bbb-recorder-git

maintainer Singularity · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The npm install runs on source code from the project's own GitHub repository, which is a normal part of building the package; no external or untrusted packages are installed at build time.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npm install runs on source code from the project's own GitHub repository, which is a normal part of building the package; no external or untrusted packages are installed at build time.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:135 npm install --ignore-scripts --silent --no-package-lock --no-update-notifier examples

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Severin Glöckner <severin.gloeckner@stud.htwk-leipzig,de>
2
3# Script to download BBB recordings.
4
5pkgname="bbb-recorder-git"
6pkgver=0.0.0+81
7pkgrel=3
8pkgdesc="Tool to download recordings from Big Blue Button"
9arch=("any")
10url="git+https://github.com/jibon57/bbb-recorder"
11license=("MIT")
12# 1:1 list of the debian packages in ./dependencies_check.sh.
13# But it looks more like the dependencies of chromium.
14depends=( # 'alsa-lib'
15 # 'atk'
16 # 'glibc'
17 # 'cairo'
18 # 'libcups'
19 # 'dbus'
20 # 'expat'
21 # 'fontconfig'
22 # 'gcc-libs'
23 # 'gconf'
24 # 'gdk-pixbuf2'
25 # 'glib2'
26 # 'gtk3'
27 # 'nspr'
28 # 'pango'
29 # 'gcc'
30 #'libx11'
31 #'libxcb'
32 #'libxcomposite'
33 #'libxcursor'
34 #'libxdamage'
35 #'libxext'
36 #'libxfixes'
37 #'libxi'
38 #'libxrandr'
39 #'libxrender'
40 #'libxss'
41 #'libxtst'
42 # 'ca-certificates'
43 # 'libappindicator-gtk3'
44 # 'ttf-liberation'
45 # 'nss'
46 # 'lsb-release'
47 # 'xdg-utils'
48 # 'wget'
49 'xorg-server-xvfb'
50 # 'fonts-noto'
51 )
52# Dependencies mentioned elsewhere:
53depends+=('nodejs')
54# Because it uses a hardcoded path (can be changed, see prepare function):
55depends+=('chromium')
56optdepends+=('ffmpeg: converting webm to mp4')
57makedepends=('git' 'npm')
58install=bbb-recorder.install
59source=("git+https://github.com/jibon57/bbb-recorder.git"
60 "BigBlueButton-2.3.patch::https://github.com/hooktstudios/bbb-recorder/commit/62c989d304a04fdf7aed565e729ac12f6d14848e.patch")
61sha256sums=('SKIP'
62 'f30a3949ffc46b7a02014352b0ec41c0ef08eecf6cc9e5ac53ca3639f0daeb5d')
63
64pkgver() {
65 cd "$srcdir"/bbb-recorder
66 # Currently no tags exist, using commit count.
67 echo -n 0.0.0+ && git rev-list HEAD --count
68}
69
70prepare() {
71 cd "$srcdir"/bbb-recorder
72
73 echo ""
74 echo ""
75 echo "THIS PATCH SUPPORTS BBB 2.3, BUT NOT ANYMORE BBB 2.0!"
76 echo "if needed, build again without the patch."
77 echo "Also, might fail some day after development of this software continued."
78 # (worked with commit f2520ca)
79 echo ""
80 echo ""
81
82 patch -p1 < "$srcdir"/BigBlueButton-2.3.patch
83
84 cd "$srcdir"
85
86
87 # Avoiding to install the node modules globally.
88 # Using wrappers, to call the scripts from anywhere.
89 # Let the wrappers have the same arguments like the js files,
90 # and use therefore three wrappers instead of one.
91
92 cat << EOF > bbb-recorder-export.sh
93#!/bin/bash
94
95# Script can be executed or sourced.
96
97[[ \$# -lt 1 || \$# -gt 4 ]] && help=1
98[ ! -d ~/Downloads ] && echo "Directory ~/Downloads not found!" && help=1
