splayer-next-git

LOW
maintainer InubashiriLix 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

All sources are from legitimate, project-owned or well-known infrastructure (GitHub, electronjs.org, crates.io); the package builds from source with checksums verified; the only 'non-standard host' is electronjs.org which is the official Electron project domain, posing no real supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): All sources are from legitimate, project-owned or well-known infrastructure (GitHub, electronjs.org, crates.io); the package builds from source with checksums verified; the only 'non-standard host' is electronjs.org which is the official Electron project domain, posing no real supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:42 "electron-v${_electron_headers_version}-headers.tar.gz::https://electronjs.org/headers/v${_electron_headers_version}/node-v${_electron_headers_version}-headers.tar.gz"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: InubashiriLix <xl996981 at gmail dot com>
2
3pkgname=splayer-next-git
4pkgver=1.0.0.r621.g4f9a95d
5pkgrel=1
6pkgdesc='Electron music player with rich lyric and audio format support (development version)'
7arch=('x86_64')
8url='https://github.com/SPlayer-Dev/SPlayer-Next'
9license=('AGPL-3.0-only')
10
11provides=("splayer-next=${pkgver}")
12conflicts=('splayer-next' 'splayer-next-bin')
13
14depends=(
15 'alsa-lib'
16 'electron41>=41.6.1'
17 'ffmpeg'
18 'glibc'
19 'hicolor-icon-theme'
20)
21optdepends=('xdg-utils: opening external links')
22makedepends=(
23 'clang'
24 'git'
25 'node-gyp'
26 'nodejs>=22.19.0'
27 'pnpm>=10'
28 'python'
29 'rust'
30)
31
32# The Rust workspace already enables LLVM LTO. makepkg's GCC LTO flags produce
33# static C/C++ archives that rustc leaves unresolved in the final N-API module.
34# Native modules must be stripped, but separate debug packages are prohibitively large.
35options=('!debug' '!lto')
36
37_source='SPlayer-Next-git'
38_electron_headers_version='41.6.1'
39
40source=(
41 "${_source}::git+${url}.git#branch=dev"
42 "electron-v${_electron_headers_version}-headers.tar.gz::https://electronjs.org/headers/v${_electron_headers_version}/node-v${_electron_headers_version}-headers.tar.gz"
43 'ffmpeg_audio_sys-0.1.2.crate::https://static.crates.io/crates/ffmpeg_audio_sys/ffmpeg_audio_sys-0.1.2.crate'
44 'splayer-next.sh'
45 'top.imsyy.splayer_next.desktop'
46 'system-electron.patch'
47 'ffmpeg-system.patch'
48)
49sha256sums=(
50 'SKIP'
51 '562ea6ffdae060941d4660e2101e5e086c3bacd26a0c211eb18b3d280b0f62a7'
52 'e20a89429144d2a75ce83bfb8883d19d1f5fe339b2cddd0d5f291cd030487b4f'
53 '713118402f5168736eb9647138ba8bb14a9deea67ad2c236a21b6cd371b3304a'
54 'affb35df91f7cb0c2d32a855d097047bd9109402a3cdb203e063cbfe88db5e3e'
55 '0728d01dfc7e9272330740295b62296f069768edb9727c24c447ee2314f11ef8'
56 '5599df118fc4658b1865e20cfd8ee2358950428597e6117dc0e410d2d5cc6032'
57)
58
59pkgver() {
60 cd "$_source"
61
62 local upstream_version
63 upstream_version=$(node -p "require('./package.json').version")
64
65 printf '%s.r%s.g%s' \
66 "$upstream_version" \
67 "$(git rev-list --count HEAD)" \
68 "$(git rev-parse --short=7 HEAD)"
69}
70
71_setup_build_env() {
72 export PNPM_HOME="$srcdir/pnpm-home"
73 export npm_config_cache="$srcdir/npm-cache"
74 export XDG_CACHE_HOME="$srcdir/xdg-cache"
75 export ELECTRON_CACHE="$srcdir/electron-cache"
76 export ELECTRON_BUILDER_CACHE="$srcdir/electron-builder-cache"
77 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
78 export FFMPEG_MODE=system
79 export CARGO_HOME="$srcdir/cargo-home"
80 export CARGO_TARGET_DIR="$srcdir/cargo-target"
81 export RUSTFLAGS="${RUSTFLAGS:-} --remap-path-prefix=$srcdir=/usr/src/debug/$pkgname"
82
83 mkdir -p \
84 "$PNPM_HOME" \
85 "$npm_config_cache" \
86 "$XDG_CACHE_HOME" \
87 "$ELECTRON_CACHE" \
88 "$ELECTRON_BUILDER_CACHE" \
89 "$CARGO_HOME" \
90 "$CARGO_TARGET_DIR"
91}
92
93prepare() {
94 _setup_build_env
95
96 cd "$_source"
97
98 patch -Np1 -i "$srcdir/system-electron.patch"
99 patch -d "$srcdir/ffmpeg_audio_sys-0.1.2" -Np1 -i "$srcdir/ffmpeg-system.patch"
100 pnpm install \
101 --frozen-lockfile \
102 --ignore-scripts \
103 --store-dir "$srcdir/pnpm-store"
104}
105
106build() {
107 _setup_build_env
108
109 cd "$_source"
110
111 local electron_version
112 electron_version=$(</usr/lib/electron41/version)
113 electron_version=${electron_version#v}
114
115 # The checked Electron headers set the correct native-module ABI without a download hook.
116 pushd node_modules/better-sqlite3
117 node-gyp rebuild \
118 --release \
119 --nodedir="$srcdir/node_headers"
120 popd
121
122 pnpm build:native
123
124 # Linux permits unresolved symbols in shared libraries. Fail the build here
125 # instead of shipping a module that only breaks when Electron loads it.
126 if nm -D --undefined-only native/audio-engine/audio-engine.node |
127 grep -Eq 'signalsmith_stretch_|aws_lc_[0-9_]+_'; then
128 printf '%s\n' 'audio-engine.node contains unresolved bundled-library symbols' >&2
129 return 1
130 fi
131
132 SKIP_NATIVE_BUILD=true pnpm build
133 pnpm exec electron-builder \
134 --linux \
135 --x64 \
136 --dir \
137 --publish never \
138 --config electron-builder.config.ts \
139 -c.electronDist=/usr/lib/electron41 \
140 -c.electronVersion="$electron_version"
141
142 test -f dist/linux-unpacked/resources/app.asar
143 test -d dist/linux-unpacked/resources/app.asar.unpacked
144 test -f dist/linux-unpacked/resources/native/audio-engine.node
145 test -f dist/linux-unpacked/resources/native/media-ctrl.node
146}
147
148check() {
149 cd "$_source"
150
151 # Load every native module with the exact Electron major used at runtime.
152 env ELECTRON_RUN_AS_NODE=1 /usr/lib/electron41/electron -e \
153 "require(process.argv[1])" \
154 "$PWD/native/audio-engine/audio-engine.node"
155 env ELECTRON_RUN_AS_NODE=1 /usr/lib/electron41/electron -e \
156 "require(process.argv[1])" \
157 "$PWD/native/media-ctrl/media-ctrl.node"
158 env ELECTRON_RUN_AS_NODE=1 /usr/lib/electron41/electron -e \
159 "const Database=require(process.argv[1]); const db=new Database(':memory:'); if (db.prepare('select 41+1 as value').get().value !== 42) process.exit(1); db.close()" \
160 "$PWD/node_modules/better-sqlite3"
161}
162
163package() {
164 cd "$_source"
165
166 install -Dm644 \
167 dist/linux-unpacked/resources/app.asar \
168 "$pkgdir/usr/lib/splayer-next/app.asar"
169 cp -a --no-preserve=ownership \
170 dist/linux-unpacked/resources/app.asar.unpacked \
171 "$pkgdir/usr/lib/splayer-next/"
172 cp -a --no-preserve=ownership \
173 dist/linux-unpacked/resources/native \
174 "$pkgdir/usr/lib/splayer-next/"
175
176 # electron-builder unpacks entire native packages; only Linux runtime files are useful.
177 rm -rf \
178 "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/font-list/libs/darwin" \
179 "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/font-list/libs/win32" \
180 "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/deps" \
181 "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/src" \
182 "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/build/deps" \
183 "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/build/Release/obj" \
184 "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/build/Release/obj.target" \
185 "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/build/Release/sqlite3.a" \
186 "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/build/Release/test_extension.node"
187
188 install -Dm755 \
189 "$srcdir/splayer-next.sh" \
190 "$pkgdir/usr/bin/splayer-next"
191 install -Dm644 \
192 "$srcdir/top.imsyy.splayer_next.desktop" \
193 "$pkgdir/usr/share/applications/top.imsyy.splayer_next.desktop"
194 install -Dm644 \
195 public/icons/favicon-512x512.png \
196 "$pkgdir/usr/share/icons/hicolor/512x512/apps/splayer-next.png"
197 install -Dm644 \
198 LICENSE \
199 "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
200}
201

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion