quaver-music-appimage

MEDIUM

maintainer hellopoisonx 0 votes scanned 2026-11-01 07:59:34.641363

View on AUR

Why flagged

The package installs a prebuilt AppImage from GitHub releases, which is an unverifiable executable binary; if the source were swapped maliciously, it could lead to code execution, though the project is hosted on a plausible official repository.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt AppImage from GitHub releases, which is an unverifiable executable binary; if the source were swapped maliciously, it could lead to code execution, though the project is hosted on a plausible official repository.

PKGBUILD

      1# Maintainer: hellopoisonx <x1665341912@gmail.com>
    
      2
    
      3_pkgname=quaver-music
    
      4pkgname=${_pkgname}-appimage
    
      5pkgver=1.7.2
    
      6pkgrel=1
    
      7pkgdesc="Third-party QQ Music client built with Electron (AppImage)"
    
      8arch=('x86_64')
    
      9url="https://github.com/Team-Quaver/${_pkgname}"
    
      10license=('AGPL-3.0-only')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'at-spi2-core'
    
      14  'cairo'
    
      15  'dbus'
    
      16  'expat'
    
      17  'fuse2'
    
      18  'gcc-libs'
    
      19  'glib2'
    
      20  'gtk3'
    
      21  'libcups'
    
      22  'libx11'
    
      23  'libxcb'
    
      24  'libxcomposite'
    
      25  'libxdamage'
    
      26  'libxext'
    
      27  'libxfixes'
    
      28  'libxkbcommon'
    
      29  'libxrandr'
    
      30  'mesa'
    
      31  'nspr'
    
      32  'nss'
    
      33  'pango'
    
      34  'systemd-libs'
    
      35  'xdg-utils'
    
      36)
    
      37optdepends=(
    
      38  'libsecret: encrypted credential storage'
    
      39  'xdg-desktop-portal: global hotkey support'
    
      40)
    
      41provides=('quaver-music')
    
      42conflicts=('quaver-music' 'quaver-music-bin')
    
      43options=('!strip' '!debug')
    
      44
    
      45_asset="Quaver-${pkgver}-x86_64.AppImage"
    
      46source=("${_asset}::${url}/releases/download/v${pkgver}/${_asset}")
    
      47sha256sums=('69f26230a40da93d8a43910784d125f9e7f3db50a82ded6d7f562b7cf564863f')
    
      48
    
      49prepare() {
    
      50  cd "$srcdir"
    
      51  rm -rf squashfs-root
    
      52
    
      53  chmod +x "$_asset"
    
      54
    
      55  # The AppImage runtime can extract itself without FUSE. Pull only the
    
      56  # desktop entry and hicolor icons; the AppImage itself is installed as-is.
    
      57  ./"$_asset" --appimage-extract 'red.0w0.quaver.desktop' >/dev/null
    
      58  ./"$_asset" --appimage-extract 'usr/share/icons/*' >/dev/null
    
      59}
    
      60
    
      61package() {
    
      62  cd "$srcdir"
    
      63
    
      64  install -Dm755 "$_asset" "$pkgdir/opt/$_pkgname/$_pkgname.AppImage"
    
      65
    
      66  install -d "$pkgdir/usr/bin"
    
      67  ln -s "/opt/$_pkgname/$_pkgname.AppImage" "$pkgdir/usr/bin/$_pkgname"
    
      68
    
      69  # Keep the upstream desktop file name so the application's own integration
    
      70  # can overwrite the user-level copy without creating a duplicate menu entry.
    
      71  sed -e 's|^Exec=.*|Exec=quaver-music %U|' \
    
      72      -e 's|^Categories=.*|Categories=AudioVideo;Audio;|' \
    
      73      squashfs-root/red.0w0.quaver.desktop > "${pkgname}.desktop"
    
      74  install -Dm644 "${pkgname}.desktop" \
    
      75    "$pkgdir/usr/share/applications/red.0w0.quaver.desktop"
    
      76
    
      77  local icon
    
      78  while IFS= read -r -d '' icon; do
    
      79    install -Dm644 "$icon" "$pkgdir/usr/${icon#squashfs-root/usr/}"
    
      80  done < <(find squashfs-root/usr/share/icons -type f -name 'red.0w0.quaver.png' -print0)
    
      81}
    
      82

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 07:59:34	Medium	2