99[ ! -f /opt/bbb-recorder/.env ] && echo "Configuration file /opt/bbb-recorder/.env was not created. See /opt/bbb-recorder/.env.example" && help=1
100grep -s copyToPath /opt/bbb-recorder/.env | grep --quiet ~/Downloads$ && echo "The copyToPath cannot be you Downloads directory, because the video is temporarily stored there and later deleted!" && help=1
101[[ \$2 == */* ]] && echo "The filename cannot be a path!" && help=1
102[[ \${2%.webm} == *.* ]] && echo "No dots are allowed as part of the filname except for the file extension .webm!" && help=1
103
104if [[ \$help -eq 1 ]]; then
105 unset help
106 echo ''
107 echo 'Valid arguments are:'
108 echo '\$1: BBB recording link (mandatory).'
109 echo '\$2: Export file name (should be .webm at the end) or the special value MEETING_ID (default). Cannot be a path.'
110 echo '\$3: Duration of recording in seconds. 0 = real duration of recording (default).'
111 echo '\$4: Enter "true" to convert to mp4.'
112else
113 # Script would also work from any other directory as long as it has an ./.env file in it.
114 cd /opt/bbb-recorder
115
116 exec node export.js "\$@"
117fi
118EOF
119
120 sed -e "s/export.js/liveJoin.js/" \
121 -e "s/recording link/join link/" \
122 -e "s/real duration of recording/until the end of the meeting/" \
123 bbb-recorder-export.sh > bbb-recorder-livejoin.sh
124
125 cd "$srcdir"/bbb-recorder
126 # Google Chrome has a different filename than on Debain, need to change it to something else!
127 # Using chromium.
128 sed -i '/options.executablePath/ s!/usr/bin/google-chrome!/usr/bin/chromium!' \
129 export.js liveJoin.js liveRTMP.js
130}
131
132build() {
133 cd "$srcdir"/bbb-recorder
134 npm install --ignore-scripts --silent --no-package-lock --no-update-notifier
135 npm install --ignore-scripts --silent --no-package-lock --no-update-notifier examples
136 find -name package.json -exec sed -i '/_where/d' {} +
137}
138
139package() {
140 install -Dm755 bbb-recorder-export.sh "$pkgdir"/usr/bin/bbb-recorder
141
142 # AFAICT the other scripts are only usable if you adminstrate the BBB server too.
143 # install -Dm755 bbb-recorder-livejoin.sh "$pkgdir"/usr/bin/bbb-recorder-livejoin
144 # install -Dm755 bbb-recorder-broadcast.sh "$pkgdir"/usr/bin/bbb-recorder-broadcast
145
146 # Storing it together with the node modules in /opt, so that the node modules do not need to be installed globally.
147 install -Dm644 "$srcdir"/bbb-recorder/.env.example -t "$pkgdir"/opt/bbb-recorder/
148 cp -a "$srcdir"/bbb-recorder/* "$pkgdir"/opt/bbb-recorder/
149
150 # Did that already by listing them as package dependencies.
151 rm "$pkgdir"/opt/bbb-recorder/dependencies_check.sh
152
153 # Need to do that differently (like in the bbb-recorder.install script).
154 # It even seems that the namespaceing for users is not needed.
155 rm "$pkgdir"/opt/bbb-recorder/namespace_checker.sh
156
157 # Example script for usage with docker-compose, should not be used without it.
158 chmod 644 "$pkgdir"/opt/bbb-recorder/start_stream.sh
159 mv "$pkgdir"/opt/bbb-recorder/start_stream.sh "$pkgdir"/opt/bbb-recorder/docker-compose.start_stream.sh
160
161 install -dm755 "$pkgdir"/usr/share/licenses/$pkgname/
162 mv "$pkgdir"/opt/bbb-recorder/LICENSE "$pkgdir"/usr/share/licenses/$pkgname/
163}
164

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion