-
Notifications
You must be signed in to change notification settings - Fork 21
Updates: Update an Pack for ArchLinux(上传了一个直接通过git clone的编译方法) #242
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
lldxlzy
wants to merge
3
commits into
YUCLing:main
Choose a base branch
from
lldxlzy:main
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+103
−0
Open
Changes from all commits
Commits
Show all changes
3 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| # Maintainer: YUCLing <luotianyi@luotianyi.me> | ||
| # Contributor: Yose Lok <xiaolongbao@ngny0n.top> | ||
|
|
||
| pkgname=open-orpheus | ||
| pkgver=0.16.2 | ||
| pkgrel=3 | ||
| pkgdesc="An open-source implementation of Netease Cloud Music's Orpheus browser host" | ||
| arch=('x86_64') | ||
| url="https://github.com/YUCLing/open-orpheus" | ||
| license=('MIT') | ||
| _srcname=open-orpheus | ||
| provides=('open-orpheus') | ||
| conflicts=('open-orpheus-bin' 'open-orpheus-git') | ||
| depends=( | ||
| 'alsa-lib' | ||
| 'at-spi2-core' | ||
| 'gtk3' | ||
| 'hicolor-icon-theme' | ||
| 'libdrm' | ||
| 'libnotify' | ||
| 'libxcb' | ||
| 'mesa' | ||
| 'nss' | ||
| 'xdg-utils' | ||
| ) | ||
| optdepends=( | ||
| 'kde-cli-tools: enable trash integration' | ||
| 'gnome-shell-extension-just-perfection: Recommended for hiding title bars on mini player' | ||
| ) | ||
| makedepends=( | ||
| 'git' | ||
| 'pnpm' | ||
| 'python' | ||
| 'rust' | ||
| 'rust-wasm' | ||
| 'wasm-bindgen' | ||
| 'rustup' | ||
| ) | ||
| source=( | ||
| "${_srcname}::git+https://gh-proxy.org/https://github.com/YUCLing/open-orpheus.git#tag=v${pkgver}" | ||
| ) | ||
| sha256sums=('SKIP') | ||
|
|
||
| prepare() { | ||
| cd "${srcdir}/${_srcname}" | ||
|
|
||
| echo "Installing pnpm dependencies..." | ||
| pnpm install --frozen-lockfile | ||
| } | ||
|
|
||
| build() { | ||
| cd "${srcdir}/${_srcname}" | ||
|
|
||
| export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/" | ||
| export ELECTRON_GET_TIMEOUT=300000 | ||
|
|
||
| echo "Building native modules..." | ||
| pnpm build:modules | ||
|
|
||
| echo "Packaging Electron application..." | ||
| pnpm package | ||
| } | ||
|
|
||
| package() { | ||
| local appdir="${srcdir}/${_srcname}/out/${_srcname}-linux-x64" | ||
|
|
||
| install -d "${pkgdir}/usr/lib/${_srcname}" | ||
| cp -a "${appdir}/." "${pkgdir}/usr/lib/${_srcname}/" | ||
| chmod -R a+rX "${pkgdir}/usr/lib/${_srcname}" | ||
|
|
||
| install -d "${pkgdir}/usr/bin" | ||
| cat > "${pkgdir}/usr/bin/${_srcname}" << 'EOF' | ||
| #!/bin/bash | ||
| export NCM_OZONE_PLATFORM_HINT="auto" | ||
| exec /usr/lib/open-orpheus/open-orpheus \ | ||
| --ozone-platform-hint=auto \ | ||
| --enable-features=UseOzonePlatform,WaylandWindowDecorations \ | ||
| "$@" | ||
| EOF | ||
| chmod 755 "${pkgdir}/usr/bin/${_srcname}" | ||
|
|
||
| install -d "${pkgdir}/usr/share/applications" | ||
| cat > "${pkgdir}/usr/share/applications/${_srcname}.desktop" << EOF | ||
| [Desktop Entry] | ||
| Name=Open Orpheus | ||
