tone3000-plugin-bin

LOW

maintainer xpufx 0 votes scanned 2026-09-01 17:48:51.913915

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official GitHub releases, which is a normal practice for proprietary or complex builds; the low severity is due to the unverifiable binary payload, but it comes from a trusted project source with no signs of malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases, which is a normal practice for proprietary or complex builds; the low severity is due to the unverifiable binary payload, but it comes from a trusted project source with no signs of malicious behavior.

PKGBUILD

      1# Maintainer: xpufx <github@xpufx.com>
    
      2pkgname=tone3000-plugin-bin
    
      3pkgver=0.0.2
    
      4_zip_sha='fade5434e78a0cfefeb7b13987cd549e169f7c1caf0584eebc1ce1497dac636d'
    
      5_license_sha='88d4908d7343898f682e47e70f4288728006ed650dbf79e8940c709d55b76326'
    
      6pkgrel=1
    
      7pkgdesc="TONE3000 — NAM & IR loader plugin (VST3/CLAP/LV2/Standalone, JUCE/WebKitGTK)"
    
      8arch=('x86_64')
    
      9url="https://github.com/tone-3000/tone3000-plugin"
    
      10_github_url="https://github.com/tone-3000/tone3000-plugin"
    
      11license=('MIT')
    
      12depends=('webkit2gtk-4.1' 'gtk3' 'alsa-lib' 'freetype2' 'curl' 'hicolor-icon-theme' 'glibc' 'gcc-libs')
    
      13optdepends=('jack: JACK audio backend for standalone')
    
      14makedepends=('unzip')
    
      15provides=('tone3000-plugin')
    
      16conflicts=('tone3000-plugin')
    
      17options=('!strip' '!debug')
    
      18source=("TONE3000-v${pkgver}-linux-x64.zip::${_github_url}/releases/download/v${pkgver}/TONE3000-v${pkgver}-linux-x64.zip"
    
      19        "LICENSE::https://raw.githubusercontent.com/tone-3000/tone3000-plugin/v${pkgver}/LICENSE")
    
      20sha256sums=("$_zip_sha"
    
      21            "$_license_sha")
    
      22
    
      23prepare() {
    
      24	# The zip contains a single inner tar.gz. makepkg (bsdtar) extracts the zip
    
      25	# leaving TONE3000-vX-linux-x64.tar.gz; unpack it to get the payload dir.
    
      26	if [ -f "TONE3000-v${pkgver}-linux-x64.tar.gz" ]; then
    
      27		tar -xzf "TONE3000-v${pkgver}-linux-x64.tar.gz"
    
      28	fi
    
      29}
    
      30
    
      31package() {
    
      32	cd "$srcdir"
    
      33
    
      34	_srcdir="TONE3000-v${pkgver}-linux-x64"
    
      35	# Fallback if prepare already ran in a different workdir (e.g. update-package.sh)
    
      36	if [ ! -d "$_srcdir" ] && [ -f "TONE3000-v${pkgver}-linux-x64.tar.gz" ]; then
    
      37		tar -xzf "TONE3000-v${pkgver}-linux-x64.tar.gz"
    
      38	fi
    
      39
    
      40	# Binaries — system-wide locations (Arch audio plugin convention).
    
      41	# Do NOT use ${pkgname} in install paths (see paseo fix); use fixed names.
    
      42	install -Dm755 "${_srcdir}/TONE3000" "${pkgdir}/usr/bin/TONE3000"
    
      43	install -Dm755 "${_srcdir}/TONE3000.clap" "${pkgdir}/usr/lib/clap/TONE3000.clap"
    
      44
    
      45	# VST3 is a bundle dir; LV2 is a bundle dir
    
      46	mkdir -p "${pkgdir}/usr/lib/vst3" "${pkgdir}/usr/lib/lv2"
    
      47	cp -a "${_srcdir}/TONE3000.vst3" "${pkgdir}/usr/lib/vst3/"
    
      48	cp -a "${_srcdir}/TONE3000.lv2" "${pkgdir}/usr/lib/lv2/"
    
      49
    
      50	# Fix permissions: upstream tar ships dirs at 775, Arch wants 755; .so perms
    
      51	find "${pkgdir}/usr/lib" -type d -exec chmod 755 {} +
    
      52	find "${pkgdir}/usr/lib" -type f -name "*.so" -exec chmod 755 {} +
    
      53
    
      54	# Factory presets — system-wide, replaces previous set (upstream install.sh does rm *.t3kpreset first)
    
      55	if compgen -G "${_srcdir}/factory-presets/*.t3kpreset" > /dev/null; then
    
      56		install -d "${pkgdir}/usr/share/tone3000/factory-presets"
    
      57		install -m644 "${_srcdir}/factory-presets"/*.t3kpreset "${pkgdir}/usr/share/tone3000/factory-presets/"
    
      58	fi
    
      59
    
      60	# Icon + desktop entry (Exec must be absolute /usr/bin path)
    
      61	install -Dm644 "${_srcdir}/tone3000.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/tone3000.png"
    
      62	install -d "${pkgdir}/usr/share/applications"
    
      63	cat > "${pkgdir}/usr/share/applications/tone3000.desktop" <<DESKTOP
    
      64[Desktop Entry]
    
      65Type=Application
    
      66Name=TONE3000
    
      67Comment=Play NAM captures and IRs straight from TONE3000
    
      68Exec=/usr/bin/TONE3000
    
      69Icon=tone3000
    
      70Terminal=false
    
      71Categories=AudioVideo;Audio;Music;
    
      72StartupWMClass=TONE3000
    
      73DESKTOP
    
      74
    
      75	# License — ship original MIT from upstream (second source)
    
      76	install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      77}
    
      78

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-01 17:48:51	Low	2