riff-player-bin

LOW

maintainer deridray 0 votes scanned 2026-10-27 07:47:02.942332

View on AUR

Why flagged

The package downloads a prebuilt AppImage from the project's official GitHub releases, which is normal for bin packages; the AppImage is extracted to install desktop/icons, but no untrusted remote code is executed at build/install time.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt AppImage from the project's official GitHub releases, which is normal for bin packages; the AppImage is extracted to install desktop/icons, but no untrusted remote code is executed at build/install time.

PKGBUILD

      1# Maintainer: deridray <deriday@gmail.com>
    
      2pkgname=riff-player-bin
    
      3pkgver=43.0.0
    
      4pkgrel=1
    
      5pkgdesc="A free, open-source desktop music player for YouTube Music, SoundCloud, and local files."
    
      6arch=('x86_64')
    
      7url="https://github.com/rootscripts/riff"
    
      8license=('MIT') 
    
      9provides=('riff')
    
      10conflicts=('riff' 'riff-bin')
    
      11depends=('zlib' 'hicolor-icon-theme' 'fuse2')
    
      12options=(!strip)
    
      13
    
      14_appimage="riff-${pkgver}-linux-x86_64.AppImage"
    
      15source_x86_64=("${url}/releases/download/v${pkgver}/${_appimage}")
    
      16sha256sums_x86_64=('b35ec26f4d630e67a75ed6e3869441458d94e5727e4abf2c557915531b234bb5')
    
      17
    
      18prepare() {
    
      19    chmod +x "${_appimage}"
    
      20    ./"${_appimage}" --appimage-extract "*.desktop" || true
    
      21    ./"${_appimage}" --appimage-extract "usr/share/icons/*" || true
    
      22    ./"${_appimage}" --appimage-extract "*.png" || true
    
      23}
    
      24
    
      25package() {
    
      26    install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/opt/riff/riff.AppImage"
    
      27
    
      28    install -dm755 "${pkgdir}/usr/bin"
    
      29    ln -sf "/opt/riff/riff.AppImage" "${pkgdir}/usr/bin/riff"
    
      30
    
      31    if [[ -d "${srcdir}/squashfs-root" ]]; then
    
      32        cd "${srcdir}/squashfs-root"
    
      33        find . -maxdepth 1 -name "*.desktop" -exec sed -i -E 's|Exec=[^ ]+|Exec=/usr/bin/riff|' {} +
    
      34        find . -maxdepth 1 -name "*.desktop" -exec install -Dm644 {} "${pkgdir}/usr/share/applications/riff.desktop" \;
    
      35        if [[ -d "usr/share/icons" ]]; then
    
      36            cp -r usr/share/icons "${pkgdir}/usr/share/"
    
      37        else
    
      38            find . -maxdepth 1 -name "*.png" -exec install -Dm644 {} "${pkgdir}/usr/share/pixmaps/riff.png" \;
    
      39        fi
    
      40    fi
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 07:47:02	Low	2