spotify

maintainer gromit · 272 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads a Debian binary from Spotify's official repository, which is standard practice for distributing Spotify on Linux; the non-whitelisted host is Spotify's own domain, and the download is verified via GPG-signed Release files and checksums, making it a legitimate source despite the static analyzer flag.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a Debian binary from Spotify's official repository, which is standard practice for distributing Spotify on Linux; the non-whitelisted host is Spotify's own domain, and the download is verified via GPG-signed Release files and checksums, making it a legitimate source despite the static analyzer flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 source=("${pkgname}-${pkgver}-${_commit}-x86_64.deb::http://repository.spotify.com/pool/non-free/s/spotify-client/spotify-client_${pkgver}.${_commit}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christian Heusel <christian@heusel.eu>
    
      2# Maintainer: Robin Candau <antiz@archlinux.org>
    
      3# Contributor: NicoHood <archlinux {cat} nicohood {dog} de>
    
      4# Contributor: TobFromme < TobFromme {hat} pm {dont} me >
    
      5# Contributor: Ashley Whetter <(firstname) @ awhetter.co.uk>
    
      6# Contributor: Eothred <yngve.levinsen@gmail.com>
    
      7
    
      8pkgname=spotify
    
      9pkgver='1.2.95.453'
    
      10epoch=1
    
      11_commit=g0eeebbed
    
      12pkgrel=1
    
      13pkgdesc='A proprietary music streaming service'
    
      14arch=('x86_64')
    
      15license=('custom')
    
      16url='https://www.spotify.com'
    
      17depends=('alsa-lib>=1.0.14' 'gtk3' 'libxss' 'desktop-file-utils' 'openssl' 'nss' 'at-spi2-atk' 'libcurl-gnutls' 'libsm' 'libayatana-appindicator')
    
      18optdepends=('ffmpeg4.4: Adds support for playback of local files'
    
      19            'zenity: Adds support for importing local files'
    
      20            'libnotify: Desktop notifications')
    
      21options=('!strip')
    
      22
    
      23# NOTE: We switched from stable to testing on 18th march, as the spotify
    
      24# stable repository is always outdated. Testing seems to be in sync with snap:
    
      25# https://snapcraft.io/spotify
    
      26# http://repository.spotify.com/dists/testing/Release
    
      27# http://repository.spotify.com/dists/testing/non-free/binary-amd64/Packages
    
      28# http://repository.spotify.com/dists/testing/Release.gpg
    
      29source=("${pkgname}-${pkgver}-${_commit}-x86_64.deb::http://repository.spotify.com/pool/non-free/s/spotify-client/spotify-client_${pkgver}.${_commit}_amd64.deb"
    
      30        "spotify.sh"
    
      31        "spotify.protocol"
    
      32        "LICENSE"
    
      33        # GPG signature check
    
      34        "${pkgname}-${pkgver}-${pkgrel}-Release::http://repository.spotify.com/dists/testing/Release"
    
      35        "${pkgname}-${pkgver}-${pkgrel}-Release.sig::http://repository.spotify.com/dists/testing/Release.gpg"
    
      36        "${pkgname}-${pkgver}-${pkgrel}-x86_64-Packages::http://repository.spotify.com/dists/testing/non-free/binary-amd64/Packages")
    
      37sha512sums=('902d9b8200d67e10a19ce5e34316ea14ed05e935fe5493c21f7a8db31b2ffc91375dd18a68734e781b815d57ac9e3aff36da79bce9ff6882a1f247542caab451'
    
      38            'da48b628a4ea925dd8521133ebf364b261b11aed252d264dde6605d915cdb631919ffe672c58534bcdb60869e5d87a49a60a8198780b99517123f0031e83fdb1'
    
      39            '999abe46766a4101e27477f5c9f69394a4bb5c097e2e048ec2c6cb93dfa1743eb436bde3768af6ba1b90eaac78ea8589d82e621f9cbe7d9ab3f41acee6e8ca20'
    
      40            '2e16f7c7b09e9ecefaa11ab38eb7a792c62ae6f33d95ab1ff46d68995316324d8c5287b0d9ce142d1cf15158e61f594e930260abb8155467af8bc25779960615'
    
