spotify-1.1

maintainer StarterX4 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The .deb is fetched from web.archive.org, which is an archived copy of the original Spotify repository URL (http://repository.spotify.com/pool/non-free/s/spotify-client/). The Wayback Machine preserves the exact bytes it crawled; it does not allow arbitrary substitution of content at a fixed timestamp URL (the 'if_' flag suppresses redirects and serves the raw archived content). Critically, the PKGBUILD includes a sha512sum for the .deb AND a validpgpkeys entry for Spotify's official signing key, meaning the downloaded binary must pass both hash verification and PGP signature validation before installation. This is actually a stronger integrity guarantee than many AUR packages that fetch from official mirrors without PGP verification. The use of web.archive.org is a legitimate and common practice for preserving access to packages removed from upstream repositories. The binary is Spotify's own proprietary client, not a third-party repackaging. The only real concern is that web.archive.org is not the canonical distribution channel, but the cryptographic controls (sha512 + PGP) mitigate supply-chain risk to a low level.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The .deb is fetched from web.archive.org, which is an archived copy of the original Spotify repository URL (http://repository.spotify.com/pool/non-free/s/spotify-client/). The Wayback Machine preserves the exact bytes it crawled; it does not allow arbitrary substitution of content at a fixed timestamp URL (the 'if_' flag suppresses redirects and serves the raw archived content). Critically, the PKGBUILD includes a sha512sum for the .deb AND a validpgpkeys entry for Spotify's official signing key, meaning the downloaded binary must pass both hash verification and PGP signature validation before installation. This is actually a stronger integrity guarantee than many AUR packages that fetch from official mirrors without PGP verification. The use of web.archive.org is a legitimate and common practice for preserving access to packages removed from upstream repositories. The binary is Spotify's own proprietary client, not a third-party repackaging. The only real concern is that web.archive.org is not the canonical distribution channel, but the cryptographic controls (sha512 + PGP) mitigate supply-chain risk to a low level.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "${_pkg}-${pkgver}-${_commit}-x86_64.deb::https://web.archive.org/web/20221223020256if_/http://repository.spotify.com/pool/non-free/s/${_pkg}-client/${_pkg}-client_${pkgver}.${_commit}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dominik Adrian Grzywak <starterx4 at gmail dot com>
    
      2# Contributor: NicoHood <archlinux {cat} nicohood {dog} de>
    
      3# Contributor: TobFromme < TobFromme {hat} pm {dont} me >
    
      4# Contributor: Ashley Whetter <(firstname) @ awhetter.co.uk>
    
      5# Contributor: Eothred <yngve.levinsen@gmail.com>
    
      6
    
      7pkgname=spotify-1.1
    
      8_pkg=spotify
    
      9pkgver=1.1.84.716
    
      10_commit=gc5f8b819-2
    
      11pkgrel=1
    
      12pkgdesc='A proprietary music streaming service. (Legacy version branch v1.1.)'
    
      13arch=('x86_64')
    
      14license=('custom')
    
      15url='https://www.spotify.com'
    
      16depends=('alsa-lib>=1.0.14' 'gtk3' 'libxss' 'desktop-file-utils' 'openssl' 'nss' 'at-spi2-atk' 'libcurl-gnutls' 'libsm')
    
      17optdepends=('ffmpeg4.4: Adds support for playback of local files'
    
      18            'zenity: Adds support for importing local files'
    
      19            'libnotify: Desktop notifications')
    
      20options=('!strip')
    
      21provides=("${_pkg}" "${_pkg}-dev" "${_pkg}-edge" "${_pkg}-legacy")
    
      22conflicts=("${_pkg}" "${_pkg}-dev" "${_pkg}-edge" "${_pkg}-legacy")
    
      23
    
      24source=('spotify.protocol'
    
      25        'LICENSE'
    
      26        "${_pkg}-${pkgver}-${_commit}-x86_64.deb::https://web.archive.org/web/20221223020256if_/http://repository.spotify.com/pool/non-free/s/${_pkg}-client/${_pkg}-client_${pkgver}.${_commit}_amd64.deb") # Not in their repo anymore.
    
      27
    
      28sha512sums=('999abe46766a4101e27477f5c9f69394a4bb5c097e2e048ec2c6cb93dfa1743eb436bde3768af6ba1b90eaac78ea8589d82e621f9cbe7d9ab3f41acee6e8ca20'
    
      29            '2e16f7c7b09e9ecefaa11ab38eb7a792c62ae6f33d95ab1ff46d68995316324d8c5287b0d9ce142d1cf15158e61f594e930260abb8155467af8bc25779960615'
    
      30            '9ba6c2d155f683b9a38222d58a2a53a2a5f4b422ed1c0d603af87919ba8a68309aea3354278fd1d5d8142a1568d93b7e83b14c041e749b0c39f3bc155a633ef8')
    
      31
    
      32# Import key with:
    
      33# curl -sS https://download.spotify.com/debian/pubkey_7A3A762FAFD4A51F.gpg | gpg --import -
    
      34validpgpkeys=('E27409F51D1B66337F2D2F417A3A762FAFD4A51F') # Spotify Public Repository Signing Key <tux@spotify.com>
    
      35
    
      36package() {
    
      37    cd "${srcdir}"
    
      38
    
      39    tar -xzf data.tar.gz --no-same-owner -C "${pkgdir}"
    
      40
    
      41    # Enable spotify to open URLs from the webapp
    
      42    sed -i 's/^Exec=.*/Exec=spotify --uri=%U/' "${pkgdir}"/usr/share/spotify/spotify.desktop
    
      43
    
      44    install -Dm644 "${pkgdir}"/usr/share/spotify/spotify.desktop "${pkgdir}"/usr/share/applications/spotify.desktop
    
      45    install -Dm644 "${pkgdir}"/usr/share/spotify/icons/spotify-linux-512.png "${pkgdir}"/usr/share/pixmaps/spotify-client.png
    
      46
    
      47    for size in 22 24 32 48 64 128 256 512; do
    
      48        install -Dm644 "${pkgdir}/usr/share/spotify/icons/spotify-linux-$size.png" \
    
      49            "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/spotify.png"
    
      50    done
    
      51
    
      52    # Move spotify binary to its proper location
    
      53    mkdir -p "${pkgdir}"/opt/spotify
    
      54    mv "${pkgdir}/usr/share/spotify" "${pkgdir}/opt/"
    
      55
    
      56    # Symlink spotify binary which is located in /opt
    
      57    ln -sf /opt/spotify/spotify "${pkgdir}/usr/bin/spotify"
    
      58
    
      59    # Copy protocol file for KDE
    
      60    install -Dm644 "${srcdir}/spotify.protocol" "${pkgdir}/usr/share/kservices5/spotify.protocol"
    
      61
    
      62    # Install license
    
      63    # https://www.spotify.com/legal/end-user-agreement
    
      64    install -Dm 644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      65
    
      66    # Fix permissions
    
      67    chmod -R go-w "${pkgdir}"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2