yesplaymusic-plus

maintainer zmr233 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The external downloads are npm registry requests for build dependencies via yarn, using a mirror for performance; they do not execute untrusted code or install prebuilt binaries from swappable hosts.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The external downloads are npm registry requests for build dependencies via yarn, using a mirror for performance; they do not execute untrusted code or install prebuilt binaries from swappable hosts.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:69 response=$(curl -s --noproxy ip-api.com --max-time 2 http://ip-api.com/json)
PKGBUILD:76 response=$(curl -s --max-time 2 http://ip-api.com/json)
PKGBUILD:83 response=$(curl -s --noproxy ipinfo.io --max-time 2 http://ipinfo.io/json)
PKGBUILD:90 response=$(curl -s --max-time 2 http://ipinfo.io/json)

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: zmr233 <zmr_233@outlook.com>
    
      2# Contributor and Ahthor: qier22 <qier222@outlook.com>
    
      3
    
      4# Refer to https://aur.archlinux.org/packages/yesplaymusic-git
    
      5# 参考了如上AUR包的PKGBUILD文件以使用系统electron
    
      6
    
      7_pkgname=yesplaymusic
    
      8pkgname=yesplaymusic-plus
    
      9pkgver=0.4.10
    
      10pkgrel=1
    
      11pkgdesc="A third-party music player for Netease Music"
    
      12arch=('x86_64')
    
      13url="https://github.com/qier222/YesPlayMusic"
    
      14license=('MIT')
    
      15provides=("${_pkgname}=${pkgver}")
    
      16
    
      17# _electronversion=33 无法确保系统中有对应版本的electron，故使用系统中的electron
    
      18_nodeversion=16
    
      19
    
      20conflicts=(
    
      21    "my-yesplaymusic-bin"
    
      22    "r3playx-bin"
    
      23    "r3playx-git"
    
      24    "yesplaymusic"
    
      25    "yesplaymusic-appimage"
    
      26    "yesplaymusic-bin"
    
      27    "yesplaymusic-electron"
    
      28    "yesplaymusic-git"
    
      29    "yesplaymusic-new"
    
      30    "yesplaymusicosd-origin-electron-git"
    
      31    "yesplaymusicosd-origin-git"
    
      32)
    
      33
    
      34depends=(
    
      35    "electron"
    
      36)
    
      37
    
      38makedepends=(
    
      39    'jq'
    
      40    'npm'
    
      41    'nvm'
    
      42    'git'
    
      43    'curl'
    
      44    'yarn'
    
      45    'gcc'
    
      46    'python-setuptools'
    
      47)
    
      48
    
      49source=("$pkgname-$pkgver.tar.gz::https://github.com/qier222/YesPlayMusic/archive/refs/tags/v$pkgver.tar.gz"
    
      50        "$pkgname.desktop"
    
      51        "$pkgname.sh")
    
      52
    
      53sha256sums=('819caa59ebde11eb4e3a56e4c95e233c9245f1a707999e86d193b8d3609856cf'
    
      54            '2c70ded5b08d349db110f2fc80f8aa6b7dc8f6945b576c5c3324404fb8fbe55b'
    
      55            '8022475183b04d8c04168ff32aaa6d749e65ba1bf6966867b49982baa2953661'
    
      56)
    
      57
    
      58_ensure_local_nvm() {
    
      59    local NVM_DIR="${srcdir}/.nvm"
    
      60    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      61    nvm install "${_nodeversion}"
    
      62    nvm use "${_nodeversion}"
    
      63}
    
      64
    
      65# 获取国家代码
    
      66_get_country_code() {
    
      67    local response
    
      68    # 尝试不使用代理
    
      69    response=$(curl -s --noproxy ip-api.com --max-time 2 http://ip-api.com/json)
    
      70    if [[ $? -eq 0 && -n "$response" ]]; then
    
      71        echo "$response" | jq -r .countryCode
    
      72        return 0
    
      73    fi
    
      74
    
      75    # 尝试使用代理
    
      76    response=$(curl -s --max-time 2 http://ip-api.com/json)
    
      77    if [[ $? -eq 0 && -n "$response" ]]; then
    
      78        echo "$response" | jq -r .countryCode
    
      79        return 0
    
      80    fi
    
      81
    
      82    # 尝试备用服务不使用代理
    
      83    response=$(curl -s --noproxy ipinfo.io --max-time 2 http://ipinfo.io/json)
    
      84    if [[ $? -eq 0 && -n "$response" ]]; then
    
      85        echo "$response" | jq -r .country
    
      86        return 0
    
      87    fi
    
      88
    
      89    # 尝试备用服务使用代理
    
      90    response=$(curl -s --max-time 2 http://ipinfo.io/json)
    
      91    if [[ $? -eq 0 && -n "$response" ]]; then
    
      92        echo "$response" | jq -r .country
    
      93        return 0
    
      94    fi
    
      95
    
      96    # 如果所有方法都失败，返回空并发出警告
    
      97    echo "Failed to retrieve country code from all services." >&2
    
      98    return 1
    
      99}
    
      100
    
      101prepare() {
    
      102    export SYSTEM_ELECTRON_VERSION="$(electron -v | sed 's/v//g')"
    
      103    # 检查最低electron版本
    
      104    if [[ $(vercmp "$SYSTEM_ELECTRON_VERSION" "13.0.0") -lt 0 ]]; then
    
      105        echo "Error: Electron version 13.0.0 or higher is required."
    
