toobamp-bin

LOW

maintainer xpufx 0 votes scanned 2026-08-25 11:26:09.289924

View on AUR

Why flagged

The package repacks a verifiable upstream .deb from the project's official GitHub repository, installs only data and binaries without executing code, and has no install-time scripts, making the risk low despite the untrusted-host download.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package repacks a verifiable upstream .deb from the project's official GitHub repository, installs only data and binaries without executing code, and has no install-time scripts, making the risk low despite the untrusted-host download.

PKGBUILD

      1# Maintainer: xpufx <github@xpufx.com>
    
      2#
    
      3# ToobAmp only ships .deb packages; this PKGBUILD repacks the upstream
    
      4# amd64 deb into an Arch package. Pure file drop: the deb has no
    
      5# maintainer scripts, and the package runs nothing at install time.
    
      6# See README.md (maintainer notes).
    
      7
    
      8pkgname=toobamp-bin
    
      9pkgver=1.2.77
    
      10pkgrel=1
    
      11pkgdesc="TooB LV2 guitar effects plugins: amp/cab models and effects (binary repack)"
    
      12arch=('x86_64')
    
      13url="https://github.com/rerdavies/ToobAmp"
    
      14license=('MIT' 'MPL-2.0')
    
      15depends=(
    
      16  'cairo'
    
      17  'gcc-libs'
    
      18  'glib2'
    
      19  'glibc'
    
      20  'libx11'
    
      21  'libxrandr'
    
      22  'pango'
    
      23  'librsvg'
    
      24)
    
      25makedepends=('binutils')
    
      26source=("https://github.com/rerdavies/ToobAmp/releases/download/v${pkgver}/toobamp_${pkgver}_amd64.deb")
    
      27sha256sums=('0c63281de6cf8dd4c5bd11a3634a54f4ba7d1be4573c6f68ede8822edc24f469')
    
      28
    
      29package() {
    
      30  cd "${srcdir}"
    
      31
    
      32  # Unpack the deb's data payload. `ar` (binutils) splits the deb into
    
      33  # debian-binary, control.tar.gz and data.tar.gz; the data payload maps
    
      34  # onto the Arch FHS (usr/).
    
      35  ar x "toobamp_${pkgver}_amd64.deb"
    
      36  tar -xf data.tar.gz -C "${pkgdir}"
    
      37
    
      38  # Drop the stray empty usr/local directory the deb ships.
    
      39  rmdir "${pkgdir}"/usr/local 2>/dev/null || true
    
      40
    
      41  # Normalize directory permissions: the deb ships dirs at 775, Arch
    
      42  # convention is 755.
    
      43  find "${pkgdir}" -type d -exec chmod 755 {} +
    
      44
    
      45  # Licenses: main code is MIT, the ToobML part is MPL-2.0, and the
    
      46  # impulse responses are CC-BY-4.0 (their license texts travel inside
    
      47  # the bundle). The deb's copyright file documents all components.
    
      48  install -Dm644 "${pkgdir}/usr/share/doc/toobamp/copyright" \
    
      49    "${pkgdir}/usr/share/licenses/toobamp-bin/LICENSE"
    
      50  install -Dm644 "${pkgdir}/usr/lib/lv2/ToobAmp.lv2/LICENSE.md" \
    
      51    "${pkgdir}/usr/share/licenses/toobamp-bin/LICENSE.md"
    
      52  install -Dm644 "${pkgdir}/usr/lib/lv2/ToobAmp.lv2/MPL-2.0.md" \
    
      53    "${pkgdir}/usr/share/licenses/toobamp-bin/MPL-2.0.md"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-25 11:26:09	Low	2