qbzd-bin

MEDIUM

maintainer blitzfc 0 votes scanned 2026-09-08 05:16:12.985842

View on AUR

Why flagged

The package installs a prebuilt binary from GitHub releases with unverified checksums (SKIP), creating a supply-chain risk if the source is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from GitHub releases with unverified checksums (SKIP), creating a supply-chain risk if the source is compromised.

PKGBUILD

      1# Maintainer: blitzkriegfc <blitzkriegfc@gmail.com>
    
      2pkgname=qbzd-bin
    
      3pkgver=2.1.0
    
      4pkgrel=1
    
      5pkgdesc="QBZ headless Qobuz daemon for servers and appliances (prebuilt binary)"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/vicrodh/qbz"
    
      8license=('MIT')
    
      9depends=('alsa-lib')
    
      10optdepends=(
    
      11    'pipewire: PipeWire device discovery and sample-rate control'
    
      12    'libpulse: PulseAudio device discovery and routing through pactl'
    
      13    'jack2: JACK audio backend'
    
      14    'xdg-utils: Open the login URL in a browser when one is available'
    
      15)
    
      16provides=('qbzd')
    
      17conflicts=('qbzd' 'qbzd-git')
    
      18options=('!strip')
    
      19install=qbzd.install
    
      20source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://github.com/vicrodh/qbz/releases/download/v${pkgver}/qbzd-${pkgver}-linux-amd64.tar.gz")
    
      21source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://github.com/vicrodh/qbz/releases/download/v${pkgver}/qbzd-${pkgver}-linux-aarch64.tar.gz")
    
      22sha256sums_x86_64=('SKIP')
    
      23sha256sums_aarch64=('SKIP')
    
      24
    
      25package() {
    
      26    local release_arch
    
      27    case "$CARCH" in
    
      28        x86_64) release_arch=amd64 ;;
    
      29        aarch64) release_arch=aarch64 ;;
    
      30    esac
    
      31
    
      32    cd "${srcdir}/qbzd-${pkgver}-linux-${release_arch}"
    
      33    install -Dm755 qbzd "${pkgdir}/usr/bin/qbzd"
    
      34    install -Dm644 qbzd.service "${pkgdir}/usr/lib/systemd/user/qbzd.service"
    
      35    install -Dm644 completions/qbzd.bash "${pkgdir}/usr/share/bash-completion/completions/qbzd"
    
      36    install -Dm644 completions/qbzd.zsh "${pkgdir}/usr/share/zsh/site-functions/_qbzd"
    
      37    install -Dm644 completions/qbzd.fish "${pkgdir}/usr/share/fish/vendor_completions.d/qbzd.fish"
    
      38    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      39    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      40    install -Dm644 licenses/* -t "${pkgdir}/usr/share/licenses/${pkgname}/third-party"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-08 05:16:12	Medium	2