sonora

maintainer nolight · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads prebuilt binaries from the project's own GitHub releases, which is a normal practice for Rust applications; the sources are checksummed and the rest of the build installs only static assets, posing no execution risk beyond the verified binary.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from the project's own GitHub releases, which is a normal practice for Rust applications; the sources are checksummed and the rest of the build installs only static assets, posing no execution risk beyond the verified binary.

PKGBUILD

      1# Maintainer: Pavel Olizko <contact@nolight.dev>
    
      2
    
      3pkgname=sonora
    
      4pkgver=0.15.0
    
      5pkgrel=1
    
      6pkgdesc='A native music streaming client, built with Rust and GPUI'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/nolight132/sonora'
    
      9license=('GPL-3.0-or-later')
    
      10depends=('alsa-lib' 'dbus' 'fontconfig' 'hicolor-icon-theme' 'libxcb' 'libxkbcommon'
    
      11         'libxkbcommon-x11' 'vulkan-icd-loader' 'wayland')
    
      12optdepends=('vulkan-radeon: Vulkan driver for AMD GPUs'
    
      13            'vulkan-intel: Vulkan driver for Intel GPUs'
    
      14            'nvidia-utils: Vulkan driver for NVIDIA GPUs')
    
      15source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
    
      16source_x86_64=("${pkgname}-${pkgver}-x86_64::${url}/releases/download/v${pkgver}/sonora-v${pkgver}-x86_64-unknown-linux-gnu")
    
      17source_aarch64=("${pkgname}-${pkgver}-aarch64::${url}/releases/download/v${pkgver}/sonora-v${pkgver}-aarch64-unknown-linux-gnu")
    
      18sha256sums=('955e4abb3dd9aa8d9869c73b9919b178d37136297fb5a1e7940dc0a266171a80')
    
      19sha256sums_x86_64=('204716840afd9008796817275080a2f40fcf74d2ec3e6f6100cd24ed053875e8')
    
      20sha256sums_aarch64=('4e682803c29e9f5f076de1ab688ecf978a159acf39ac718958a880a5d37c1e49')
    
      21
    
      22package() {
    
      23  cd "${pkgname}-${pkgver}"
    
      24
    
      25  install -Dm755 "${srcdir}/${pkgname}-${pkgver}-${CARCH}" "${pkgdir}/usr/bin/${pkgname}"
    
      26  install -Dm644 assets/linux/sonora.desktop \
    
      27    "${pkgdir}/usr/share/applications/sonora.desktop"
    
      28  install -Dm644 assets/linux/sonora.svg \
    
      29    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/sonora.svg"
    
      30
    
      31  for icon in assets/linux/icons/hicolor/*/apps/sonora.png; do
    
      32    local size
    
      33    size=$(basename "$(dirname "$(dirname "${icon}")")")
    
      34    install -Dm644 "${icon}" \
    
      35      "${pkgdir}/usr/share/icons/hicolor/${size}/apps/sonora.png"
    
      36  done
    
      37
    
      38  install -Dm644 COPYING "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      39  install -Dm644 THIRD-PARTY.md "${pkgdir}/usr/share/licenses/${pkgname}/THIRD-PARTY.md"
    
      40  install -Dm644 assets/fonts/LICENSE.txt \
    
      41    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.Inter"
    
      42  install -Dm644 assets/icons/LICENSE \
    
      43    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.Lucide"
    
      44}
    
      45

Changes since previous scan

--- PKGBUILD @ 2026-08-16 00:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,7 +1,7 @@
 # Maintainer: Pavel Olizko <contact@nolight.dev>
 
 pkgname=sonora
-pkgver=0.14.0
+pkgver=0.15.0
 pkgrel=1
 pkgdesc='A native music streaming client, built with Rust and GPUI'
 arch=('x86_64' 'aarch64')
@@ -15,9 +15,9 @@
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
 source_x86_64=("${pkgname}-${pkgver}-x86_64::${url}/releases/download/v${pkgver}/sonora-v${pkgver}-x86_64-unknown-linux-gnu")
 source_aarch64=("${pkgname}-${pkgver}-aarch64::${url}/releases/download/v${pkgver}/sonora-v${pkgver}-aarch64-unknown-linux-gnu")
-sha256sums=('4a04dfc424fd3f22d4ae60bc3c9ebc683710916f86ea27510729a1c8baa4b66e')
-sha256sums_x86_64=('0ee824af683a7ea37b182244fd16ae54c63fede14afa1678a08339cfb8560afd')
-sha256sums_aarch64=('4b52cab57c7337fc6c46dad317761c958356e3663be9028f7cd1e2cddc210c2b')
+sha256sums=('955e4abb3dd9aa8d9869c73b9919b178d37136297fb5a1e7940dc0a266171a80')
+sha256sums_x86_64=('204716840afd9008796817275080a2f40fcf74d2ec3e6f6100cd24ed053875e8')
+sha256sums_aarch64=('4e682803c29e9f5f076de1ab688ecf978a159acf39ac718958a880a5d37c1e49')
 
 package() {
   cd "${pkgname}-${pkgver}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 01:31:50	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 19:29:30	LOW	2
2026-08-14 01:27:12	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 15:26:23	LOW	2
2026-08-13 13:26:16	LOW	2
2026-08-13 11:26:16	LOW	2