rox-player

maintainer Trixelit · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source hosted on the project's official GitHub repository, uses standard Rust build practices, and includes only benign API keys for optional upstream services; no untrusted remote code execution or malicious behavior is present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on the project's official GitHub repository, uses standard Rust build practices, and includes only benign API keys for optional upstream services; no untrusted remote code execution or malicious behavior is present.

PKGBUILD

      1# Maintainer: Juniper <trixelit.alias@gmail.com>
    
      2
    
      3pkgname=rox-player
    
      4pkgver=1.7.0
    
      5pkgrel=1
    
      6pkgdesc="Fast, composable music player written in rust (foobar2000 for the current year)"
    
      7arch=('x86_64')
    
      8url="https://github.com/zealsprince/rox"
    
      9license=('AGPL-3.0-only')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'glibc'
    
      13  'gcc-libs'
    
      14  'sqlite'
    
      15  'libxcb'
    
      16  'libxkbcommon'
    
      17  'libxkbcommon-x11'
    
      18  'vulkan-icd-loader'
    
      19)
    
      20makedepends=('cargo' 'patch' 'curl' 'gcc' 'clang')
    
      21optdepends=(
    
      22  'vulkan-intel: Vulkan support for Intel graphics'
    
      23  'vulkan-radeon: Vulkan support for AMD graphics'
    
      24  'nvidia-utils: Vulkan support for Nvidia graphics'
    
      25)
    
      26provides=('rox')
    
      27conflicts=('rox-player-git')
    
      28source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      29sha256sums=('8699a88a59cc5d403f7e696d81efbf3fc6ac0953a8ffc4e4a1cd487be264e114')
    
      30
    
      31prepare() {
    
      32  cd "rox-$pkgver"
    
      33  
    
      34  # Fetch and patch the GPUI crates for rox
    
      35  chmod +x scripts/vendor-gpui.sh
    
      36  ./scripts/vendor-gpui.sh
    
      37
    
      38  # Download rust deps
    
      39  export CARGO_HOME="$srcdir/cargo-home"
    
      40  cargo fetch --target "$CARCH-unknown-linux-gnu"
    
      41}
    
      42
    
      43build() {
    
      44  cd "rox-$pkgver"
    
      45  export CARGO_HOME="$srcdir/cargo-home"
    
      46
    
      47  # AUR build API keys from Upstream
    
      48  export LASTFM_API_KEY=186d4bf7bd5d686fedb15dc27f33b954
    
      49  export LASTFM_API_SECRET=56addddfc3e50143c90152568ce9185f
    
      50  export DISCORD_APPLICATION_ID=1531533372051030036
    
      51
    
      52  # Tell ring and sqlite3-sys to link against system libraries / build C code correctly
    
      53  export LIBSQLITE3_SYS_USE_PKG_CONFIG=1
    
      54
    
      55  # Fix ring's C/Assembly compilation
    
      56  export CC=gcc
    
      57  export CFLAGS="-O2 -fPIC"
    
      58  export RING_PREGEN_PREFIX=1
    
      59
    
      60  export RUSTFLAGS="--remap-path-prefix=$srcdir=/"
    
      61
    
      62  cargo build --offline --release --all-targets
    
      63}
    
      64
    
      65package() {
    
      66  cd "rox-$pkgver"
    
      67  
    
      68  # Install binary
    
      69  install -Dm755 "target/release/rox" "$pkgdir/usr/bin/rox"
    
      70
    
      71  # Install Licence
    
      72  if [ -f "LICENSE" ]; then
    
      73    install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      74  fi
    
      75
    
      76  # Desktop entry & app icon
    
      77  install -Dm644 "crates/rox/assets/app/rox.desktop" "$pkgdir/usr/share/applications/rox.desktop"
    
      78  
    
      79  install -Dm644 "crates/rox/assets/app/rox.png" "$pkgdir/usr/share/pixmaps/rox.png"
    
      80}
    
      81

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Juniper <trixelit.alias@gmail.com>
 
 pkgname=rox-player
-pkgver=1.6.1
+pkgver=1.7.0
 pkgrel=1
 pkgdesc="Fast, composable music player written in rust (foobar2000 for the current year)"
 arch=('x86_64')
@@ -26,7 +26,7 @@
 provides=('rox')
 conflicts=('rox-player-git')
 source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('f9e45201cdd4b205bc55c355a80ac04deaf8217271ef77d81ed4ed412f9a80aa')
+sha256sums=('8699a88a59cc5d403f7e696d81efbf3fc6ac0953a8ffc4e4a1cd487be264e114')
 
 prepare() {
   cd "rox-$pkgver"
@@ -43,6 +43,11 @@
 build() {
   cd "rox-$pkgver"
   export CARGO_HOME="$srcdir/cargo-home"
+
+  # AUR build API keys from Upstream
+  export LASTFM_API_KEY=186d4bf7bd5d686fedb15dc27f33b954
+  export LASTFM_API_SECRET=56addddfc3e50143c90152568ce9185f
+  export DISCORD_APPLICATION_ID=1531533372051030036
 
   # Tell ring and sqlite3-sys to link against system libraries / build C code correctly
   export LIBSQLITE3_SYS_USE_PKG_CONFIG=1

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 09:20:18	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 05:14:03	LOW	2
2026-07-30 03:13:55	LOW	1
2026-07-28 00:07:28	CLEAN	2
2026-07-27 17:35:03	LOW	1
2026-07-27 05:34:42	LOW	2
2026-07-27 00:24:32	CLEAN	2
2026-07-26 09:32:02	LOW	1
2026-07-26 03:31:41	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 21:31:00	LOW	2