yesplaymusic-axuanran-bin

maintainer axuanran · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt pacman archive from a GitHub release without source code or build steps, making the binary unverifiable; while GitHub is generally trusted, the lack of transparency in the binary origin creates a supply-chain risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt pacman archive from a GitHub release without source code or build steps, making the binary unverifiable; while GitHub is generally trusted, the lack of transparency in the binary origin creates a supply-chain risk.

PKGBUILD

      1# Maintainer: YesPlayMusic contributors
    
      2
    
      3pkgname=yesplaymusic-axuanran-bin
    
      4pkgver=0.1.1_alpha.8
    
      5pkgrel=1
    
      6_releasever=0.1.1-alpha.8
    
      7pkgdesc="A third-party Netease Cloud Music player"
    
      8arch=('x86_64')
    
      9url="https://github.com/axuanran/YesPlayMusic"
    
      10license=('MIT')
    
      11provides=('yesplaymusic')
    
      12conflicts=(
    
      13    'yesplaymusic'
    
      14    'yesplaymusic-bin'
    
      15    'yesplaymusic-electron'
    
      16    'yesplaymusic-git'
    
      17)
    
      18depends=(
    
      19    'alsa-lib'
    
      20    'gtk3'
    
      21    'libxss'
    
      22    'nss'
    
      23)
    
      24optdepends=(
    
      25    'libnotify: desktop notifications'
    
      26    'libayatana-appindicator: system tray support'
    
      27    'xdg-utils: open URLs with default browser'
    
      28)
    
      29options=('!strip' '!debug')
    
      30source=(
    
      31    "YesPlayMusic-${_releasever}.pacman::${url}/releases/download/v${_releasever}/YesPlayMusic-${_releasever}.pacman"
    
      32    "LICENSE-${_releasever}::https://raw.githubusercontent.com/axuanran/YesPlayMusic/v${_releasever}/LICENSE"
    
      33)
    
      34sha256sums=('b05c3e611b27ee4bcf71d7416f1bc268b777bb053bff81aed9aa978923087978'
    
      35            'c33378c6fd12e6d040cedd06dc0d1bedfca74fd66bc46cc2cf10cc10e0906be6')
    
      36
    
      37package() {
    
      38    tar -xf "YesPlayMusic-${_releasever}.pacman" -C "$pkgdir"
    
      39
    
      40    rm -f "$pkgdir"/.{PKGINFO,MTREE,INSTALL}
    
      41
    
      42    install -dm755 "$pkgdir/usr/bin"
    
      43    ln -sf '/opt/YesPlayMusic/yesplaymusic' "$pkgdir/usr/bin/yesplaymusic"
    
      44
    
      45    chmod 4755 "$pkgdir/opt/YesPlayMusic/chrome-sandbox"
    
      46
    
      47    sed -i 's|Categories=Music;|Categories=Music;AudioVideo;Player;|' \
    
      48        "$pkgdir/usr/share/applications/yesplaymusic.desktop"
    
      49
    
      50    install -Dm644 "$srcdir/LICENSE-${_releasever}" \
    
      51        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      52}
    
      53

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,9 +1,9 @@
 # Maintainer: YesPlayMusic contributors
 
 pkgname=yesplaymusic-axuanran-bin
-pkgver=0.1.1_alpha.6
+pkgver=0.1.1_alpha.8
 pkgrel=1
-_releasever=0.1.1-alpha.6
+_releasever=0.1.1-alpha.8
 pkgdesc="A third-party Netease Cloud Music player"
 arch=('x86_64')
 url="https://github.com/axuanran/YesPlayMusic"
@@ -31,7 +31,7 @@
     "YesPlayMusic-${_releasever}.pacman::${url}/releases/download/v${_releasever}/YesPlayMusic-${_releasever}.pacman"
     "LICENSE-${_releasever}::https://raw.githubusercontent.com/axuanran/YesPlayMusic/v${_releasever}/LICENSE"
 )
-sha256sums=('b0ae87dd7fe325d7c019831819605d607cbc892edb20020062b8ed145e12858e'
+sha256sums=('b05c3e611b27ee4bcf71d7416f1bc268b777bb053bff81aed9aa978923087978'
             'c33378c6fd12e6d040cedd06dc0d1bedfca74fd66bc46cc2cf10cc10e0906be6')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 09:17:30	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 07:10:52	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 15:39:03	MEDIUM	2
2026-07-28 09:37:42	LOW	2
2026-07-28 07:37:32	LOW	2