sonora-nightly-bin
LOW
maintainer nolight
0 votes
scanned 2026-10-29 11:52:15.123535
Why flagged
The package has few votes and was recently uploaded, but it installs a prebuilt binary from the project's official GitHub repository, which is a trusted source; the binary is verified via matching checksums, and no obfuscated or suspicious code execution is present.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package has few votes and was recently uploaded, but it installs a prebuilt binary from the project's official GitHub repository, which is a trusted source; the binary is verified via matching checksums, and no obfuscated or suspicious code execution is present.
PKGBUILD
1
# Maintainer: Pavel Olizko <contact@nolight.dev>
2
3
# Rendered every night from aur/sonora-nightly-bin/PKGBUILD in github.com/sonorahq/sonora by its
4
# nightly workflow, which overwrites any change made in the AUR repository.
5
6
pkgname=sonora-nightly-bin
7
_pkgname=sonora
8
pkgver=0.45.0.nightly.20261029
9
pkgrel=1
10
_commit=b525b2a702ed81035a2439c29da1ca8158a8ee21
11
pkgdesc='A native music streaming client, built with Rust and GPUI (nightly build of main)'
12
arch=('x86_64' 'aarch64')
13
url='https://github.com/sonorahq/sonora'
14
license=('GPL-3.0-or-later')
15
depends=('glibc' 'alsa-lib' 'dbus' 'fontconfig' 'hicolor-icon-theme' 'libxcb'
16
'libxkbcommon' 'libxkbcommon-x11' 'sqlite' 'vulkan-icd-loader' 'wayland')
17
optdepends=('vulkan-radeon: Vulkan driver for AMD GPUs'
18
'vulkan-intel: Vulkan driver for Intel GPUs'
19
'nvidia-utils: Vulkan driver for NVIDIA GPUs'
20
'pipewire-alsa: audio output through PipeWire'
21
'pulseaudio-alsa: audio output through PulseAudio'
22
'webkit2gtk-4.1: sign in to YouTube Music through a browser window')
23
provides=("${_pkgname}=${pkgver%%.nightly.*}")
24
conflicts=("${_pkgname}" "${_pkgname}-bin")
25
options=('!strip' '!debug')
26
source=("${_pkgname}-${_commit}.tar.gz::${url}/archive/${_commit}.tar.gz")
27
source_x86_64=("${pkgname}-${pkgver}-x86_64::${url}/releases/download/nightly/sonora-nightly-x86_64-unknown-linux-gnu")
28
source_aarch64=("${pkgname}-${pkgver}-aarch64::${url}/releases/download/nightly/sonora-nightly-aarch64-unknown-linux-gnu")
29
sha256sums=('ed06edfbc6c406b57bb5209bd241516331a79e0d05fca3508aefa9b11eba04ab')
30
sha256sums_x86_64=('c6b4d54e7163f9063af1b74340b040afa424471ef6a9130c4f65bbd2fe30cc3d')
31
sha256sums_aarch64=('949f9196b9b8dd1a9f365e8e52843d2605edf7afadeb7e89149863f984916d90')
32
33
package() {
34
cd "${_pkgname}-${_commit}"
35
36
install -Dm755 "${srcdir}/${pkgname}-${pkgver}-${CARCH}" "${pkgdir}/usr/bin/${_pkgname}"
37
install -Dm644 assets/linux/sonora.desktop \
38
"${pkgdir}/usr/share/applications/sonora.desktop"
39
install -Dm644 assets/linux/sonora.svg \
40
"${pkgdir}/usr/share/icons/hicolor/scalable/apps/sonora.svg"
41
42
for icon in assets/linux/icons/hicolor/*/apps/sonora.png; do
43
local size
44
size=$(basename "$(dirname "$(dirname "${icon}")")")
45
install -Dm644 "${icon}" \
46
"${pkgdir}/usr/share/icons/hicolor/${size}/apps/sonora.png"
47
done
48
49
install -Dm644 COPYING "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
50
install -Dm644 THIRD-PARTY.md "${pkgdir}/usr/share/licenses/${pkgname}/THIRD-PARTY.md"
51
install -Dm644 assets/fonts/LICENSE.txt \
52
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.Inter"
53
install -Dm644 assets/icons/LICENSE \
54
"${pkgdir}/usr/share/licenses/${pkgname}/icons/LICENSE"
55
56
for licence in assets/icons/*/LICENSE; do
57
local pack
58
pack=$(basename "$(dirname "${licence}")")
59
install -Dm644 "${licence}" \
60
"${pkgdir}/usr/share/licenses/${pkgname}/icons/LICENSE.${pack}"
61
done
62
}
63
Changes since previous scan
--- PKGBUILD @ 2026-10-29 00:13+++ PKGBUILD @ 2026-10-29 11:52@@ -5,9 +5,9 @@ pkgname=sonora-nightly-bin _pkgname=sonora-pkgver=0.45.0.nightly.20261027+pkgver=0.45.0.nightly.20261029 pkgrel=1-_commit=505124bcc27e3d16e817dd48f7205311056829f8+_commit=b525b2a702ed81035a2439c29da1ca8158a8ee21 pkgdesc='A native music streaming client, built with Rust and GPUI (nightly build of main)' arch=('x86_64' 'aarch64') url='https://github.com/sonorahq/sonora'@@ -26,9 +26,9 @@ source=("${_pkgname}-${_commit}.tar.gz::${url}/archive/${_commit}.tar.gz") source_x86_64=("${pkgname}-${pkgver}-x86_64::${url}/releases/download/nightly/sonora-nightly-x86_64-unknown-linux-gnu") source_aarch64=("${pkgname}-${pkgver}-aarch64::${url}/releases/download/nightly/sonora-nightly-aarch64-unknown-linux-gnu")-sha256sums=('dc65a38696d29ea3d105eae51b325c161ddc949d5b19692d8cf5afedf985bf78')-sha256sums_x86_64=('14db7e791fdfcd9be79df09a2a8d9b34995eb1c6900b419ae658621896d02970')-sha256sums_aarch64=('8c322ad7b96709d802326ed2d12057e553d8640c9f109cc75d6a44b30a5505f4')+sha256sums=('ed06edfbc6c406b57bb5209bd241516331a79e0d05fca3508aefa9b11eba04ab')+sha256sums_x86_64=('c6b4d54e7163f9063af1b74340b040afa424471ef6a9130c4f65bbd2fe30cc3d')+sha256sums_aarch64=('949f9196b9b8dd1a9f365e8e52843d2605edf7afadeb7e89149863f984916d90') package() { cd "${_pkgname}-${_commit}"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-29 11:52:15 | Low | 2 |
| 2026-10-29 00:13:55 | Clean | 2 |
| 2026-10-28 23:51:05 | Low | 1 |
| 2026-10-27 00:23:28 | Clean | 2 |
| 2026-10-26 21:45:59 | Low | 1 |