taptempo

LOW

maintainer fermino 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a tarball from a personal domain (mzf.fr), which is not on a standard forge, but it is the project's own release source; the checksum is verified, and the package builds from source, posing no active execution or supply-chain risk beyond typical AUR packages.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a personal domain (mzf.fr), which is not on a standard forge, but it is the project's own release source; the checksum is verified, and the package builds from source, posing no active execution or supply-chain risk beyond typical AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("${pkgname}-${pkgver}.tar.gz::https://mzf.fr/${pkgname}/download/${pkgver}/${pkgname}-${pkgver}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dimitris Kiziridis <ragouel at outlook dot com>
    
      2
    
      3pkgname=taptempo
    
      4pkgver=1.4.5
    
      5pkgrel=2
    
      6pkgdesc="A command line tap tempo. Hit enter key with style and you'll get the corresponding number of beats per minute (BPM). This tool is very useful to quickly find the tempo of a song without launching a big digital workstation like Ardour or LMMS"
    
      7arch=('x86_64')
    
      8url="https://taptempo.tuxfamily.org"
    
      9license=('GPL3')
    
      10depends=('gcc-libs')
    
      11makedepends=('catch2-v2' 'cmake')
    
      12source=("${pkgname}-${pkgver}.tar.gz::https://mzf.fr/${pkgname}/download/${pkgver}/${pkgname}-${pkgver}.tar.gz")
    
      13sha256sums=('6a471bc693516529dfc7b8bb3cf7e237dde675068cce0f0d99d2831e2e378753')
    
      14
    
      15prepare() {
    
      16  cd "$srcdir/$pkgname-$pkgver"
    
      17  if [[ -d _build ]]; then
    
      18    rm -rf _build
    
      19  fi
    
      20  mkdir _build
    
      21  cd _build
    
      22  cmake -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -DCMAKE_INSTALL_PREFIX:PATH=/usr ..
    
      23}
    
      24
    
      25build() {
    
      26  cd "$srcdir/$pkgname-$pkgver/_build"
    
      27  make
    
      28}
    
      29
    
      30package() {
    
      31  cd "$srcdir/$pkgname-$pkgver/_build"
    
      32  DESTDIR=$pkgdir make install 
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2