yandex-music
LOW
maintainer dmitrysvd
19 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from Yandex's own S3 bucket, which is plausibly the official source; while the host is not whitelisted, it is a legitimate release artifact from the vendor, and no code execution or obfuscation occurs during install.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Yandex's own S3 bucket, which is plausibly the official source; while the host is not whitelisted, it is a legitimate release artifact from the vendor, and no code execution or obfuscation occurs during install.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:26
source=("https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_amd64_${pkgver}.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: dmitrysvd
2
3
pkgname=yandex-music
4
pkgver=5.119.0
5
pkgrel=1
6
pkgdesc="Official Yandex Music App for Linux"
7
arch=('x86_64')
8
url="https://music.yandex.ru/download/"
9
license=('LicenseRef-unknown')
10
depends=(
11
alsa-lib
12
gtk3
13
libnotify
14
nss
15
libxss
16
libxtst
17
xdg-utils
18
at-spi2-core
19
util-linux-libs
20
libsecret
21
)
22
optdepends=(
23
libappindicator-gtk3
24
)
25
options=('!strip' '!debug')
26
source=("https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_amd64_${pkgver}.deb")
27
sha256sums=('3ebe10124ba5924348a623353e6e39a64855f81eb2199134b9df884326bf6296')
28
29
package() {
30
bsdtar -xf data.tar.* --directory "${pkgdir}"
31
32
# Remove Cyrillic from the path
33
mv "${pkgdir}/opt/Яндекс Музыка" "${pkgdir}/opt/yandex-music"
34
35
# Disable auto-updates
36
rm "${pkgdir}/opt/yandex-music/resources/app-update.yml"
37
# Without package-type electron-updater falls back to AppImageUpdater,
38
# which reports itself inactive instead of erroring on every poll
39
rm "${pkgdir}/opt/yandex-music/resources/package-type"
40
41
# Fix desktop file
42
sed -i 's|/opt/Яндекс Музыка|/opt/yandex-music|g' "${pkgdir}/usr/share/applications/yandexmusic.desktop"
43
44
# Localize Cyrillic name
45
sed -i 's|Name=Яндекс Музыка|Name=Yandex Music\nName[ru]=Яндекс Музыка|g' "${pkgdir}/usr/share/applications/yandexmusic.desktop"
46
47
# Change StartupWMClass to package name from package.json in app.asar
48
sed -i 's|StartupWMClass=Яндекс Музыка|StartupWMClass=YandexMusic|g' "${pkgdir}/usr/share/applications/yandexmusic.desktop"
49
50
# Fix menu category
51
sed -i 's|Categories=Audio;|Categories=AudioVideo;Audio;|g' "${pkgdir}/usr/share/applications/yandexmusic.desktop"
52
53
# Fix GTK version error for Gnome users
54
sed -i 's|Exec="/opt/yandex-music/yandexmusic"|Exec="/opt/yandex-music/yandexmusic" --gtk-version=3|' "${pkgdir}/usr/share/applications/yandexmusic.desktop"
55
56
install -Dm644 "${pkgdir}/opt/yandex-music/LICENSE.electron.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
57
install -Dm644 "${pkgdir}/opt/yandex-music/LICENSES.chromium.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
58
59
# add to the $PATH
60
install -dm755 "${pkgdir}/usr/bin"
61
ln -s "/opt/yandex-music/yandexmusic" "${pkgdir}/usr/bin/yandex-music"
62
}
63
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |