vynody-bin

maintainer yougg · 0 votes · scanned 2026-08-18 03:38:23.746777

LOW

Why flagged The package downloads a prebuilt .deb from the project's GitHub releases, which is a normal distribution method for binaries; the source is verifiable and the checksum is provided, making it low risk despite the binary origin.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt .deb from the project's GitHub releases, which is a normal distribution method for binaries; the source is verifiable and the checksum is provided, making it low risk despite the binary origin.

PKGBUILD

      1# Maintainer: axel10 <https://github.com/axel10/vynody>
    
      2pkgname=vynody-bin
    
      3_pkgname=vynody
    
      4pkgver=1.17.0
    
      5pkgrel=2
    
      6pkgdesc="Cross-platform local music/audio player with synced lyrics and audio tag editor"
    
      7arch=('x86_64')
    
      8url="https://github.com/axel10/vynody"
    
      9license=('GPL-3.0-or-later')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'cairo'
    
      14  'dbus'
    
      15  'fontconfig'
    
      16  'freetype2'
    
      17  'gdk-pixbuf2'
    
      18  'glib2'
    
      19  'gtk3'
    
      20  'libepoxy'
    
      21  'pango'
    
      22  'hicolor-icon-theme'
    
      23)
    
      24optdepends=(
    
      25  'ffmpeg: Audio decoding support'
    
      26)
    
      27options=('!strip')
    
      28provides=("${_pkgname}=${pkgver}")
    
      29conflicts=("${_pkgname}")
    
      30source_x86_64=("${pkgname}-${pkgver}.deb::${url}/releases/download/${pkgver}/${_pkgname}-linux-${pkgver}-amd64.deb")
    
      31sha256sums_x86_64=('bcd4ce4e20c5b5a0c471591eb74956bfbac6c01637b2449a8111e0de4f2a5fad')
    
      32
    
      33package() {
    
      34  local data_archive
    
      35  data_archive=$(find "${srcdir}" -maxdepth 1 -name "data.tar.*" | head -n 1)
    
      36  if [[ -n "$data_archive" ]]; then
    
      37    bsdtar -xf "${data_archive}" -C "${pkgdir}"
    
      38  else
    
      39    bsdtar -xf "${pkgname}-${pkgver}.deb" -C "${pkgdir}"
    
      40  fi
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 03:38:23	LOW	2