plezy-bin
LOW
maintainer Felitendo
0 votes
scanned 2026-08-21 09:14:41.547952
Why flagged
Package installs a prebuilt binary from the project's official GitHub releases, which is normal for AUR packages distributing upstream-built apps; the binary is not executed during build, and the source is verifiable via checksums.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package installs a prebuilt binary from the project's official GitHub releases, which is normal for AUR packages distributing upstream-built apps; the binary is not executed during build, and the source is verifiable via checksums.
PKGBUILD
1
# Maintainer: Felitendo
2
# This PKGBUILD is updated automatically:
3
# https://github.com/Felitendo/PKGBUILDS
4
5
pkgname=plezy-bin
6
pkgver=2.16.0
7
pkgrel=1
8
pkgdesc="Modern client for Plex, Jellyfin and Emby (upstream binary)"
9
arch=('x86_64' 'aarch64')
10
url="https://plezy.app"
11
license=('GPL-3.0-or-later')
12
# Upstream's own pacman dependency list, taken from the manifest that produces
13
# the release packages (linux/packaging/build-packages.py) and kept in that
14
# shape on purpose: the .deb repackaged here is the same bundle upstream's
15
# .pkg.tar.zst carries. Almost everything the app links travels inside
16
# /opt/plezy/lib - including GTK, glib, libmpv and ffmpeg - so what is declared
17
# here is mostly what upstream deliberately does not bundle, because it is
18
# coupled to the running compositor and GPU driver. libmpv in particular has to
19
# be the bundled, Wayland-enabled build: a distro libmpv silently drops hwdec
20
# to vaapi-copy on the native video plane.
21
depends=('alsa-lib' 'glib2' 'gtk3' 'hicolor-icon-theme' 'libdrm' 'libepoxy'
22
'libevdev' 'libglvnd' 'libva' 'libx11' 'libxcb' 'libxext' 'mesa'
23
'wayland')
24
provides=("plezy=${pkgver}")
25
conflicts=('plezy')
26
# prebuilt, and the runner finds its bundled libraries through the wrapper's
27
# LD_LIBRARY_PATH rather than an RPATH
28
options=('!strip' '!debug')
29
# Release tags carry no v prefix (2.16.0), so the tag is pkgver as-is.
30
source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::https://github.com/edde746/plezy/releases/download/${pkgver}/plezy-linux-x64.deb")
31
source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::https://github.com/edde746/plezy/releases/download/${pkgver}/plezy-linux-arm64.deb")
32
noextract=("${pkgname}-${pkgver}-x86_64.deb" "${pkgname}-${pkgver}-aarch64.deb")
33
sha256sums_x86_64=('f07f95fe6df0fda280a0a0dd94a6315c326ed9613ad34696a61ede769cbac118')
34
sha256sums_aarch64=('883234b646763a235a6882d38983af31ba0b63a2200a3414b5af7ce81b36ca79')
35
36
package() {
37
# the Flutter bundle in /opt/plezy plus the /usr/bin wrapper, desktop entry
38
# and icons upstream's .deb installs
39
bsdtar -xOf "$srcdir/${pkgname}-${pkgver}-${CARCH}.deb" 'data.tar.*' \
40
| bsdtar -xpf - -C "$pkgdir" --exclude './usr/share/doc' ./opt ./usr
41
42
# upstream ships this one non-executable and fixes it up in the .deb's
43
# postinst, which pacman never runs
44
chmod 755 "$pkgdir/opt/plezy/lib/crashpad_handler"
