spotify-dev
LOW
maintainer imp0
26 votes
scanned 2026-10-03 00:23:04.761738
Why flagged
The package downloads a prebuilt .deb from Spotify's official repository, which is a standard and expected source for the binary; while checksums are partially skipped, the build process validates the package hashes via the signed Release file, reducing supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Spotify's official repository, which is a standard and expected source for the binary; while checksums are partially skipped, the build process validates the package hashes via the signed Release file, reducing supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
source=("${_pkgname}-Release::https://repository.spotify.com/dists/testing/Release"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: imp0 <jan <(a)> siteworld <(.)> be>
2
# Contributor: NicoHood <archlinux {cat} nicohood {dog} de>
3
# Contributor: Ashley Whetter <(firstname) @ awhetter.co.uk>
4
# Contributor: Eothred <yngve.levinsen@gmail.com>
5
6
pkgname=spotify-dev
7
_pkgname=spotify
8
pkgver=1.2.96.518
9
_commit=g366879e1
10
pkgrel=1
11
pkgdesc='A proprietary music streaming service'
12
arch=('x86_64')
13
license=('custom')
14
url='https://www.spotify.com'
15
depends=('alsa-lib'
16
'at-spi2-core'
17
'gtk3'
18
'libayatana-appindicator'
19
'libcurl-gnutls'
20
'libdbusmenu-glib'
21
'libglvnd'
22
'libice'
23
'libsm'
24
'nss'
25
'nspr'
26
'vulkan-icd-loader')
27
optdepends=('ffmpeg: Adds support for playback of local files'
28
'zenity: Adds support for importing local files'
29
'libnotify: Desktop notifications')
30
provides=("${_pkgname}")
31
conflicts=("${_pkgname}")
32
33
source=("${_pkgname}-Release::https://repository.spotify.com/dists/testing/Release"
34
"${_pkgname}-${pkgver}-${CARCH}.deb::https://repository.spotify.com/pool/non-free/s/spotify-client/spotify-client_${pkgver}.${_commit}_amd64.deb"
35
"${_pkgname}-${CARCH}-Packages::https://repository.spotify.com/dists/testing/non-free/binary-amd64/Packages"
36
'LICENSE')
37
sha512sums=('SKIP'
38
'98d25bd748258ca8b8357313cd35c7188bb0b26ed2d4390b0208473aa9fa3491a095559762f8ba06ec0828d73e05ee8fb488f0f357340191da4c65dd1f93c519'
39
'SKIP'
40
'2e16f7c7b09e9ecefaa11ab38eb7a792c62ae6f33d95ab1ff46d68995316324d8c5287b0d9ce142d1cf15158e61f594e930260abb8155467af8bc25779960615')
41
42
# Spotify uses different names for the arch
43
_SPOTIFY_ARCH=amd64
44
45
prepare() {
46
# Validate hashes from the "Release" file
47
echo "$(grep non-free/binary-${_SPOTIFY_ARCH}/Packages ${_pkgname}-Release | tail -n 2 | head -n 1 | awk '{print $1}') ${_pkgname}-${CARCH}-Packages" > "${_pkgname}-${CARCH}-Packages.sha256"
48
sha256sum -c "${_pkgname}-${CARCH}-Packages.sha256"
49
50
echo "$(grep SHA512 ${_pkgname}-${CARCH}-Packages | awk '{print $2}') ${_pkgname}-${pkgver}-${CARCH}.deb" > "${_pkgname}-${pkgver}-${CARCH}.deb.sha512"
51
sha512sum -c "${_pkgname}-${pkgver}-${CARCH}.deb.sha512"
52
}
53
54
build() {
55
tar -xzf data.tar.gz -C "${srcdir}"
56
}
57
58
package() {
59
60
# Install icons
61
install -D -m 644 "${srcdir}"/usr/share/spotify/spotify.desktop "${pkgdir}"/usr/share/applications/spotify.desktop
62
install -D -m 644 "${srcdir}"/usr/share/spotify/icons/spotify-linux-512.png "${pkgdir}"/usr/share/pixmaps/spotify-client.png
63
64
for size in 22 24 32 48 64 128 256 512; do
65
install -D -m 644 "${srcdir}/usr/share/spotify/icons/spotify-linux-$size.png" \
66
"${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/spotify.png"
67
done
68
69
# Some vars to make life easier
70
_srcshare="${srcdir}/usr/share/${_pkgname}"
71
_pkgopt="${pkgdir}/opt/${_pkgname}"
72
73
# Create target directories
74
install -d -m 755 "${_pkgopt}"
75
install -d -m 755 "${_pkgopt}/Apps"
76
install -d -m 755 "${_pkgopt}/locales"
77
78
# Install files in rootdir
79
for _rfile in $(find "${_srcshare}" -maxdepth 1 -type f -name "*.pak" -o -name "*.dat" -o -name "*.bin" -o -name "libcef.so"); do
80
install -D -m 644 "${_rfile}" "${_pkgopt}"
81
done
82
83
# Install files in appdir
84
for _app in $(find "${_srcshare}/Apps" -maxdepth 1 -type f -name "*.spa"); do
85
install -D -m 644 "${_app}" "${_pkgopt}/Apps"
86
done
87
88
# Install locale data
89
for _loc in $(find "${_srcshare}/locales" -maxdepth 1 -type f -name "*.pak" -o -name "*.mo"); do
90
install -D -m 644 "${_loc}" "${_pkgopt}/locales"
91
done
92
93
# Install binary
94
install -D -m 755 "${_srcshare}/${_pkgname}" "${_pkgopt}"
95
96
# Symlink binary
97
install -d -m 755 "${pkgdir}"/usr/bin
98
ln -s /opt/spotify/spotify "${pkgdir}"/usr/bin/spotify
99
100
# Install license
101
# https://www.spotify.com/legal/end-user-agreement
102
install -D -m 644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
103
}
104
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |