yaqmc-git

LOW

maintainer Osilvfe 0 votes scanned 2026-10-17 07:17:15.137327

View on AUR

Why flagged

The package builds from the project's own git repository, uses standard build tools, and installs only the resulting application files; the low severity is due to the unverified source (SKIP'd checksum) but no evidence of malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own git repository, uses standard build tools, and installs only the resulting application files; the low severity is due to the unverified source (SKIP'd checksum) but no evidence of malicious behavior.

PKGBUILD

      1# Maintainer: Osilvfe <osilvfe@gmail.com>
    
      2
    
      3pkgname=yaqmc-git
    
      4pkgver=0.1.1.r5.gb4c6531
    
      5pkgrel=1
    
      6pkgdesc='Unofficial QQ Music client (git version)'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/YAQMC/YAQMC'
    
      9license=('GPL-3.0-or-later')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'cairo'
    
      14  'dbus'
    
      15  'expat'
    
      16  'glib2'
    
      17  'gtk3'
    
      18  'hicolor-icon-theme'
    
      19  'libcups'
    
      20  'libnotify'
    
      21  'libsecret'
    
      22  'libx11'
    
      23  'libxcb'
    
      24  'libxcomposite'
    
      25  'libxdamage'
    
      26  'libxext'
    
      27  'libxfixes'
    
      28  'libxkbcommon'
    
      29  'libxrandr'
    
      30  'libxss'
    
      31  'libxtst'
    
      32  'mesa'
    
      33  'nspr'
    
      34  'nss'
    
      35  'pango'
    
      36  'systemd-libs'
    
      37  'xdg-utils'
    
      38)
    
      39optdepends=('libayatana-appindicator: system tray support')
    
      40makedepends=(
    
      41  'git'
    
      42  'nodejs'
    
      43  'npm'
    
      44  'pkgconf'
    
      45  'python'
    
      46  'rust'
    
      47)
    
      48provides=('yaqmc')
    
      49conflicts=('yaqmc' 'yaqmc-bin')
    
      50# makepkg's default -flto=auto breaks aws-lc-sys static linking with lld.
    
      51# Cargo still applies the upstream release profile LTO settings independently.
    
      52options=('!strip' '!debug' '!lto')
    
      53source=(
    
      54  "${pkgname}::git+https://github.com/YAQMC/YAQMC.git"
    
      55  'yaqmc.desktop'
    
      56)
    
      57sha256sums=(
    
      58  'SKIP'
    
      59  '25a56522c4de0ecc762d91f43335a3ffb6e93ea8466ccbe37ed730204a76a851'
    
      60)
    
      61
    
      62pkgver() {
    
      63  cd "${pkgname}"
    
      64  git describe --long --tags --abbrev=7 | sed 's/^v//; s/\([^-]*-g\)/r\1/; s/-/./g'
    
      65}
    
      66
    
      67prepare() {
    
      68  cd "${pkgname}"
    
      69
    
      70  export npm_config_cache="${srcdir}/npm-cache"
    
      71  npm ci --engine-strict=false --no-audit --no-fund --replace-registry-host=always
    
      72
    
      73  export CARGO_HOME="${srcdir}/cargo-home"
    
      74  cargo fetch --locked
    
      75}
    
      76
    
      77build() {
    
      78  cd "${pkgname}"
    
      79
    
      80  local _electron_arch
    
      81  case "$CARCH" in
    
      82    x86_64) _electron_arch=x64 ;;
    
      83    aarch64) _electron_arch=arm64 ;;
    
      84    *) exit 1 ;;
    
      85  esac
    
      86
    
      87  export npm_config_cache="${srcdir}/npm-cache"
    
      88  export CARGO_HOME="${srcdir}/cargo-home"
    
      89  export ELECTRON_CACHE="${srcdir}/electron-cache"
    
      90  export RUSTFLAGS="${RUSTFLAGS:+${RUSTFLAGS} }--remap-path-prefix=${CARGO_HOME}=/usr/src/cargo --remap-path-prefix=${srcdir}=/usr/src/${pkgname}"
    
      91  export YAQMC_BUILD_PROFILE=production
    
      92  export CARGO_PROFILE_RELEASE_LTO=true
    
      93  export CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1
    
      94
    
      95  cargo build -p yaqmc-core --release --locked
    
      96  node scripts/stage-core.mjs --profile release
    
      97  npm run ci:frontend-build
    
      98  npm run build -w @yaqmc/desktop
    
      99
    
      100  (
    
      101    cd apps/desktop
    
      102    ../../node_modules/.bin/electron-builder \
    
      103      --projectDir . \
    
      104      --config electron-builder.yml \
    
      105      --dir "--${_electron_arch}" \
    
      106      --publish never
    
      107  )
    
      108}
    
      109
    
      110package() {
    
      111  cd "${pkgname}"
    
      112
    
      113  local _unpacked _size
    
      114  _unpacked=$(find release-electron -maxdepth 1 -type d -name '*-unpacked' -print -quit)
    
      115  if [[ -z "${_unpacked}" ]]; then
    
      116    echo 'electron-builder did not produce an unpacked application directory' >&2
    
      117    exit 1
    
      118  fi
    
      119
    
      120  install -d "${pkgdir}/opt/yaqmc"
    
      121  cp -a "${_unpacked}/." "${pkgdir}/opt/yaqmc/"
    
      122
    
      123  install -d "${pkgdir}/usr/bin"
    
      124  ln -s /opt/yaqmc/yaqmc "${pkgdir}/usr/bin/yaqmc"
    
      125
    
      126  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      127  install -Dm644 "${srcdir}/yaqmc.desktop" \
    
      128    "${pkgdir}/usr/share/applications/org.yaqmc.desktop"
    
      129
    
      130  for _size in 32x32 64x64 128x128; do
    
      131    install -Dm644 "apps/desktop/resources/${_size}.png" \
    
      132      "${pkgdir}/usr/share/icons/hicolor/${_size}/apps/yaqmc.png"
    
      133  done
    
      134  install -Dm644 apps/desktop/resources/128x128@2x.png \
    
      135    "${pkgdir}/usr/share/icons/hicolor/256x256/apps/yaqmc.png"
    
      136  install -Dm644 apps/desktop/resources/icon.png \
    
      137    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/yaqmc.png"
    
      138
    
      139  chmod 0755 "${pkgdir}/opt/yaqmc/chrome-sandbox"
    
      140}
    
      141

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 07:17:15	Low	2