spotify-dev
MEDIUM
maintainer imp0
26 votes
scanned 2026-08-19 15:42:02.122486
Why flagged
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
source=("${_pkgname}-Release::https://repository.spotify.com/dists/testing/Release"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: imp0 <jan <(a)> siteworld <(.)> be>
2
# Contributor: NicoHood <archlinux {cat} nicohood {dog} de>
3
# Contributor: Ashley Whetter <(firstname) @ awhetter.co.uk>
4
# Contributor: Eothred <yngve.levinsen@gmail.com>
5
6
pkgname=spotify-dev
7
_pkgname=spotify
8
pkgver=1.2.96.518
9
_commit=g366879e1
10
pkgrel=1
11
pkgdesc='A proprietary music streaming service'
12
arch=('x86_64')
13
license=('custom')
14
url='https://www.spotify.com'
15
depends=('alsa-lib'
16
'at-spi2-core'
17
'gtk3'
18
'libayatana-appindicator'
19
'libcurl-gnutls'
20
'libdbusmenu-glib'
21
'libglvnd'
22
'libice'
23
'libsm'
24
'nss'
25
'nspr'
26
'vulkan-icd-loader')
27
optdepends=('ffmpeg: Adds support for playback of local files'
28
'zenity: Adds support for importing local files'
29
'libnotify: Desktop notifications')
30
provides=("${_pkgname}")
31
conflicts=("${_pkgname}")
32
33
source=("${_pkgname}-Release::https://repository.spotify.com/dists/testing/Release"
34
"${_pkgname}-${pkgver}-${CARCH}.deb::https://repository.spotify.com/pool/non-free/s/spotify-client/spotify-client_${pkgver}.${_commit}_amd64.deb"
35
"${_pkgname}-${CARCH}-Packages::https://repository.spotify.com/dists/testing/non-free/binary-amd64/Packages"
36
'LICENSE')
37
sha512sums=('SKIP'
38
'98d25bd748258ca8b8357313cd35c7188bb0b26ed2d4390b0208473aa9fa3491a095559762f8ba06ec0828d73e05ee8fb488f0f357340191da4c65dd1f93c519'
39
'SKIP'
40
'2e16f7c7b09e9ecefaa11ab38eb7a792c62ae6f33d95ab1ff46d68995316324d8c5287b0d9ce142d1cf15158e61f594e930260abb8155467af8bc25779960615')
41
42
# Spotify uses different names for the arch
43
_SPOTIFY_ARCH=amd64
44
45
prepare() {
46
# Validate hashes from the "Release" file
47
echo "$(grep non-free/binary-${_SPOTIFY_ARCH}/Packages ${_pkgname}-Release | tail -n 2 | head -n 1 | awk '{print $1}') ${_pkgname}-${CARCH}-Packages" > "${_pkgname}-${CARCH}-Packages.sha256"
48
sha256sum -c "${_pkgname}-${CARCH}-Packages.sha256"
49
50
echo "$(grep SHA512 ${_pkgname}-${CARCH}-Packages | awk '{print $2}') ${_pkgname}-${pkgver}-${CARCH}.deb" > "${_pkgname}-${pkgver}-${CARCH}.deb.sha512"
51
sha512sum -c "${_pkgname}-${pkgver}-${CARCH}.deb.sha512"
52
}
53
54
build() {
55
tar -xzf data.tar.gz -C "${srcdir}"
56
}
57
58
package() {
59
60
# Install icons
61
install -D -m 644 "${srcdir}"/usr/share/spotify/spotify.desktop "${pkgdir}"/usr/share/applications/spotify.desktop
62
install -D -m 644 "${srcdir}"/usr/share/spotify/icons/spotify-linux-512.png "${pkgdir}"/usr/share/pixmaps/spotify-client.png
63
64
for size in 22 24 32 48 64 128 256 512; do
65
install -D -m 644 "${srcdir}/usr/share/spotify/icons/spotify-linux-$size.png" \
66
"${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/spotify.png"
67
done
68
69
# Some vars to make life easier
70
_srcshare="${srcdir}/usr/share/${_pkgname}"
71
_pkgopt="${pkgdir}/opt/${_pkgname}"
72
73
# Create target directories
74
install -d -m 755 "${_pkgopt}"
75
install -d -m 755 "${_pkgopt}/Apps"
76
install -d -m 755 "${_pkgopt}/locales"
77
78
# Install files in rootdir
79
for _rfile in $(find "${_srcshare}" -maxdepth 1 -type f -name "*.pak" -o -name "*.dat" -o -name "*.bin" -o -name "libcef.so"); do
80
install -D -m 644 "${_rfile}" "${_pkgopt}"
81
done
82
83
# Install files in appdir
84
for _app in $(find "${_srcshare}/Apps" -maxdepth 1 -type f -name "*.spa"); do
85
install -D -m 644 "${_app}" "${_pkgopt}/Apps"
86
done
87
88
# Install locale data
89
for _loc in $(find "${_srcshare}/locales" -maxdepth 1 -type f -name "*.pak" -o -name "*.mo"); do
90
install -D -m 644 "${_loc}" "${_pkgopt}/locales"
91
done
92
93
# Install binary
94
install -D -m 755 "${_srcshare}/${_pkgname}" "${_pkgopt}"
95
96
# Symlink binary
97
install -d -m 755 "${pkgdir}"/usr/bin
98
ln -s /opt/spotify/spotify "${pkgdir}"/usr/bin/spotify
99
100
# Install license
101
# https://www.spotify.com/legal/end-user-agreement
102
install -D -m 644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
103
}
104
Changes since previous scan
--- PKGBUILD @ 2026-06-19 19:07+++ PKGBUILD @ 2026-08-19 15:42@@ -5,8 +5,8 @@ pkgname=spotify-dev _pkgname=spotify-pkgver=1.2.92.147-_commit=g5b8f9367+pkgver=1.2.96.518+_commit=g366879e1 pkgrel=1 pkgdesc='A proprietary music streaming service' arch=('x86_64')@@ -35,7 +35,7 @@ "${_pkgname}-${CARCH}-Packages::https://repository.spotify.com/dists/testing/non-free/binary-amd64/Packages" 'LICENSE') sha512sums=('SKIP'- 'e84afeaa3c011c7e06cffa31d0a0113f8851bad57fc26317c2eef74b89985848bdd25b72e4f9a9e55948b8b927f3205a8b9c1047e2f28eec500ac7a2d4913cad'+ '98d25bd748258ca8b8357313cd35c7188bb0b26ed2d4390b0208473aa9fa3491a095559762f8ba06ec0828d73e05ee8fb488f0f357340191da4c65dd1f93c519' 'SKIP' '2e16f7c7b09e9ecefaa11ab38eb7a792c62ae6f33d95ab1ff46d68995316324d8c5287b0d9ce142d1cf15158e61f594e930260abb8155467af8bc25779960615') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-19 15:42:02 | Medium | 1 |
| 2026-06-19 19:07:35 | Clean | 2 |
| 2026-06-18 18:55:24 | Low | 2 |
| 2026-06-18 18:04:49 | Low | 2 |
| 2026-06-18 17:53:10 | Low | 2 |
| 2026-06-18 16:11:54 | Medium | 1 |