icons/hicolor/${px}x${px}/apps/$_appid.png"
    
      77  done
    
      78}
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 23:22:13	LOW	2