soundcloud-bin
MEDIUM
maintainer loli69
1 votes
scanned 2026-08-22 17:18:20.171967
Why flagged
The package downloads prebuilt .deb binaries from a GitHub release on a non-whitelisted host; while the checksums are verified, the binaries are unverifiable executables that could be malicious if the source were compromised.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a GitHub release on a non-whitelisted host; while the checksums are verified, the binaries are unverifiable executables that could be malicious if the source were compromised.
PKGBUILD
1
# Maintainer: zxcloli666 <156155219+zxcloli666@users.noreply.github.com>
2
3
# CI (aur-publish.yml) rewrites pkgver/pkgrel/sha256sums_* with ^-anchored sed:
4
# keep those four assignments one-line and at column 0.
5
pkgname=soundcloud-bin
6
pkgver=8.4.13
7
pkgrel=1
8
pkgdesc="🎵🎵🎵 THE BEST SOUNDCLOUD DESKTOP APP FOR WINDOWS, LINUX & MACOS | AI WAVE | NO ADS | NO CAPTCHA | NO RESTRICTIONS"
9
arch=('x86_64' 'aarch64')
10
url="https://github.com/zxcloli666/SoundCloud-Desktop"
11
license=('MIT')
12
depends=('gtk3' 'libappindicator' 'webkit2gtk-4.1')
13
provides=("soundcloud-desktop=${pkgver}")
14
conflicts=('soundcloud-desktop')
15
options=('!strip' '!debug')
16
17
_app='soundcloud-desktop'
18
19
source=("LICENSE::${url}/raw/${pkgver}/LICENSE"
20
"${_app}.desktop")
21
sha256sums=('3bed3331b7048bac17cf50e249d560ccc9508c970da8d7b9283bf4f2e633a91d'
22
'123e9a1e84eec9b29106ee83de9f5d24be17659468731babe22cf1faeb89bb3b')
23
24
source_x86_64=("soundcloud-${pkgver}-x86_64.deb::${url}/releases/download/${pkgver}/soundcloud-desktop_${pkgver}_amd64.deb")
25
sha256sums_x86_64=('331cb2553e295e0c19f7967cba689c8cebd266fce3bfbe3d31b8c50455aa6475')
26
27
source_aarch64=("soundcloud-${pkgver}-aarch64.deb::${url}/releases/download/${pkgver}/soundcloud-desktop_${pkgver}_arm64.deb")
28
sha256sums_aarch64=('4f038e22daf8fdd7d35783a6199844e4105e7231d2151670a850c8d79c4f4999')
29
30
noextract=("soundcloud-${pkgver}-x86_64.deb"
31
"soundcloud-${pkgver}-aarch64.deb")
32
33
prepare() {
34
# makepkg only wipes $srcdir with -C, so drop the previous unpack ourselves.
35
rm -rf "$srcdir/usr" "$srcdir/control.tar.gz" "$srcdir/data.tar.gz" "$srcdir/debian-binary"
36
bsdtar -xOf "soundcloud-${pkgver}-${CARCH}.deb" 'data.tar*' | bsdtar -xf - -C "$srcdir"
37
}
38
39
package() {
40
install -Dm755 "$srcdir/usr/bin/${_app}" "$pkgdir/usr/bin/${_app}"
41
42
local _icon
43
while IFS= read -r -d '' _icon; do
44
install -Dm644 "$_icon" "$pkgdir/${_icon#"$srcdir"/}"
45
done < <(find "$srcdir/usr/share/icons" -type f -print0)
46
47
install -Dm644 "$srcdir/${_app}.desktop" "$pkgdir/usr/share/applications/${_app}.desktop"
48
install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
49
}
50
51
Changes since previous scan
--- PKGBUILD @ 2026-08-16 13:32+++ PKGBUILD @ 2026-08-22 17:18@@ -48,3 +48,4 @@ install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE" } +Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-22 17:18:20 | Medium | 2 |
| 2026-08-16 13:32:24 | Clean | 0 |
| 2026-08-15 23:31:34 | Clean | 0 |
| 2026-08-12 21:24:53 | Clean | 0 |
| 2026-08-12 15:24:23 | Clean | 0 |
| 2026-07-30 09:14:07 | Clean | 0 |
| 2026-07-28 23:39:52 | Clean | 0 |
| 2026-07-28 21:39:42 | Clean | 0 |
| 2026-07-26 11:32:17 | Clean | 0 |
| 2026-07-24 21:28:26 | Clean | 0 |
| 2026-06-25 16:23:07 | Clean | 0 |
| 2026-06-22 20:14:17 | Clean | 0 |
| 2026-06-19 22:34:54 | Clean | 0 |
| 2026-06-18 16:11:54 | Clean | 0 |