      41            'b1a317c49c32ca63be65a85a92f486ecbb39ffc402c8c459f6c6542261584f740da318d1311fb71832e68a56754d547805de0cffb19dde6a79c4a14c1914aee6'
    
      42            'SKIP'
    
      43            'bd52856fb7531af4f7782fdd3b1d047e99dc00b02223035022f70112d2ecf9c80d7c2bf816eb78aeced8de577a9975fab5042c8e8ce4ca689ce3dbc46a9e4703')
    
      44
    
      45# Import key with:
    
      46# curl -sS https://download.spotify.com/debian/pubkey_5384CE82BA52C83A.gpg | gpg --import -
    
      47validpgpkeys=('E1096BCBFF6D418796DE78515384CE82BA52C83A') # Spotify Public Repository Signing Key <tux@spotify.com>
    
      48# Old Keys:
    
      49# 63CBEEC9006602088F9B19326224F9941A8AA6D1
    
      50# E27409F51D1B66337F2D2F417A3A762FAFD4A51F
    
      51# F9A211976ED662F00E59361E5E3C45D7B312C643
    
      52# 8FD3D9A8D3800305A9FFF259D1742AD60D811D58
    
      53# 931FF8E79F0876134EDDBDCCA87FF9DF48BF1C90
    
      54# 2EBF997C15BDA244B6EBF5D84773BD5E130D1D45
    
      55# B420FD3777CCE3A7F0076B55C85668DF69375001
    
      56
    
      57# Skip "Release" and "Packages" files hashes as they are unstable
    
      58# Since "updpkgsums"/"pkgctl version upgrade" overwrite the checksum array with
    
      59# literal hashes, set them to SKIP with indexed assignments (pacman-contrib#119)
    
      60# https://gitlab.archlinux.org/pacman/pacman-contrib/-/issues/119
    
      61sha512sums[4]='SKIP'
    
      62sha512sums[6]='SKIP'
    
      63
    
      64prepare() {
    
      65    # Validate hashes from the PGP signed "Release" file
    
      66    echo "$(grep non-free/binary-amd64/Packages ${pkgname}-${pkgver}-${pkgrel}-Release | tail -n 2 | head -n 1 | awk '{print $1}') ${pkgname}-${pkgver}-${pkgrel}-x86_64-Packages" \
    
      67        > "${pkgname}-${pkgver}-x86_64-Packages.sha256"
    
      68    sha256sum -c "${pkgname}-${pkgver}-x86_64-Packages.sha256"
    
      69
    
      70    echo "$(grep SHA512 ${pkgname}-${pkgver}-${pkgrel}-x86_64-Packages | head -n 1 | awk '{print $2}') ${pkgname}-${pkgver}-${_commit}-x86_64.deb" \
    
      71        > "${pkgname}-${pkgver}-x86_64.deb.sha512"
    
      72    sha512sum -c "${pkgname}-${pkgver}-x86_64.deb.sha512"
    
      73}
    
      74
    
      75package() {
    
      76    tar -xzf data.tar.gz --no-same-owner -C "${pkgdir}"
    
      77
    
      78    # Enable spotify to open URLs from the webapp
    
      79    sed -i 's/^Exec=.*/Exec=spotify --uri=%u/' "${pkgdir}/usr/share/spotify/spotify.desktop"
    
      80
    
      81    install -Dm 644 "${pkgdir}/usr/share/spotify/spotify.desktop" "${pkgdir}/usr/share/applications/spotify.desktop"
    
      82    install -Dm 644 "${pkgdir}/usr/share/spotify/icons/spotify-linux-512.png" "${pkgdir}/usr/share/pixmaps/spotify-client.png"
    
      83
    
      84    for size in 22 24 32 48 64 128 256 512; do
    
      85        install -Dm 644 "${pkgdir}/usr/share/spotify/icons/spotify-linux-${size}.png" \
    
      86            "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/spotify.png"
    