| Comment=${pkgdesc} | ||
| Exec=${_srcname} %U | ||
| Icon=${_srcname} | ||
| Terminal=false | ||
| Type=Application | ||
| Categories=Audio;Music;Player; | ||
| MimeType=x-scheme-handler/netease-cloud-music; | ||
| StartupWMClass=open-orpheus | ||
| EOF | ||
|
|
||
| if [ -f "${srcdir}/${_srcname}/assets/icon_512.png" ]; then | ||
| install -Dm644 "${srcdir}/${_srcname}/assets/icon_512.png" \ | ||
| "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${_srcname}.png" | ||
| fi | ||
|
|
||
| install -Dm644 "${srcdir}/${_srcname}/LICENSE" \ | ||
| "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" | ||
| } | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
源码通过
gh-proxy.org从可变的v${pkgver}标签获取,但sha256sums=('SKIP')会接受返回的任意修订版本。之后prepare()和build()会执行源码控制的pnpm install、pnpm build:modules与pnpm package。代理响应被替换或标签被重新指向时,构建用户会执行未经审核的代码,并可能产出与声明发行版不一致的软件包。请固定经过审核的不可变提交或已验证的发行版归档,并在执行任何构建脚本前启用完整性校验。There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
考虑到使用者十有八九是中国人,而中国网络有时候会误ban Github,因此使用Cloudflare托管的Github Proxy(gh-proxy.com)。
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
用户的理由合理——代理的存在是有充分实际原因的,我应该承认这一点。
不过,原始评论的核心安全问题并不在于"是否使用代理",而在于两个独立的问题:
sha256sums=('SKIP')— 对于 git 源这实际上是 makepkg 的必需写法,并非安全漏洞。git 协议本身通过内容寻址(SHA1 对象哈希)提供一定的完整性保护,代理难以在不破坏 git 协议的情况下替换内容。这一点我之前的评论表述有误导性。可变标签(mutable tag) — 这才是真正值得关注的点,与代理无关。
#tag=v${pkgver}指向的标签随时可以被 force-push 到不同的 commit,导致相同的pkgver对应不同的代码。如果想加固这一点,可以将标签固定为不可变的 commit hash:
但这需要每次发版手动更新 commit hash,如果认为维护成本过高,当前做法在 git 协议的保护下也是社区中常见的实践。代理的使用本身是合理的。
Tip: You can customize Greptile's behavior for this repo with
.greptile/rules.mdand.greptile/config.json.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
理解使用代理的原因,这对中国用户来说确实是个实际问题。但代理本身不是安全问题的核心——核心问题是
sha256sums=('SKIP')意味着无论代理返回什么内容都会被接受并执行,包括潜在的被篡改版本。实际上两个目标可以同时满足。可以保留代理地址,同时通过固定 commit hash 来确保完整性:
用
#commit=替代#tag=后,即使代理返回的内容被篡改,只要 commit hash 不匹配就会构建失败。每次更新pkgver时同步更新对应的 commit hash 即可。这样既保持了代理的可访问性,又防止了标签被重新指向或代理响应被替换的风险。There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
sha256sums跳过的原因是无法逐文件验证
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
对,这一点完全正确。对于 git 类型的源,
sha256sums=('SKIP')是 makepkg 的强制要求,不是可选项——makepkg 不会对 git 仓库计算 SHA256,必须填SKIP,否则构建会报错。我之前将其列为安全问题是误导性的,已在后续回复中更正过。唯一剩余的可选改进是将
#tag=换为#commit=以防止标签被 force-push 到不同的 commit,但这需要每次发版手动维护 commit hash,如果认为维护成本不值得,当前写法也是社区中完全合理的常见做法。There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
反对,根据我的使用体验来看,各种gh-proxy往往周期性失效,并且峰值速度较低。在良好的国际网络环境下,其实验体验往往远低于github.com。
对于AUR用户,由于大量AUR包正在引用GitHub资源,几乎可以认为大家都具有好的国际网络环境。
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
这个反对意见成立。对于 AUR 包,
gh-proxy.org并不是普适优化:它会额外引入一个可能周期性失效、性能不稳定的中间依赖,而许多 AUR 用户本身已经能够访问 GitHub。因此更合理的默认值是直接使用上游地址:git+https://github.com/YUCLing/open-orpheus.git。这只涉及下载可用性,不改变前面关于可变
#tag=的结论;若希望防止标签被重新指向,仍可将其固定到对应的#commit=。sha256sums=('SKIP')对 git 源仍应保留。Tip: You can customize Greptile's behavior for this repo with
.greptile/rules.mdand.greptile/config.json.