spotifast-git

LOW

maintainer crmne 0 votes scanned 2026-09-14 17:17:35.691721

View on AUR

Why flagged

The package builds from source hosted on the maintainer's GitHub, which is normal for AUR-git packages; the only concerns are low-vote count and unverifiable source due to skipped checksum, but no remote code execution or malicious behavior is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on the maintainer's GitHub, which is normal for AUR-git packages; the only concerns are low-vote count and unverifiable source due to skipped checksum, but no remote code execution or malicious behavior is present.

PKGBUILD

      1# Maintainer: Carmine Paolino <carmine@paolino.me>
    
      2pkgname=spotifast-git
    
      3pkgver=0.8.0.r3.16ee665
    
      4pkgrel=1
    
      5pkgdesc="Native Spotify client"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/crmne/spotifast"
    
      8license=('MIT')
    
      9install="${pkgname}.install"
    
      10depends=('dbus' 'alsa-lib' 'libpulse' 'libglvnd' 'libxkbcommon' 'wayland' 'libx11')
    
      11# MilkDrop builds libprojectM from source at compile time: cmake drives
    
      12# that build, and clang carries the libclang bindgen reads its headers
    
      13# with. Build with --no-default-features to leave the visualiser out.
    
      14makedepends=('git' 'cargo' 'cmake' 'clang')
    
      15optdepends=('libxkbcommon-x11: keyboard handling in X11 sessions'
    
      16            'pipewire-pulse: PipeWire as the PulseAudio server')
    
      17provides=("spotifast=$pkgver" "fastpotify=$pkgver" "fastpotify-git=$pkgver")
    
      18conflicts=('fastpotify' 'fastpotify-bin' 'fastpotify-git' 'spotifast' 'spotifast-bin')
    
      19replaces=('fastpotify-git')
    
      20# !lto because ring compiles its own C and Arch's default CFLAGS put LTO
    
      21# objects in the archive, which lld then cannot resolve: the link fails on
    
      22# undefined ring_core_* symbols. The stable package is prebuilt and never
    
      23# meets this.
    
      24options=('!debug' '!lto')
    
      25source=("${pkgname}::git+https://github.com/crmne/spotifast.git")
    
      26sha256sums=('SKIP')
    
      27
    
      28pkgver() {
    
      29  cd "${srcdir}/${pkgname}"
    
      30  # A pre-release tag (v0.4.0-rc1) keeps its suffix without the hyphen,
    
      31  # 0.4.0rc1, which pacman orders before 0.4.0; then the commits since the
    
      32  # tag and the hash, as before: 0.4.0rc1.r1.cb95384.
    
      33  git describe --long --tags --abbrev=7 |
    
      34    sed 's/^v//;s/-\(rc\|alpha\|beta\)\([0-9]*\)-/\1\2-/;s/-/.r/;s/-g/./'
    
      35}
    
      36
    
      37prepare() {
    
      38  cd "${srcdir}/${pkgname}"
    
      39  export RUSTUP_TOOLCHAIN=stable
    
      40  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      41}
    
      42
    
      43build() {
    
      44  cd "${srcdir}/${pkgname}"
    
      45  export RUSTUP_TOOLCHAIN=stable
    
      46  export CARGO_TARGET_DIR=target
    
      47  # Generated bindings inside glutin carry the path they were built at, which
    
      48  # ends up in the binary and makes makepkg warn about a reference to $srcdir.
    
      49  # Appended rather than assigned, so the distro's own flags survive.
    
      50  export RUSTFLAGS="${RUSTFLAGS:-} --remap-path-prefix=${srcdir}=/"
    
      51  cargo build --frozen --release
    
      52}
    
      53
    
      54check() {
    
      55  cd "${srcdir}/${pkgname}"
    
      56  export RUSTUP_TOOLCHAIN=stable
    
      57  # The demo feature carries the headless render test, which lays out every
    
      58  # page without a display and talks to nothing.
    
      59  cargo test --frozen --features demo
    
      60}
    
      61
    
      62package() {
    
      63  cd "${srcdir}/${pkgname}"
    
      64
    
      65  install -Dm755 "target/release/fastpotify" "${pkgdir}/usr/bin/fastpotify"
    
      66  ln -s fastpotify "${pkgdir}/usr/bin/spotifast"
    
      67  install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      68  install -Dm644 "README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      69  install -Dm644 "packaging/applications/fastpotify.desktop" \
    
      70    "${pkgdir}/usr/share/applications/fastpotify.desktop"
    
      71  install -Dm644 "packaging/icons/fastpotify.svg" \
    
      72    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/fastpotify.svg"
    
      73  install -Dm644 contrib/omarchy/spotifast.json.tpl "${pkgdir}/usr/share/spotifast/omarchy/spotifast.json.tpl"
    
      74  install -Dm755 contrib/omarchy/spotifast-theme "${pkgdir}/usr/share/spotifast/omarchy/spotifast-theme"
    
      75}
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-14 17:17:35	Low	2