pulse-visualizer-bin

maintainer duartelourenco · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt tarball from the project's official GitHub releases, which is a normal and expected practice; the orphaned/re-adopted status does not imply malicious intent or supply chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt tarball from the project's official GitHub releases, which is a normal and expected practice; the orphaned/re-adopted status does not imply malicious intent or supply chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_pkgauthor=Audio-Solutions
    
      4_pkgname=pulse-visualizer
    
      5pkgname=${_pkgname}-bin
    
      6pkgver=1.3.7
    
      7pkgrel=1
    
      8pkgdesc="A GPU-accelerated audio visualizer for PulseAudio/PipeWire"
    
      9arch=('x86_64')
    
      10url="https://github.com/${_pkgauthor}/${_pkgname}"
    
      11_urlraw="https://raw.githubusercontent.com/${_pkgauthor}/${_pkgname}/v${pkgver}"
    
      12license=('GPL-3.0-only')
    
      13
    
      14install=pulse-visualizer-bin.install
    
      15depends=('glibc' 'gcc-libs' 'libebur128' 'glew' 'freetype2' 'libglvnd' 'libpipewire' 'sdl3' 'libpulse' 'yaml-cpp' 'fftw' 'sdl3_image')
    
      16conflicts=("${_pkgname}" "${_pkgname}"-git)
    
      17provides=("${_pkgname}")
    
      18
    
      19source=("${_urlraw}/LICENSE"
    
      20        "${_urlraw}/README.md")
    
      21source_x86_64=("${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-Linux.tar.gz")
    
      22sha256sums=('c53a65c2fd561c87eaabf1072ef5dcab8653042bc15308465f52413585eb6271'
    
      23            'd080c882c568252d20f1b150804b21b4da06d5a34060b0b025e92bf718cae6a2')
    
      24sha256sums_x86_64=('e7fd8bb38eafcdeb27e3942c96b3f0f6197d79d530927acc9600632114b91489')
    
      25
    
      26package() {
    
      27  cd "${srcdir}" || return
    
      28
    
      29  chmod +x ./install.sh
    
      30  ./install.sh "${pkgdir}/usr" "skip-root"
    
      31}
    
      32

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -18,19 +18,15 @@
 
 source=("${_urlraw}/LICENSE"
         "${_urlraw}/README.md")
-source_x86_64=(
-  'tagger'
-)
+source_x86_64=("${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-Linux.tar.gz")
 sha256sums=('c53a65c2fd561c87eaabf1072ef5dcab8653042bc15308465f52413585eb6271'
             'd080c882c568252d20f1b150804b21b4da06d5a34060b0b025e92bf718cae6a2')
 sha256sums_x86_64=('e7fd8bb38eafcdeb27e3942c96b3f0f6197d79d530927acc9600632114b91489')
 
 package() {
-  sudo "$srcdir/tagger"
   cd "${srcdir}" || return
 
   chmod +x ./install.sh
   ./install.sh "${pkgdir}/usr" "skip-root"
 }
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 17:18:23	MEDIUM	1
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0