45
46
# GPL-3.0-or-later is a common license (/usr/share/licenses/common/GPL3) and
47
# the .deb carries no license text of its own.
48
49
# Upstream builds its release binaries with ENABLE_UPDATE_CHECK=true, so
50
# unlike the [extra] package this one does check GitHub for new versions.
51
# On Linux that only ever opens a dialog with a browser link - there is no
52
# in-app install path to collide with pacman - and the dialog can be
53
# dismissed per version or turned off in the app's settings.
54
}
55
Changes since previous scan
--- PKGBUILD @ 2026-07-30 05:14+++ PKGBUILD @ 2026-08-21 09:14@@ -1,31 +1,55 @@-# Maintainer: Lai Jiang <jianglai@msn.com>+# Maintainer: Felitendo+# This PKGBUILD is updated automatically:+# https://github.com/Felitendo/PKGBUILDS pkgname=plezy-bin-pkgver=2.11.0+pkgver=2.16.0 pkgrel=1-pkgdesc="A beautiful Plex media server client built with Flutter"-arch=('x86_64')-url="https://github.com/edde746/plezy"-license=('GPL-3.0')-depends=(- 'gtk3'- 'mpv'- 'libepoxy'- 'alsa-lib'- 'libevdev'- 'glib2'-)-source=("${pkgname%-bin}-${pkgver}.pkg.tar.zst::https://github.com/edde746/plezy/releases/download/${pkgver}/plezy-linux-x64.pkg.tar.zst")-sha256sums=('7e515dbf4ec4af35efa85fd36464a9dfb7dd71559e712cb0560a456b7f5d82b4')-provides=("${pkgname%-bin}")-conflicts=("${pkgname%-bin}")+pkgdesc="Modern client for Plex, Jellyfin and Emby (upstream binary)"+arch=('x86_64' 'aarch64')+url="https://plezy.app"+license=('GPL-3.0-or-later')+# Upstream's own pacman dependency list, taken from the manifest that produces+# the release packages (linux/packaging/build-packages.py) and kept in that+# shape on purpose: the .deb repackaged here is the same bundle upstream's+# .pkg.tar.zst carries. Almost everything the app links travels inside+# /opt/plezy/lib - including GTK, glib, libmpv and ffmpeg - so what is declared+# here is mostly what upstream deliberately does not bundle, because it is+# coupled to the running compositor and GPU driver. libmpv in particular has to+# be the bundled, Wayland-enabled build: a distro libmpv silently drops hwdec+# to vaapi-copy on the native video plane.+depends=('alsa-lib' 'glib2' 'gtk3' 'hicolor-icon-theme' 'libdrm' 'libepoxy'+ 'libevdev' 'libglvnd' 'libva' 'libx11' 'libxcb' 'libxext' 'mesa'+ 'wayland')+provides=("plezy=${pkgver}")+conflicts=('plezy')+# prebuilt, and the runner finds its bundled libraries through the wrapper's+# LD_LIBRARY_PATH rather than an RPATH+options=('!strip' '!debug')+# Release tags carry no v prefix (2.16.0), so the tag is pkgver as-is.+source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::https://github.com/edde746/plezy/releases/download/${pkgver}/plezy-linux-x64.deb")+source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::https://github.com/edde746/plezy/releases/download/${pkgver}/plezy-linux-arm64.deb")+noextract=("${pkgname}-${pkgver}-x86_64.deb" "${pkgname}-${pkgver}-aarch64.deb")+sha256sums_x86_64=('f07f95fe6df0fda280a0a0dd94a6315c326ed9613ad34696a61ede769cbac118')+sha256sums_aarch64=('883234b646763a235a6882d38983af31ba0b63a2200a3414b5af7ce81b36ca79') package() {- # Extract the contents of the downloaded zst into the pkgdir- # This works because makepkg automatically extracts the source to $srcdir- cp -ra "$srcdir"/* "$pkgdir/"+ # the Flutter bundle in /opt/plezy plus the /usr/bin wrapper, desktop entry+ # and icons upstream's .deb installs+ bsdtar -xOf "$srcdir/${pkgname}-${pkgver}-${CARCH}.deb" 'data.tar.*' \+ | bsdtar -xpf - -C "$pkgdir" --exclude './usr/share/doc' ./opt ./usr - # Clean up: remove the original source archive if it was extracted into $pkgdir- rm -rf "${pkgdir}/${pkgname%-bin}-${pkgver}.pkg.tar.zst"+ # upstream ships this one non-executable and fixes it up in the .deb's+ # postinst, which pacman never runs+ chmod 755 "$pkgdir/opt/plezy/lib/crashpad_handler"++ # GPL-3.0-or-later is a common license (/usr/share/licenses/common/GPL3) and+ # the .deb carries no license text of its own.++ # Upstream builds its release binaries with ENABLE_UPDATE_CHECK=true, so+ # unlike the [extra] package this one does check GitHub for new versions.+ # On Linux that only ever opens a dialog with a browser link - there is no+ # in-app install path to collide with pacman - and the dialog can be+ # dismissed per version or turned off in the app's settings. } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-21 09:14:41 | Low | 2 |
| 2026-07-30 05:14:03 | Clean | 0 |
| 2026-07-28 01:36:52 | Clean | 0 |
| 2026-07-13 17:42:24 | Clean | 0 |
| 2026-07-13 03:40:50 | Clean | 0 |
| 2026-06-28 08:32:16 | Clean | 0 |
| 2026-06-18 16:11:54 | Clean | 0 |