      87    done
    
      88
    
      89    # Move spotify binary to its proper location
    
      90    mkdir -p "${pkgdir}/opt/spotify"
    
      91    mv "${pkgdir}/usr/share/spotify" "${pkgdir}/opt/"
    
      92
    
      93    # Copy launch script which allows the use of custom flags
    
      94    install -Dm 755 spotify.sh "${pkgdir}/usr/bin/spotify"
    
      95
    
      96    # Copy protocol file for KDE
    
      97    install -Dm 644 spotify.protocol "${pkgdir}/usr/share/kservices5/spotify.protocol"
    
      98
    
      99    # Install license
    
      100    # https://www.spotify.com/legal/end-user-agreement
    
      101    install -Dm 644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      102
    
      103    # Fix permissions
    
      104    chmod -R go-w "${pkgdir}"
    
      105}
    
      106

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-18 00:03
@@ -6,9 +6,9 @@
 # Contributor: Eothred <yngve.levinsen@gmail.com>
 
 pkgname=spotify
-pkgver='1.2.92.147'
+pkgver='1.2.95.453'
 epoch=1
-_commit=g5b8f9367
+_commit=g0eeebbed
 pkgrel=1
 pkgdesc='A proprietary music streaming service'
 arch=('x86_64')
@@ -34,13 +34,13 @@
         "${pkgname}-${pkgver}-${pkgrel}-Release::http://repository.spotify.com/dists/testing/Release"
         "${pkgname}-${pkgver}-${pkgrel}-Release.sig::http://repository.spotify.com/dists/testing/Release.gpg"
         "${pkgname}-${pkgver}-${pkgrel}-x86_64-Packages::http://repository.spotify.com/dists/testing/non-free/binary-amd64/Packages")
-sha512sums=('e84afeaa3c011c7e06cffa31d0a0113f8851bad57fc26317c2eef74b89985848bdd25b72e4f9a9e55948b8b927f3205a8b9c1047e2f28eec500ac7a2d4913cad'
+sha512sums=('902d9b8200d67e10a19ce5e34316ea14ed05e935fe5493c21f7a8db31b2ffc91375dd18a68734e781b815d57ac9e3aff36da79bce9ff6882a1f247542caab451'
             'da48b628a4ea925dd8521133ebf364b261b11aed252d264dde6605d915cdb631919ffe672c58534bcdb60869e5d87a49a60a8198780b99517123f0031e83fdb1'
             '999abe46766a4101e27477f5c9f69394a4bb5c097e2e048ec2c6cb93dfa1743eb436bde3768af6ba1b90eaac78ea8589d82e621f9cbe7d9ab3f41acee6e8ca20'
             '2e16f7c7b09e9ecefaa11ab38eb7a792c62ae6f33d95ab1ff46d68995316324d8c5287b0d9ce142d1cf15158e61f594e930260abb8155467af8bc25779960615'
-            'a193289e2e86a945cd3d7a104e0d96d8669aed55a0099719c7bdf2b53c7367206fa563582fcadb7ba043469076f6064b9845a7b47af717dff70f4b83ff40cd84'
+            'b1a317c49c32ca63be65a85a92f486ecbb39ffc402c8c459f6c6542261584f740da318d1311fb71832e68a56754d547805de0cffb19dde6a79c4a14c1914aee6'
             'SKIP'
-            '362ab4123305bedd16cbefab66adc7968da8d8ebf4431f6646605786aa723622149c2c2d5ab9208347013fe9e6affb570bf9a68bc1fc2c9d70d75dbc9b5672c0')
+            'bd52856fb7531af4f7782fdd3b1d047e99dc00b02223035022f70112d2ecf9c80d7c2bf816eb78aeced8de577a9975fab5042c8e8ce4ca689ce3dbc46a9e4703')
 
 # Import key with:
 # curl -sS https://download.spotify.com/debian/pubkey_5384CE82BA52C83A.gpg | gpg --import -

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 13:36:23	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 21:21:47	LOW	2
2026-06-19 19:07:35	CLEAN	2
2026-06-18 18:04:49	CLEAN	2
2026-06-18 16:11:54	LOW	1