      106        exit 1
    
      107    fi
    
      108}
    
      109
    
      110build() {
    
      111    # 设置启动脚本
    
      112    #  不再特殊指定版本 => 使用系统中的electron
    
      113    sed -e "
    
      114        s/@electronversion@//g 
    
      115        s/@appname@/${_pkgname}/g
    
      116        s/@runname@/app.asar/g
    
      117        s/@cfgdirname@/${_pkgname}/g
    
      118        s/@options@//g
    
      119    " -i "${srcdir}/${pkgname}.sh"
    
      120
    
      121    # 设置构建node版本
    
      122    _ensure_local_nvm
    
      123    cd "$srcdir/YesPlayMusic-$pkgver"
    
      124
    
      125    # 设置系统electron版本
    
      126    
    
      127    HOME="${srcdir}/.electron-gyp"
    
      128    mkdir -p "${srcdir}/.electron-gyp"
    
      129
    
      130    # 获取国家代码
    
      131    countryCode=$(_get_country_code)
    
      132
    
      133    if [[ "$countryCode" == "CN" ]]; then
    
      134        echo "Using mirror in China"
    
      135        {
    
      136            echo -e '\n'
    
      137            echo 'registry "https://repo.nju.edu.cn/repository/npm/"'
    
      138            echo 'electron_mirror "https://registry.npmmirror.com/-/binary/electron/"'
    
      139            echo 'electron_builder_binaries_mirror "https://registry.npmmirror.com/-/binary/electron-builder-binaries/"'
    
      140            echo "cacheFolder \"${srcdir}/.yarn/cache\""
    
      141            echo "pluginsFolder \"${srcdir}/.yarn/plugins\""
    
      142            echo "globalFolder \"${srcdir}/.yarn/global\""
    
      143            echo 'useHardlinks true'
    
      144            #echo 'buildFromSource true'
    
      145            echo 'linkWorkspacePackages true'
    
      146            echo 'fetchRetries 3'
    
      147            echo 'fetchRetryTimeout 10000'
    
      148        } >> .yarnrc
    
      149        find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g;s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
      150    elif [[ -z "$countryCode" ]]; then
    
      151        echo "Empty countryCode from ip-api.com and ipinfo.io"
    
      152    elif [[ $? -ne 0 ]]; then
    
      153        echo "Failed to retrieve country code from all services. Proceeding without proxy settings."
    
      154    else 
    
      155        echo "No proxy"
    
      156    fi
    
      157
    
      158    # 设置较高并发数
    
      159    yarn config set network-concurrency 16
    
      160
    
      161    sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
      162
    
      163    # 添加 homepage 字段到 package.json
    
      164    sed -i 's/"name": "yesplaymusic"/"name": "yesplaymusic", "homepage": "https:\/\/github.com\/qier222\/YesPlayMusic"/' package.json
    
      165    
    
      166    # 更换版本号
    
      167    sed -i "s/\"version\": \".*\"/\"version\": \"$pkgver\"/" package.json
    
      168    
    
      169    # 设置网易云API
    
      170    cp .env.example .env
    
      171
    
      172    NODE_ENV=development    yarn install --cache-folder "${srcdir}/.yarn_cache" --ignore-optional
    
      173    NODE_ENV=development    yarn add --ignore-platform --ignore-optional \
    
      174                                @unblockneteasemusic/rust-napi-linux-x64-gnu@0.4.0 \
    
      175                                @unblockneteasemusic/rust-napi-linux-arm64-gnu@0.4.0 \
    
      176                                @unblockneteasemusic/rust-napi-linux-arm-gnueabihf@0.4.0 \
    
      177                                utf-8-validate
    
      178    NODE_ENV=production     yarn run electron:build-linux --dir
    
      179}
    
      180
    
      181package() {
    
      182  cd "$srcdir/YesPlayMusic-$pkgver"
    
      183
    
      184  # 安装主程序
    
      185  install -Dm644 "dist_electron/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${_pkgname}"
    
      186
    
      187  # 安装启动脚本
    
      188  install -Dm755 "$srcdir/$pkgname.sh" "$pkgdir/usr/bin/$_pkgname"
    
      189
    
      190  # 安装桌面条目和图标
    
      191  install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      192  for size in 16 32 48 64 128 256 512; do
    
      193    install -Dm644 "build/icons/${size}x${size}.png" "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$_pkgname.png"
    
      194  done
    
      195
    
      196  # 安装许可证
    
      197  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      198}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2