tinymediamanager-bin

maintainer evine · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from the project's official release host, which is not on the whitelist but is plausibly legitimate; checksums are provided and match the sources, reducing supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official release host, which is not on the whitelist but is plausibly legitimate; checksums are provided and match the sources, reducing supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("${_pkgname}-${pkgver}-x86_64.tar.xz::https://release.${_pkgname}.org/v${pkgver%%.*}/dist/${_dlname}-${pkgver}-linux-amd64.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: devome <evinedeng@hotmail.com>
    
      2
    
      3_dlname="tinyMediaManager"
    
      4_pkgname="${_dlname,,}"
    
      5pkgname="${_pkgname}-bin"
    
      6pkgver=5.3.0
    
      7pkgrel=1
    
      8pkgdesc="A media management tool written in Java/Swing."
    
      9provides=("${_pkgname}")
    
      10conflicts=("${_pkgname}")
    
      11arch=("x86_64" "aarch64")
    
      12url="https://www.${_pkgname}.org"
    
      13license=("Apache-2.0")
    
      14depends=("ffmpeg" "java-runtime>=8" "libmediainfo")
    
      15source=("${_pkgname}.desktop"
    
      16        "${_pkgname}.png")
    
      17source_x86_64=("${_pkgname}-${pkgver}-x86_64.tar.xz::https://release.${_pkgname}.org/v${pkgver%%.*}/dist/${_dlname}-${pkgver}-linux-amd64.tar.xz")
    
      18source_aarch64=("${_pkgname}-${pkgver}-aarch64.tar.xz::https://release.${_pkgname}.org/v${pkgver%%.*}/dist/${_dlname}-${pkgver}-linux-arm64.tar.xz")
    
      19sha256sums=('08499a10730b6af6113c4a56e4ed7bed068d7fed282080dfd550b66d6a8ac9f5'
    
      20            '79b50c260b1c1c1f695c0ea1d743742d11d9a1337a2bc73985e4428752492f0f')
    
      21sha256sums_x86_64=('fa1e20c490fdcbc46e0b4b82f8954e793c40781ed95bba149303f7f5496c6bcc')
    
      22sha256sums_aarch64=('92eb13f86d761eb3b801923a0eb562c5fe53157e7ddee706c3529cd6e126b393')
    
      23_mark1=$(if [[ $CARCH == x86_64 ]]; then echo "linux";      elif [[ $CARCH == aarch64 ]]; then echo "arm";            fi)
    
      24_mark2=$(if [[ $CARCH == x86_64 ]]; then echo "${_dlname}"; elif [[ $CARCH == aarch64 ]]; then echo "${_dlname}-arm"; fi)
    
      25
    
      26prepare() {
    
      27    cd "${_dlname}"
    
      28    mv LICENSE ..
    
      29    rm -rf jre "native/${_mark1}/addons/"*
    
      30}
    
      31
    
      32package() {
    
      33    install -Dm644 "LICENSE"             "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
    
      34    install -Dm644 "${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      35    install -Dm644 "${_pkgname}.png"     "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png"
    
      36    install -dm755 "${pkgdir}/"{opt,usr/bin}
    
      37
    
      38    cp --preserve=mode -r "${_dlname}"   "${pkgdir}/opt/${_pkgname}"
    
      39
    
      40    ln -s "/opt/${_pkgname}/${_mark2}"   "${pkgdir}/usr/bin/${_pkgname}"
    
      41    ln -s "/usr/lib/jvm/default"         "${pkgdir}/opt/${_pkgname}/jre"
    
      42    # ln -s "/usr/bin/ffmpeg"              "${pkgdir}/opt/${_pkgname}/native/${_mark1}/addons/ffmpeg"
    
      43}
    
      44

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 _dlname="tinyMediaManager"
 _pkgname="${_dlname,,}"
 pkgname="${_pkgname}-bin"
-pkgver=5.2.12
+pkgver=5.3.0
 pkgrel=1
 pkgdesc="A media management tool written in Java/Swing."
 provides=("${_pkgname}")
@@ -18,8 +18,8 @@
 source_aarch64=("${_pkgname}-${pkgver}-aarch64.tar.xz::https://release.${_pkgname}.org/v${pkgver%%.*}/dist/${_dlname}-${pkgver}-linux-arm64.tar.xz")
 sha256sums=('08499a10730b6af6113c4a56e4ed7bed068d7fed282080dfd550b66d6a8ac9f5'
             '79b50c260b1c1c1f695c0ea1d743742d11d9a1337a2bc73985e4428752492f0f')
-sha256sums_x86_64=('d2fe73494998d89b82884d153da2f489ac8e9b444895c6dcdc260ff6f694c4f3')
-sha256sums_aarch64=('19faf3a3b7f3dc7551ab429df81d102723b0c4dd679da9f40f7c33e1f942c4fb')
+sha256sums_x86_64=('fa1e20c490fdcbc46e0b4b82f8954e793c40781ed95bba149303f7f5496c6bcc')
+sha256sums_aarch64=('92eb13f86d761eb3b801923a0eb562c5fe53157e7ddee706c3529cd6e126b393')
 _mark1=$(if [[ $CARCH == x86_64 ]]; then echo "linux";      elif [[ $CARCH == aarch64 ]]; then echo "arm";            fi)
 _mark2=$(if [[ $CARCH == x86_64 ]]; then echo "${_dlname}"; elif [[ $CARCH == aarch64 ]]; then echo "${_dlname}-arm"; fi)
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 09:54:28	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-19 18:54:17	CLEAN	2