soundshed-guitar-bin

maintainer awahab · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt executable from a non-standard host (downloads.soundshed.com) with no public version control or build transparency, posing a supply-chain risk if the host is compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "https://downloads.soundshed.com/downloads/SoundshedGuitar-${pkgver}-Linux-x64.zip"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt executable from a non-standard host (downloads.soundshed.com) with no public version control or build transparency, posing a supply-chain risk if the host is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Adam Wahab <awahab@adhoc.tools>
    
      2_name=soundshed-guitar
    
      3pkgname=${_name,,}-bin
    
      4pkgver=1.5.0
    
      5pkgrel=0
    
      6pkgdesc="A guitar/bass effects app and plugin."
    
      7arch=(x86_64)
    
      8url="https://guitar.soundshed.com"
    
      9license=(AGPL-3.0)
    
      10depends=(webkit2gtk-4.1)
    
      11makedepends=('unzip')
    
      12options=()
    
      13provides=("${_name}")
    
      14conflicts=("${_name}")
    
      15source=(
    
      16"https://downloads.soundshed.com/downloads/SoundshedGuitar-${pkgver}-Linux-x64.zip"
    
      17"$_name.desktop"
    
      18)
    
      19sha256sums=('3beb782a8df8925b42bfcc17f40513348ae6610061c98fadf7e0d3959475f8fa'
    
      20            '841f9d304c6bce88380d30c86c8badc89c985548d9b5ad31e0c6c19cb7ca26a9')
    
      21
    
      22package() {
    
      23  rm SoundshedGuitar-${pkgver}-Linux-x64.zip
    
      24  cp -a $srcdir/{opt,usr} $pkgdir/
    
      25  install -Dm644 $srcdir/${_name}.desktop -t "$pkgdir/usr/share/applications"
    
      26}
    
      27

Changes since previous scan

--- PKGBUILD @ 2026-07-27 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,8 +1,8 @@
 # Maintainer: Adam Wahab <awahab@adhoc.tools>
 _name=soundshed-guitar
 pkgname=${_name,,}-bin
-pkgver=1.4.0
-pkgrel=2
+pkgver=1.5.0
+pkgrel=0
 pkgdesc="A guitar/bass effects app and plugin."
 arch=(x86_64)
 url="https://guitar.soundshed.com"
@@ -16,7 +16,7 @@
 "https://downloads.soundshed.com/downloads/SoundshedGuitar-${pkgver}-Linux-x64.zip"
 "$_name.desktop"
 )
-sha256sums=('5359afc2c1201fc351c8a61c2eba549f661f4c4e3402a11f7365e4266c11af2d'
+sha256sums=('3beb782a8df8925b42bfcc17f40513348ae6610061c98fadf7e0d3959475f8fa'
             '841f9d304c6bce88380d30c86c8badc89c985548d9b5ad31e0c6c19cb7ca26a9')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 23:36:42	MEDIUM	3
2026-07-27 00:24:32	LOW	3
2026-07-26 19:33:02	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 21:22:00	MEDIUM	3
2026-07-22 19:23:29	MEDIUM	3
2026-07-22 19:21:42	MEDIUM	3