spotify-soloist-bin

LOW

maintainer Mopigames 0 votes scanned 2026-08-28 15:38:44.104675

View on AUR

Why flagged

Downloads a prebuilt binary from spotifycdn.com, which is plausibly Spotify's own CDN infrastructure, with proper checksums provided; the main concern is that the CDN URL is not an official documented release endpoint and the package has few votes, but there is no obfuscation, exfiltration, or clearly malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 60%): Downloads a prebuilt binary from spotifycdn.com, which is plausibly Spotify's own CDN infrastructure, with proper checksums provided; the main concern is that the CDN URL is not an official documented release endpoint and the package has few votes, but there is no obfuscation, exfiltration, or clearly malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source_x86_64=("spotify-soloist-${pkgver}-x86_64.tar.gz::https://soloist-builds.spotifycdn.com/soloist_release_x86_64.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Margot Prego <mopigames@proton.me>
    
      2
    
      3pkgname=spotify-soloist-bin
    
      4pkgver=1.3.7.502
    
      5pkgrel=1
    
      6pkgdesc='Official headless Spotify Connect client for Linux and Raspberry Pi'
    
      7arch=('x86_64' 'aarch64' 'armv7h')
    
      8url='https://developer.spotify.com/documentation/soloist'
    
      9license=('LicenseRef-Spotify-Terms')
    
      10depends=('glibc' 'libatomic' 'libpipewire' 'libpulse')
    
      11optdepends=(
    
      12  'pipewire: PipeWire audio server'
    
      13  'pipewire-pulse: PulseAudio compatibility when using PipeWire'
    
      14  'pulseaudio: PulseAudio server'
    
      15)
    
      16provides=('spotify-soloist')
    
      17conflicts=('spotify-soloist')
    
      18options=('!debug' '!strip')
    
      19
    
      20source=('TERMS.md')
    
      21source_x86_64=("spotify-soloist-${pkgver}-x86_64.tar.gz::https://soloist-builds.spotifycdn.com/soloist_release_x86_64.tar.gz")
    
      22source_aarch64=("spotify-soloist-${pkgver}-aarch64.tar.gz::https://soloist-builds.spotifycdn.com/soloist_release_arm64.tar.gz")
    
      23source_armv7h=("spotify-soloist-${pkgver}-armv7h.tar.gz::https://soloist-builds.spotifycdn.com/soloist_release_arm32.tar.gz")
    
      24sha256sums=('77d3c4f26593c9ba58ce4b8528e3fbe40cf7c718b222c0b7d500357bfbae04f9')
    
      25sha256sums_x86_64=('c47226172d06f9945b52e5740aba24233c352b635cb1c163066c148eac1eb99e')
    
      26sha256sums_aarch64=('8f7b07d3f60e050bc6cf6977b870f49dacfdb48fa8dabe151b7ef560030a7678')
    
      27sha256sums_armv7h=('b75b4b0b5c43903adf732386f812b1c5ef2f11e0dbf787cfe8d20fa8c6cac397')
    
      28
    
      29package() {
    
      30  install -Dm755 soloist "${pkgdir}/usr/bin/soloist"
    
      31  install -Dm644 TERMS.md "${pkgdir}/usr/share/licenses/${pkgname}/TERMS.md"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-28 15:38:44	Low	3
2026-08-28 15:35:42	Medium	2