Flatsonar

Vynody

by axel10

Local music player with synced lyrics, tag editing and remote libraries

Dangerous permissions Suspicious publisher GPL-3.0-or-later v2.9.0

Support the creators

Flatsonar is just the shop window. The people below made Vynody.

Screenshot 1 of Vynody Screenshot 2 of Vynody Screenshot 3 of Vynody Screenshot 4 of Vynody Screenshot 5 of Vynody Screenshot 6 of Vynody

About

This is a community package of Vynody, maintained independently and unaffiliated with the Vynody project. It repackages the official upstream Linux release build unmodified. Vynody is a cross-platform music player built with Flutter over a native Rust audio core. It is built around your own files: it scans local folders into a media library, plays them, and fills in what the tags are missing. - Local media library with folder scanning, incremental updates on change, and browsing by album, artist and song. - Synced lyrics: search and cache from LRCLIB, adjust the timeline by hand, or have a configured AI provider generate and translate them. - Tag completion through audio fingerprinting against AcoustID and MusicBrainz, plus a built-in tag editor — useful for libraries assembled from mixed sources. - Song recognition from the audio itself. - Remote libraries: stream from a Navidrome server or WebDAV storage, where track metadata is read without downloading the whole file first. - Lyric and music file sharing with other devices on the same local network. - Sleep timer, audio spectrum and waveform views, and cover-art colour extraction. Permissions: this package grants display, GPU, audio, network access, MPRIS, the StatusNotifier tray, the host Secret Service for saved server and AI-provider credentials, mDNS through Avahi for local-network sharing, and your XDG music directory. The library database, lyric cache, artwork and settings stay inside the sandbox under ~/.var/app/io.github.axel10.vynody. No home or host filesystem access is granted. Music kept outside ~/Music is the one thing you may need to open up. Files you pick through the file chooser are handed over by the portal and work as they are; a folder added to the library needs a standing grant: - Scan a music library elsewhere: flatpak override --user --filesystem=/path/to/music:ro io.github.axel10.vynody - Write tags back to files outside the music directory (drop :ro): flatpak override --user --filesystem=/path/to/music io.github.axel10.vynody - Desktop notifications (not used by default): flatpak override --user --talk-name=org.freedesktop.Notifications io.github.axel10.vynody - Silence the tray icon and rely on MPRIS only: flatpak override --user --no-talk-name=org.kde.StatusNotifierWatcher io.github.axel10.vynody

Permissions

3 permissions weaken the sandbox. Flatsonar asks before installing.

  • wildcard own-name org.fluttertray.*: can impersonate system services
    --own-name=org.fluttertray.*
  • your keyring / saved passwords
    --talk-name=org.freedesktop.secrets
  • talks to system service org.freedesktop.Avahi
    --system-talk-name=org.freedesktop.Avahi
  • inter-process communication (needed for X11)
    --share=ipc
  • Wayland display
    --socket=wayland
  • X11 display, only when Wayland is unavailable
    --socket=fallback-x11
  • GPU acceleration
    --device=dri
  • audio
    --socket=pulseaudio
  • network
    --share=network
  • access to your music folder
    --filesystem=xdg-music
  • registers as a media player (MPRIS)
    --own-name=org.mpris.MediaPlayer2.io.github.axel10.vynody.*
  • system tray
    --talk-name=org.kde.StatusNotifierWatcher

Who publishes this

Something concrete is wrong: the id claims a namespace this repository does not own, or the build does things a build should not. Flatsonar warns twice.

  • io.github.axel10.vynody claims the io.github.axel10 namespace but is hosted by github.com/flatpark and does not build the owner's code
    publisher:namespace
  • downloads github.com at install time, after any scan has run
    source:extra-data

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.