qbz

LOW

maintainer blitzfc 0 votes scanned 2026-09-08 05:16:12.985842

View on AUR

Why flagged

The package builds from source hosted on GitHub and vendors Rust dependencies via a release artifact, both from the same project repository; while checksums are skipped, the sources are from the project's official GitHub, reducing supply-chain risk, and no remote code execution or obfuscation is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on GitHub and vendors Rust dependencies via a release artifact, both from the same project repository; while checksums are skipped, the sources are from the project's official GitHub, reducing supply-chain risk, and no remote code execution or obfuscation is present.

PKGBUILD

      1# Maintainer: blitzkriegfc <blitzkriegfc@gmail.com>
    
      2pkgname=qbz
    
      3pkgver=2.1.0
    
      4pkgrel=1
    
      5pkgdesc="Native hi-fi Qobuz desktop player for Linux"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/vicrodh/qbz"
    
      8license=('MIT')
    
      9depends=('qt6-base>=6.8' 'qt6-declarative>=6.8' 'qt6-svg>=6.8' 'qt6-wayland' 'alsa-lib' 'xdg-utils')
    
      10makedepends=('rust' 'cmake' 'nasm' 'jack2')
    
      11# makepkg's GCC LTO objects cannot be consumed from Rust rlibs by rustc's lld.
    
      12options=('!lto' '!debug')
    
      13optdepends=(
    
      14    'alsa-utils: ALSA diagnostics and device inspection'
    
      15    'pipewire: PipeWire device discovery and sample-rate control'
    
      16    'libpulse: PulseAudio device discovery and routing through pactl'
    
      17    'jack2: JACK audio backend'
    
      18)
    
      19provides=('qbz')
    
      20conflicts=('qbz-bin' 'qbz-git')
    
      21source=(
    
      22    "${pkgname}-${pkgver}.tar.gz::https://github.com/vicrodh/qbz/archive/refs/tags/v${pkgver}.tar.gz"
    
      23    "${pkgname}-${pkgver}-cargo-vendor.tar.xz::https://github.com/vicrodh/qbz/releases/download/v${pkgver}/qbz-${pkgver}-cargo-vendor.tar.xz"
    
      24)
    
      25sha256sums=('SKIP' 'SKIP')
    
      26
    
      27prepare() {
    
      28    cd "${srcdir}/qbz-${pkgver}"
    
      29    mkdir -p .cargo
    
      30    printf '%s\n' \
    
      31        '[source.crates-io]' \
    
      32        'replace-with = "vendored-sources"' \
    
      33        '' \
    
      34        '[source.vendored-sources]' \
    
      35        "directory = \"${srcdir}/qbz-${pkgver}-cargo-vendor\"" \
    
      36        '' \
    
      37        '[net]' \
    
      38        'offline = true' > .cargo/config.toml
    
      39}
    
      40
    
      41build() {
    
      42    cd "${srcdir}/qbz-${pkgver}"
    
      43    # Arch's rust toolchain uses lld; cap its parallelism so this large final
    
      44    # link does not exhaust RAM on typical builder machines.
    
      45    QMAKE=/usr/bin/qmake6 cargo rustc --release --locked --offline \
    
      46        --manifest-path crates/Cargo.toml -p qbz-qt --bin qbz -- \
    
      47        -C link-arg=-Wl,--threads=4
    
      48}
    
      49
    
      50package() {
    
      51    cd "${srcdir}/qbz-${pkgver}"
    
      52    install -Dm755 crates/target/release/qbz "${pkgdir}/usr/bin/qbz"
    
      53    install -Dm644 packaging/linux/qbz.desktop \
    
      54        "${pkgdir}/usr/share/applications/com.blitzfc.qbz.desktop"
    
      55
    
      56    local size
    
      57    for size in 32 48 64 128 256 512; do
    
      58        install -Dm644 "packaging/icons/${size}x${size}.png" \
    
      59            "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/qbz.png"
    
      60    done
    
      61
    
      62    install -Dm644 packaging/flatpak/com.blitzfc.qbz.metainfo.xml \
    
      63        "${pkgdir}/usr/share/metainfo/com.blitzfc.qbz.metainfo.xml"
    
      64    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      65    install -Dm644 licenses/* -t "${pkgdir}/usr/share/licenses/${pkgname}/third-party"
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-08 05:16:12	Low	2