splayer-next-git

maintainer InubashiriLix · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged All sources are from legitimate, project-owned or well-known infrastructure (GitHub, electronjs.org, crates.io); the package builds from source with checksums verified; the only 'non-standard host' is electronjs.org which is the official Electron project domain, posing no real supply-chain risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): All sources are from legitimate, project-owned or well-known infrastructure (GitHub, electronjs.org, crates.io); the package builds from source with checksums verified; the only 'non-standard host' is electronjs.org which is the official Electron project domain, posing no real supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:42 "electron-v${_electron_headers_version}-headers.tar.gz::https://electronjs.org/headers/v${_electron_headers_version}/node-v${_electron_headers_version}-headers.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: InubashiriLix <xl996981 at gmail dot com>
    
      2
    
      3pkgname=splayer-next-git
    
      4pkgver=1.0.0.r621.g4f9a95d
    
      5pkgrel=1
    
      6pkgdesc='Electron music player with rich lyric and audio format support (development version)'
    
      7arch=('x86_64')
    
      8url='https://github.com/SPlayer-Dev/SPlayer-Next'
    
      9license=('AGPL-3.0-only')
    
      10
    
      11provides=("splayer-next=${pkgver}")
    
      12conflicts=('splayer-next' 'splayer-next-bin')
    
      13
    
      14depends=(
    
      15    'alsa-lib'
    
      16    'electron41>=41.6.1'
    
      17    'ffmpeg'
    
      18    'glibc'
    
      19    'hicolor-icon-theme'
    
      20)
    
      21optdepends=('xdg-utils: opening external links')
    
      22makedepends=(
    
      23    'clang'
    
      24    'git'
    
      25    'node-gyp'
    
      26    'nodejs>=22.19.0'
    
      27    'pnpm>=10'
    
      28    'python'
    
      29    'rust'
    
      30)
    
      31
    
      32# The Rust workspace already enables LLVM LTO.  makepkg's GCC LTO flags produce
    
      33# static C/C++ archives that rustc leaves unresolved in the final N-API module.
    
      34# Native modules must be stripped, but separate debug packages are prohibitively large.
    
      35options=('!debug' '!lto')
    
      36
    
      37_source='SPlayer-Next-git'
    
      38_electron_headers_version='41.6.1'
    
      39
    
      40source=(
    
      41    "${_source}::git+${url}.git#branch=dev"
    
      42    "electron-v${_electron_headers_version}-headers.tar.gz::https://electronjs.org/headers/v${_electron_headers_version}/node-v${_electron_headers_version}-headers.tar.gz"
    
      43    'ffmpeg_audio_sys-0.1.2.crate::https://static.crates.io/crates/ffmpeg_audio_sys/ffmpeg_audio_sys-0.1.2.crate'
    
      44    'splayer-next.sh'
    
      45    'top.imsyy.splayer_next.desktop'
    
      46    'system-electron.patch'
    
      47    'ffmpeg-system.patch'
    
      48)
    
      49sha256sums=(
    
      50    'SKIP'
    
      51    '562ea6ffdae060941d4660e2101e5e086c3bacd26a0c211eb18b3d280b0f62a7'
    
      52    'e20a89429144d2a75ce83bfb8883d19d1f5fe339b2cddd0d5f291cd030487b4f'
    
      53    '713118402f5168736eb9647138ba8bb14a9deea67ad2c236a21b6cd371b3304a'
    
      54    'affb35df91f7cb0c2d32a855d097047bd9109402a3cdb203e063cbfe88db5e3e'
    
      55    '0728d01dfc7e9272330740295b62296f069768edb9727c24c447ee2314f11ef8'
    
      56    '5599df118fc4658b1865e20cfd8ee2358950428597e6117dc0e410d2d5cc6032'
    
      57)
    
      58
    
      59pkgver() {
    
      60    cd "$_source"
    
      61
    
      62    local upstream_version
    
      63    upstream_version=$(node -p "require('./package.json').version")
    
      64
    
      65    printf '%s.r%s.g%s' \
    
      66        "$upstream_version" \
    
      67        "$(git rev-list --count HEAD)" \
    
      68        "$(git rev-parse --short=7 HEAD)"
    
      69}
    
      70
    
      71_setup_build_env() {
    
      72    export PNPM_HOME="$srcdir/pnpm-home"
    
      73    export npm_config_cache="$srcdir/npm-cache"
    
      74    export XDG_CACHE_HOME="$srcdir/xdg-cache"
    
      75    export ELECTRON_CACHE="$srcdir/electron-cache"
    
      76    export ELECTRON_BUILDER_CACHE="$srcdir/electron-builder-cache"
    
      77    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      78    export FFMPEG_MODE=system
    
      79    export CARGO_HOME="$srcdir/cargo-home"
    
      80    export CARGO_TARGET_DIR="$srcdir/cargo-target"
    
      81    export RUSTFLAGS="${RUSTFLAGS:-} --remap-path-prefix=$srcdir=/usr/src/debug/$pkgname"
    
      82
    
      83    mkdir -p \
    
      84        "$PNPM_HOME" \
    
      85        "$npm_config_cache" \
    
      86        "$XDG_CACHE_HOME" \
    
      87        "$ELECTRON_CACHE" \
    
      88        "$ELECTRON_BUILDER_CACHE" \
    
      89        "$CARGO_HOME" \
    
      90        "$CARGO_TARGET_DIR"
    
      91}
    
      92
    
      93prepare() {
    
      94    _setup_build_env
    
      95
    
      96    cd "$_source"
    
      97
    
      98    patch -Np1 -i "$srcdir/system-electron.patch"
    
      99    patch -d "$srcdir/ffmpeg_audio_sys-0.1.2" -Np1 -i "$srcdir/ffmpeg-system.patch"
    
      100    pnpm install \
    
      101        --frozen-lockfile \
    
      102        --ignore-scripts \
    
      103        --store-dir "$srcdir/pnpm-store"
    
      104}
    
      105
    
      106build() {
    
      107    _setup_build_env
    
      108
    
      109    cd "$_source"
    
      110
    
      111    local electron_version
    
      112    electron_version=$(</usr/lib/electron41/version)
    
      113    electron_version=${electron_version#v}
    
      114
    
      115    # The checked Electron headers set the correct native-module ABI without a download hook.
    
      116    pushd node_modules/better-sqlite3
    
      117    node-gyp rebuild \
    
      118        --release \
    
      119        --nodedir="$srcdir/node_headers"
    
      120    popd
    
      121
    
      122    pnpm build:native
    
      123
    
      124    # Linux permits unresolved symbols in shared libraries.  Fail the build here
    
      125    # instead of shipping a module that only breaks when Electron loads it.
    
      126    if nm -D --undefined-only native/audio-engine/audio-engine.node |
    
      127        grep -Eq 'signalsmith_stretch_|aws_lc_[0-9_]+_'; then
    
      128        printf '%s\n' 'audio-engine.node contains unresolved bundled-library symbols' >&2
    
      129        return 1
    
      130    fi
    
      131
    
      132    SKIP_NATIVE_BUILD=true pnpm build
    
      133    pnpm exec electron-builder \
    
      134        --linux \
    
      135        --x64 \
    
      136        --dir \
    
      137        --publish never \
    
      138        --config electron-builder.config.ts \
    
      139        -c.electronDist=/usr/lib/electron41 \
    
      140        -c.electronVersion="$electron_version"
    
      141
    
      142    test -f dist/linux-unpacked/resources/app.asar
    
      143    test -d dist/linux-unpacked/resources/app.asar.unpacked
    
      144    test -f dist/linux-unpacked/resources/native/audio-engine.node
    
      145    test -f dist/linux-unpacked/resources/native/media-ctrl.node
    
      146}
    
      147
    
      148check() {
    
      149    cd "$_source"
    
      150
    
      151    # Load every native module with the exact Electron major used at runtime.
    
      152    env ELECTRON_RUN_AS_NODE=1 /usr/lib/electron41/electron -e \
    
      153        "require(process.argv[1])" \
    
      154        "$PWD/native/audio-engine/audio-engine.node"
    
      155    env ELECTRON_RUN_AS_NODE=1 /usr/lib/electron41/electron -e \
    
      156        "require(process.argv[1])" \
    
      157        "$PWD/native/media-ctrl/media-ctrl.node"
    
      158    env ELECTRON_RUN_AS_NODE=1 /usr/lib/electron41/electron -e \
    
      159        "const Database=require(process.argv[1]); const db=new Database(':memory:'); if (db.prepare('select 41+1 as value').get().value !== 42) process.exit(1); db.close()" \
    
      160        "$PWD/node_modules/better-sqlite3"
    
      161}
    
      162
    
      163package() {
    
      164    cd "$_source"
    
      165
    
      166    install -Dm644 \
    
      167        dist/linux-unpacked/resources/app.asar \
    
      168        "$pkgdir/usr/lib/splayer-next/app.asar"
    
      169    cp -a --no-preserve=ownership \
    
      170        dist/linux-unpacked/resources/app.asar.unpacked \
    
      171        "$pkgdir/usr/lib/splayer-next/"
    
      172    cp -a --no-preserve=ownership \
    
      173        dist/linux-unpacked/resources/native \
    
      174        "$pkgdir/usr/lib/splayer-next/"
    
      175
    
      176    # electron-builder unpacks entire native packages; only Linux runtime files are useful.
    
      177    rm -rf \
    
      178        "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/font-list/libs/darwin" \
    
      179        "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/font-list/libs/win32" \
    
      180        "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/deps" \
    
      181        "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/src" \
    
      182        "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/build/deps" \
    
      183        "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/build/Release/obj" \
    
      184        "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/build/Release/obj.target" \
    
      185        "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/build/Release/sqlite3.a" \
    
      186        "$pkgdir/usr/lib/splayer-next/app.asar.unpacked/node_modules/better-sqlite3/build/Release/test_extension.node"
    
      187
    
      188    install -Dm755 \
    
      189        "$srcdir/splayer-next.sh" \
    
      190        "$pkgdir/usr/bin/splayer-next"
    
      191    install -Dm644 \
    
      192        "$srcdir/top.imsyy.splayer_next.desktop" \
    
      193        "$pkgdir/usr/share/applications/top.imsyy.splayer_next.desktop"
    
      194    install -Dm644 \
    
      195        public/icons/favicon-512x512.png \
    
      196        "$pkgdir/usr/share/icons/hicolor/512x512/apps/splayer-next.png"
    
      197    install -Dm644 \
    
      198        LICENSE \
    
      199        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      200}
    
      201

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 09:22:14	LOW	3
2026-07-22 09:20:02	MEDIUM	2