spotifast

LOW

maintainer crmne 0 votes scanned 2026-09-14 17:17:35.691721

View on AUR

Why flagged

The package builds from a source tarball hosted on the project's own GitHub releases, which is a normal and expected practice for AUR packages; the flagged low votes and recent upload are metadata concerns, not security issues.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a source tarball hosted on the project's own GitHub releases, which is a normal and expected practice for AUR packages; the flagged low votes and recent upload are metadata concerns, not security issues.

PKGBUILD

      1# Maintainer: Carmine Paolino <carmine@paolino.me>
    
      2pkgname=spotifast
    
      3pkgver=0.8.0
    
      4pkgrel=1
    
      5pkgdesc="Native Spotify client"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/crmne/spotifast"
    
      8license=('MIT')
    
      9install="${pkgname}.install"
    
      10depends=('dbus' 'alsa-lib' 'libpulse' 'libglvnd' 'libxkbcommon' 'wayland' 'libx11')
    
      11makedepends=('cargo' 'cmake' 'clang')
    
      12optdepends=('libxkbcommon-x11: keyboard handling in X11 sessions'
    
      13            'pipewire-pulse: PipeWire as the PulseAudio server')
    
      14provides=("fastpotify=$pkgver")
    
      15conflicts=('fastpotify' 'fastpotify-bin' 'fastpotify-git' 'spotifast-bin' 'spotifast-git')
    
      16replaces=('fastpotify')
    
      17# !lto because ring compiles its own C and Arch's default CFLAGS put LTO
    
      18# objects in the archive, which lld then cannot resolve: the link fails on
    
      19# undefined ring_core_* symbols.
    
      20options=('!debug' '!lto')
    
      21source=("${pkgname}-${pkgver}.tar.gz::${url}/releases/download/v${pkgver}/spotifast-v${pkgver}-source.tar.gz")
    
      22sha256sums=('60c384ab6aff397b08653572fac6b31c2372b30f32c7dfbd6b3624d67a00b7b1')
    
      23
    
      24# GitHub archives use the repository name; older releases used Fastpotify.
    
      25_source_dir() {
    
      26  if [[ -d "${srcdir}/spotifast-${pkgver}" ]]; then
    
      27    printf '%s\n' "${srcdir}/spotifast-${pkgver}"
    
      28  else
    
      29    printf '%s\n' "${srcdir}/fastpotify-${pkgver}"
    
      30  fi
    
      31}
    
      32
    
      33prepare() {
    
      34  cd "$(_source_dir)"
    
      35  export RUSTUP_TOOLCHAIN=stable
    
      36  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      37}
    
      38
    
      39build() {
    
      40  cd "$(_source_dir)"
    
      41  export RUSTUP_TOOLCHAIN=stable
    
      42  export CARGO_TARGET_DIR=target
    
      43  # Generated bindings inside glutin carry the path they were built at, which
    
      44  # ends up in the binary and makes makepkg warn about a reference to $srcdir.
    
      45  # Appended rather than assigned, so the distro's own flags survive.
    
      46  export RUSTFLAGS="${RUSTFLAGS:-} --remap-path-prefix=${srcdir}=/"
    
      47  cargo build --frozen --release
    
      48}
    
      49
    
      50check() {
    
      51  cd "$(_source_dir)"
    
      52  export RUSTUP_TOOLCHAIN=stable
    
      53  # The demo feature carries the headless render test, which lays out every
    
      54  # page without a display and talks to nothing.
    
      55  cargo test --frozen --features demo
    
      56}
    
      57
    
      58package() {
    
      59  cd "$(_source_dir)"
    
      60
    
      61  install -Dm755 "target/release/fastpotify" "${pkgdir}/usr/bin/fastpotify"
    
      62  ln -s fastpotify "${pkgdir}/usr/bin/spotifast"
    
      63  install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      64  install -Dm644 "README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      65  install -Dm644 "packaging/applications/fastpotify.desktop" \
    
      66    "${pkgdir}/usr/share/applications/fastpotify.desktop"
    
      67  install -Dm644 "packaging/icons/fastpotify.svg" \
    
      68    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/fastpotify.svg"
    
      69  # Older release fixtures predate the optional integration.
    
      70  if [[ -d contrib/omarchy ]]; then
    
      71    install -Dm644 contrib/omarchy/spotifast.json.tpl "${pkgdir}/usr/share/spotifast/omarchy/spotifast.json.tpl"
    
      72    install -Dm755 contrib/omarchy/spotifast-theme "${pkgdir}/usr/share/spotifast/omarchy/spotifast-theme"
    
      73  fi
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-14 17:17:35	Low	2