spotify-downloader

maintainer Archer_Mokshit · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs `pip install --no-deps --target=... redis>=5.0.0 spotipy>=2.24.0` during the package() phase, pulling live PyPI packages at build time with version ranges (not pinned hashes). This is a genuine supply-chain concern: any future PyPI release of redis or spotipy satisfying those version constraints will be silently bundled into the installed package without integrity verification (sha256sums is also 'SKIP' for the upstream tarball). The packages themselves (redis, spotipy) are well-known and not inherently malicious, but the pattern of unbounded pip-pulling from an external registry during packaging, combined with no hash pinning, represents a real medium-severity supply-chain risk. Additionally, the hardcoded python3.13 path in site_packages will break on any other Python version. The upstream source is a personal GitHub repo with SKIP checksums, adding further uncertainty. This is not a false positive — the cheaper model's assessment is correct.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:42 pip install --no-deps --target="$site_packages" redis>=5.0.0 spotipy>=2.24.0

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD runs `pip install --no-deps --target=... redis>=5.0.0 spotipy>=2.24.0` during the package() phase, pulling live PyPI packages at build time with version ranges (not pinned hashes). This is a genuine supply-chain concern: any future PyPI release of redis or spotipy satisfying those version constraints will be silently bundled into the installed package without integrity verification (sha256sums is also 'SKIP' for the upstream tarball). The packages themselves (redis, spotipy) are well-known and not inherently malicious, but the pattern of unbounded pip-pulling from an external registry during packaging, combined with no hash pinning, represents a real medium-severity supply-chain risk. Additionally, the hardcoded python3.13 path in site_packages will break on any other Python version. The upstream source is a personal GitHub repo with SKIP checksums, adding further uncertainty. This is not a false positive — the cheaper model's assessment is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mokshit Bindal <your-email@example.com>
    
      2
    
      3pkgname=spotify-downloader
    
      4pkgver=1.0.4
    
      5pkgrel=1
    
      6pkgdesc="Download Spotify playlists, albums, and tracks in FLAC/MP3 format from free sources with beautiful terminal UI"
    
      7arch=('any')
    
      8url="https://github.com/MokshitBindal/Spotify_Downloader"
    
      9license=('MIT')
    
      10depends=(
    
      11    'python'
    
      12    'ffmpeg'
    
      13    'yt-dlp'
    
      14    'python-click'
    
      15    'python-dotenv'
    
      16    'python-mutagen'
    
      17    'python-pydub'
    
      18    'python-requests'
    
      19    'python-tqdm'
    
      20    'python-yaml'
    
      21)
    
      22makedepends=('python-setuptools' 'python-build' 'python-installer' 'python-wheel' 'python-pip')
    
      23optdepends=()
    
      24source=("${pkgname}-${pkgver}.tar.gz::https://github.com/MokshitBindal/Spotify_Downloader/archive/v${pkgver}.tar.gz")
    
      25sha256sums=('SKIP')
    
      26
    
      27build() {
    
      28    cd "${srcdir}/Spotify_Downloader-${pkgver}"
    
      29    python -m build --wheel --no-isolation
    
      30}
    
      31
    
      32package() {
    
      33    cd "${srcdir}/Spotify_Downloader-${pkgver}"
    
      34    
    
      35    # Install the wheel
    
      36    python -m installer --destdir="$pkgdir" dist/*.whl
    
      37    
    
      38    # Bundle redis and spotipy (not available in official Arch repos)
    
      39    # Note: We always bundle these to avoid conflicts with user-installed system packages
    
      40    # Users who have python-redis or python-spotipy can uninstall our package first
    
      41    local site_packages="$pkgdir/usr/lib/python3.13/site-packages"
    
      42    pip install --no-deps --target="$site_packages" redis>=5.0.0 spotipy>=2.24.0
    
      43    
    
      44    # Install documentation
    
      45    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      46    
    
      47    # Install license
    
      48    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      49}
    
      50
    
      51post_install() {
    
      52    echo ""
    
      53    echo "======================================================================"
    
      54    echo "  Spotify Downloader installed successfully!"
    
      55    echo "======================================================================"
    
      56    echo ""
    
      57    echo "  NOTE: This package bundles python-redis and python-spotipy."
    
      58    echo "  If you have these installed separately, you may see file conflicts."
    
      59    echo "  Solution: sudo pacman -R python-redis && yay -R python-spotipy"
    
      60    echo ""
    
      61    echo "  First-time setup:"
    
      62    echo "    1. Get Spotify API credentials: https://developer.spotify.com/dashboard"
    
      63    echo "    2. Edit: ~/.config/spotify-downloader/config.yaml"
    
      64    echo ""
    
      65    echo "  Without Spotify credentials, you can still download from:"
    
      66    echo "    - Internet Archive (free FLAC)"
    
      67    echo "    - Jamendo (Creative Commons music)"
    
      68    echo "    - YouTube (fallback)"
    
      69    echo ""
    
      70    echo "  Refresh shell command cache: hash -r"
    
      71    echo "======================================================================"
    
      72    echo ""
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2