sonictree-bin

maintainer p741633 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt AppImage from SourceForge, a known but not fully trusted host; however, it is the official project page, checksums are provided, and no remote code execution or obfuscation is present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt AppImage from SourceForge, a known but not fully trusted host; however, it is the official project page, checksums are provided, and no remote code execution or obfuscation is present.

PKGBUILD

      1# Maintainer: p741633 <p741633@hotmail.com>
    
      2
    
      3pkgname=sonictree-bin
    
      4pkgver=1.2.0
    
      5pkgrel=1
    
      6pkgdesc="Folder-based music player (AppImage binary)"
    
      7provides=('sonictree')
    
      8conflicts=('sonictree')
    
      9arch=('x86_64')
    
      10url="https://sourceforge.net/projects/sonictree/"
    
      11license=('LicenseRef-SonicTree-EULA')
    
      12depends=(
    
      13    bash
    
      14)
    
      15options=(!strip)
    
      16
    
      17source=(
    
      18    "SonicTree-${pkgver}-${CARCH}.AppImage::https://downloads.sourceforge.net/project/sonictree/${pkgver}/SonicTree-${pkgver}-${CARCH}.AppImage"
    
      19    "LICENSE::https://downloads.sourceforge.net/sonictree/${pkgver}/LICENSE"
    
      20)
    
      21
    
      22sha256sums=('fa4e0d7bb2e4155594b28c8309cfe191b749859b1bd1dda97691a4d12f3b5530'
    
      23            'b28fa60a2cd23ce36dae9f514e03f4d1d380a0442cea4eeff665ed4e4bf89fc7'
    
      24)
    
      25
    
      26prepare() {
    
      27    chmod +x "${srcdir}/SonicTree-${pkgver}-${CARCH}.AppImage"
    
      28    "${srcdir}/SonicTree-${pkgver}-${CARCH}.AppImage" --appimage-extract >/dev/null
    
      29}
    
      30
    
      31package() {
    
      32    install -Dm644 \
    
      33        "${srcdir}/LICENSE" \
    
      34        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      35
    
      36    install -Dm755 \
    
      37        "${srcdir}/SonicTree-${pkgver}-${CARCH}.AppImage" \
    
      38        "${pkgdir}/opt/${pkgname}/SonicTree.AppImage"
    
      39
    
      40    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/sonictree" <<EOF
    
      41#!/bin/sh
    
      42exec /opt/${pkgname}/SonicTree.AppImage "\$@"
    
      43EOF
    
      44
    
      45    if compgen -G "${srcdir}/squashfs-root/*.desktop" > /dev/null; then
    
      46        desktop=$(echo "${srcdir}"/squashfs-root/*.desktop)
    
      47
    
      48        install -Dm644 \
    
      49            "$desktop" \
    
      50            "${pkgdir}/usr/share/applications/sonictree.desktop"
    
      51
    
      52        sed -i \
    
      53            -e 's|^Exec=.*|Exec=sonictree|' \
    
      54            -e 's|^Icon=.*|Icon=sonictree|' \
    
      55            "${pkgdir}/usr/share/applications/sonictree.desktop"
    
      56    fi
    
      57
    
      58    icon=$(find "${srcdir}/squashfs-root" -type f -name '*.png' | head -n1)
    
      59
    
      60    if [[ -n "$icon" ]]; then
    
      61        install -Dm644 \
    
      62            "$icon" \
    
      63            "${pkgdir}/usr/share/pixmaps/sonictree.png"
    
      64    fi
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 05:34:42	LOW	2
2026-07-27 03:34:02	LOW	2