purivox-bin

LOW

maintainer ChouChiu 0 votes scanned 2026-09-04 11:57:41.730550

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release, which is a normal practice for AUR packages; the source is verifiable and the payload is not obfuscated or executed remotely.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from a GitHub release, which is a normal practice for AUR packages; the source is verifiable and the payload is not obfuscated or executed remotely.

PKGBUILD

      1# Maintainer: ChouChiu <lshengevery@gmail.com>
    
      2
    
      3pkgname=purivox-bin
    
      4pkgver=1.0.0
    
      5pkgrel=1
    
      6_iteration=1
    
      7pkgdesc="Reference-guided and neural vocal separation for stage and live recordings"
    
      8arch=('x86_64')
    
      9url="https://github.com/ChouChiu/Purivox"
    
      10license=('AGPL-3.0-or-later')
    
      11# The onefile carries its own Python, Qt and DSP stack. Qt still loads EGL and
    
      12# PulseAudio from the system, which is what the .deb declares as well.
    
      13depends=('libglvnd' 'libpulse')
    
      14optdepends=('hicolor-icon-theme: desktop entry icon')
    
      15provides=('purivox')
    
      16conflicts=('purivox')
    
      17# The payload is appended to the executable: stripping it removes the program.
    
      18options=('!strip' '!debug')
    
      19source=("purivox-${pkgver}.deb::${url}/releases/download/v${pkgver}/purivox_${pkgver}-${_iteration}_amd64.deb")
    
      20# The package is the .deb's own tree, so makepkg does not need to unpack the
    
      21# 122 MB archive a second time before package() reads it.
    
      22noextract=("purivox-${pkgver}.deb")
    
      23sha256sums=('23548df90b8a42a3a5150d584e8e581ae500070993af63dbc12861fe961111a4')
    
      24
    
      25package() {
    
      26	# The .deb already stages exactly what a desktop install needs, so the
    
      27	# package is its data tree. bsdtar reads the inner archive off stdin, which
    
      28	# keeps this working whichever compression fpm picked.
    
      29	bsdtar -xOf "purivox-${pkgver}.deb" 'data.tar*' | bsdtar -xp -C "$pkgdir"
    
      30	# Debian keeps the licence under /usr/share/doc; Arch has it in
    
      31	# /usr/share/licenses, where the same file already landed.
    
      32	rm -rf "$pkgdir/usr/share/doc"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-04 11:57:41	Low	2