slipmat
maintainer SoftARV
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package builds from a legitimate source on GitHub and downloads dependencies (including Electron) during prepare(), which is standard for projects using npm and cargo; the downloads are from official sources (npmjs.org, GitHub releases) and the final binaries are locally compiled, posing no direct execution of untrusted remote code.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a legitimate source on GitHub and downloads dependencies (including Electron) during prepare(), which is standard for projects using npm and cargo; the downloads are from official sources (npmjs.org, GitHub releases) and the final binaries are locally compiled, posing no direct execution of untrusted remote code.
PKGBUILD
1
# Maintainer: Miguel Rincon <miguelaezak at gmail dot com>
2
pkgname=slipmat
3
pkgver=0.8.0
4
pkgrel=1
5
pkgdesc="A native GNOME client for Apple Music"
6
arch=('x86_64') # Widevine on Linux is x86_64 only
7
url="https://github.com/SoftARV/Slipmat"
8
license=('GPL-3.0-or-later')
9
depends=('gtk4' 'libadwaita' 'librsvg' 'hicolor-icon-theme')
10
makedepends=('cargo' 'nodejs' 'npm' 'git' 'pkgconf')
11
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
12
sha256sums=('929c3699658c5dbd122252c6234eea303d684192de734b7ecc70f424c3e3dcba')
13
options=('!debug' '!lto')
14
15
# The ~200 MB castLabs Electron download and the crate registry both need the
16
# network, so neither can happen in package(). makepkg allows it here.
17
prepare() {
18
cd "Slipmat-$pkgver"
19
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
20
# sidecar/.npmrc carries `allow-git=root`; npm 12 refuses git dependencies
21
# without it and castLabs Electron ships only as a GitHub release.
22
cd sidecar
23
npm install --no-audit --no-fund
24
# castLabs ships no postinstall hook — the Chromium binary is fetched by an
25
# explicit step. Skip it and node_modules is 14 MB with no Electron in it.
26
node node_modules/electron/install.js
27
}
28
29
build() {
30
cd "Slipmat-$pkgver"
31
export CARGO_TARGET_DIR=target
32
cargo build --release --frozen
33
}
34
35
check() {
36
cd "Slipmat-$pkgver"
37
cargo test --release --frozen
38
}
39
40
package() {
41
cd "Slipmat-$pkgver"
42
local appid=dev.miguelrincon.Slipmat
43
44
install -Dm755 target/release/slipmat "$pkgdir/usr/bin/slipmat"
45
46
# The sidecar goes under /usr/share, which `sidecar::locate` finds via
47
# XDG_DATA_DIRS. It is read-only here; Chromium fetches the Widevine CDM
48
# per-user into ~/.config/Slipmat at first run, so nothing needs to write
49
# inside this directory.
50
install -d "$pkgdir/usr/share/slipmat/sidecar"
51
cp -r sidecar/package.json sidecar/main.js sidecar/preload.js \
52
sidecar/node_modules "$pkgdir/usr/share/slipmat/sidecar/"
53
54
# Prebuilt binaries for architectures this package is not for — 7 MB of
55
# arm64, ia32, darwin and win32 shipped inside one npm dependency. They also
56
# make `strip` complain during packaging, which is how they were noticed.
57
find "$pkgdir/usr/share/slipmat/sidecar" -name '*.node' \
58
! -name '*linux-x64-gnu*' -delete
59
60
install -Dm644 "data/$appid.desktop" \
61
"$pkgdir/usr/share/applications/$appid.desktop"
62
install -Dm644 "data/icons/hicolor/scalable/apps/$appid.svg" \
63
"$pkgdir/usr/share/icons/hicolor/scalable/apps/$appid.svg"
64
install -Dm644 "data/icons/hicolor/symbolic/apps/$appid-symbolic.svg" \
65
"$pkgdir/usr/share/icons/hicolor/symbolic/apps/$appid-symbolic.svg"
66
67
# Raster sizes, rendered from the same SVG, as `make install` does.
68
for sz in 16 32 48 64 128 256 512; do
69
install -d "$pkgdir/usr/share/icons/hicolor/${sz}x${sz}/apps"
70
rsvg-convert -w "$sz" -h "$sz" "data/icons/hicolor/scalable/apps/$appid.svg" \
71
-o "$pkgdir/usr/share/icons/hicolor/${sz}x${sz}/apps/$appid.png"
72
done
73
74
install -Dm644 COPYING "$pkgdir/usr/share/licenses/$pkgname/COPYING"
75
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
76
}
77
Changes since previous scan
--- PKGBUILD @ 2026-07-31 00:14+++ PKGBUILD @ 2026-08-03 00:08@@ -1,6 +1,6 @@ # Maintainer: Miguel Rincon <miguelaezak at gmail dot com> pkgname=slipmat-pkgver=0.7.0+pkgver=0.8.0 pkgrel=1 pkgdesc="A native GNOME client for Apple Music" arch=('x86_64') # Widevine on Linux is x86_64 only@@ -9,7 +9,7 @@ depends=('gtk4' 'libadwaita' 'librsvg' 'hicolor-icon-theme') makedepends=('cargo' 'nodejs' 'npm' 'git' 'pkgconf') source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")-sha256sums=('9c39b4832866c3adcdca3ebc62713848bbbd45ab5f509819717c9f54bbd48859')+sha256sums=('929c3699658c5dbd122252c6234eea303d684192de734b7ecc70f424c3e3dcba') options=('!debug' '!lto') # The ~200 MB castLabs Electron download and the crate registry both need theScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 21:18:45 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 21:16:48 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 17:12:22 | LOW | 2 |
| 2026-07-29 11:11:22 | LOW | 2 |