zuno

maintainer nofayz · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt .deb from the project's GitHub releases, which is a common and acceptable practice for AUR packages; the source is verifiable via checksum and hosts no remote code execution or obfuscation risks.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt .deb from the project's GitHub releases, which is a common and acceptable practice for AUR packages; the source is verifiable via checksum and hosts no remote code execution or obfuscation risks.

PKGBUILD

      1# Maintainer: Faizan Asad <m.faizanasad97@gmail.com>
    
      2
    
      3pkgname=zuno
    
      4pkgver=1.2.1
    
      5pkgrel=1
    
      6pkgdesc="YouTube Music as a focused desktop app — tabs, offline downloads, synced lyrics"
    
      7arch=('x86_64')
    
      8url="https://github.com/noFAYZ/zuno"
    
      9license=('Apache-2.0')
    
      10
    
      11# Mapped from the .deb's own Depends: libwebkit2gtk-4.1-0, libgtk-3-0,
    
      12# libayatana-appindicator3-1.
    
      13depends=(
    
      14  'webkit2gtk-4.1'
    
      15  'gtk3'
    
      16  'libayatana-appindicator'
    
      17)
    
      18
    
      19# Playback runs through WebKitGTK, which decodes via GStreamer. Unlike the AppImage — which
    
      20# ships its own WebKitGTK and needs its plugins bundled with it — this package uses the
    
      21# system's, so the plugins are ordinary dependencies and there is no bundle to get wrong.
    
      22# gst-libav supplies the AAC and H.264 decoding YouTube streams need; without it playback
    
      23# fails with "GStreamer element appsink not found" and player error 5.
    
      24depends+=(
    
      25  'gst-plugins-base'
    
      26  'gst-plugins-good'
    
      27  'gst-libav'
    
      28)
    
      29
    
      30optdepends=(
    
      31  'gst-plugins-bad: extra container and codec support'
    
      32  'gst-plugins-ugly: extra codec support'
    
      33  'xdg-utils: opening links and the log file from inside the app'
    
      34  'libnotify: desktop notifications'
    
      35)
    
      36
    
      37# Installs the same files as the community-maintained binary package, so the two cannot
    
      38# be installed together.
    
      39conflicts=('zuno-bin')
    
      40
    
      41# The binary is already stripped and relocation-sensitive; leave it alone.
    
      42options=('!strip' '!emptydirs')
    
      43
    
      44source=("${pkgname}-${pkgver}.deb::${url}/releases/download/v${pkgver}/Zuno_${pkgver}_amd64.deb")
    
      45sha256sums=('3abc57c1accaaf3ef68a0aa37d3b9e6e81ad9ae1a5a8216a739efeb8578c05da')
    
      46
    
      47package() {
    
      48  # bsdtar reads the ar archive and the inner tarball without needing dpkg installed.
    
      49  bsdtar -O -xf "${pkgname}-${pkgver}.deb" data.tar.gz | bsdtar -C "${pkgdir}" -xf -
    
      50
    
      51  install -Dm644 "${pkgdir}/usr/share/applications/Zuno.desktop" \
    
      52    "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      53  rm -f "${pkgdir}/usr/share/applications/Zuno.desktop"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 17:12:22	LOW	2