yetease-music-bin

LOW

maintainer czyt 0 votes scanned 2026-10-24 05:39:24.161025

View on AUR

Why flagged

The package downloads a prebuilt Debian package from the project's official GitHub releases, which is then extracted; while the binary nature of the source introduces supply-chain risk, it comes from a trusted project host with verifiable checksum, and no obfuscated or remote code execution is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt Debian package from the project's official GitHub releases, which is then extracted; while the binary nature of the source introduces supply-chain risk, it comes from a trusted project host with verifiable checksum, and no obfuscated or remote code execution is present.

PKGBUILD

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=yetease-music-bin
    
      3pkgver=0.2.3
    
      4pkgrel=1
    
      5pkgdesc="A fast, clean third-party NetEase Cloud Music client — Rust core × Flutter UI (Linux-first)"
    
      6arch=(x86_64)
    
      7url="https://github.com/Gloridust/YetEaseMusic"
    
      8license=(MIT)
    
      9depends=(gtk3 alsa-lib ca-certificates)
    
      10provides=(yetease-music)
    
      11conflicts=(yetease-music)
    
      12options=(!strip !debug)
    
      13
    
      14_deb="yetease-music_${pkgver}_amd64.deb"
    
      15source_x86_64=("${_deb}::https://github.com/Gloridust/YetEaseMusic/releases/download/v${pkgver}/${_deb}")
    
      16sha256sums_x86_64=('3149e707e1e8c60011aaad9f9d0a81835e883139140dc39795c5dbb1309ce346')
    
      17noextract=("${_deb}")
    
      18
    
      19package() {
    
      20    # Dynamic member lookup: do not assume a fixed compression format
    
      21    bsdtar -xOf "${srcdir}/${_deb}" "data.tar.*" |
    
      22        bsdtar --no-same-owner -xf - -C "${pkgdir}"
    
      23
    
      24    # Upstream ships the license as a Debian copyright file
    
      25    install -Dm644 "${pkgdir}/usr/share/doc/yetease-music/copyright" \
    
      26        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 05:39:24	Low	2