bbb-recorder-git
maintainer Singularity
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The npm install runs on source code from the project's own GitHub repository, which is a normal part of building the package; no external or untrusted packages are installed at build time.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npm install runs on source code from the project's own GitHub repository, which is a normal part of building the package; no external or untrusted packages are installed at build time.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:135
npm install --ignore-scripts --silent --no-package-lock --no-update-notifier examples
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Severin Glöckner <severin.gloeckner@stud.htwk-leipzig,de>
2
3
# Script to download BBB recordings.
4
5
pkgname="bbb-recorder-git"
6
pkgver=0.0.0+81
7
pkgrel=3
8
pkgdesc="Tool to download recordings from Big Blue Button"
9
arch=("any")
10
url="git+https://github.com/jibon57/bbb-recorder"
11
license=("MIT")
12
# 1:1 list of the debian packages in ./dependencies_check.sh.
13
# But it looks more like the dependencies of chromium.
14
depends=( # 'alsa-lib'
15
# 'atk'
16
# 'glibc'
17
# 'cairo'
18
# 'libcups'
19
# 'dbus'
20
# 'expat'
21
# 'fontconfig'
22
# 'gcc-libs'
23
# 'gconf'
24
# 'gdk-pixbuf2'
25
# 'glib2'
26
# 'gtk3'
27
# 'nspr'
28
# 'pango'
29
# 'gcc'
30
#'libx11'
31
#'libxcb'
32
#'libxcomposite'
33
#'libxcursor'
34
#'libxdamage'
35
#'libxext'
36
#'libxfixes'
37
#'libxi'
38
#'libxrandr'
39
#'libxrender'
40
#'libxss'
41
#'libxtst'
42
# 'ca-certificates'
43
# 'libappindicator-gtk3'
44
# 'ttf-liberation'
45
# 'nss'
46
# 'lsb-release'
47
# 'xdg-utils'
48
# 'wget'
49
'xorg-server-xvfb'
50
# 'fonts-noto'
51
)
52
# Dependencies mentioned elsewhere:
53
depends+=('nodejs')
54
# Because it uses a hardcoded path (can be changed, see prepare function):
55
depends+=('chromium')
56
optdepends+=('ffmpeg: converting webm to mp4')
57
makedepends=('git' 'npm')
58
install=bbb-recorder.install
59
source=("git+https://github.com/jibon57/bbb-recorder.git"
60
"BigBlueButton-2.3.patch::https://github.com/hooktstudios/bbb-recorder/commit/62c989d304a04fdf7aed565e729ac12f6d14848e.patch")
61
sha256sums=('SKIP'
62
'f30a3949ffc46b7a02014352b0ec41c0ef08eecf6cc9e5ac53ca3639f0daeb5d')
63
64
pkgver() {
65
cd "$srcdir"/bbb-recorder
66
# Currently no tags exist, using commit count.
67
echo -n 0.0.0+ && git rev-list HEAD --count
68
}
69
70
prepare() {
71
cd "$srcdir"/bbb-recorder
72
73
echo ""
74
echo ""
75
echo "THIS PATCH SUPPORTS BBB 2.3, BUT NOT ANYMORE BBB 2.0!"
76
echo "if needed, build again without the patch."
77
echo "Also, might fail some day after development of this software continued."
78
# (worked with commit f2520ca)
79
echo ""
80
echo ""
81
82
patch -p1 < "$srcdir"/BigBlueButton-2.3.patch
83
84
cd "$srcdir"
85
86
87
# Avoiding to install the node modules globally.
88
# Using wrappers, to call the scripts from anywhere.
89
# Let the wrappers have the same arguments like the js files,
90
# and use therefore three wrappers instead of one.
91
92
cat << EOF > bbb-recorder-export.sh
93
#!/bin/bash
94
95
# Script can be executed or sourced.
96
97
[[ \$# -lt 1 || \$# -gt 4 ]] && help=1
98
[ ! -d ~/Downloads ] && echo "Directory ~/Downloads not found!" && help=1
99
[ ! -f /opt/bbb-recorder/.env ] && echo "Configuration file /opt/bbb-recorder/.env was not created. See /opt/bbb-recorder/.env.example" && help=1
100
grep -s copyToPath /opt/bbb-recorder/.env | grep --quiet ~/Downloads$ && echo "The copyToPath cannot be you Downloads directory, because the video is temporarily stored there and later deleted!" && help=1
101
[[ \$2 == */* ]] && echo "The filename cannot be a path!" && help=1
102
[[ \${2%.webm} == *.* ]] && echo "No dots are allowed as part of the filname except for the file extension .webm!" && help=1
103
104
if [[ \$help -eq 1 ]]; then
105
unset help
106
echo ''
107
echo 'Valid arguments are:'
108
echo '\$1: BBB recording link (mandatory).'
109
echo '\$2: Export file name (should be .webm at the end) or the special value MEETING_ID (default). Cannot be a path.'
110
echo '\$3: Duration of recording in seconds. 0 = real duration of recording (default).'
111
echo '\$4: Enter "true" to convert to mp4.'
112
else
113
# Script would also work from any other directory as long as it has an ./.env file in it.
114
cd /opt/bbb-recorder
115
116
exec node export.js "\$@"
117
fi
118
EOF
119
120
sed -e "s/export.js/liveJoin.js/" \
121
-e "s/recording link/join link/" \
122
-e "s/real duration of recording/until the end of the meeting/" \
123
bbb-recorder-export.sh > bbb-recorder-livejoin.sh
124
125
cd "$srcdir"/bbb-recorder
126
# Google Chrome has a different filename than on Debain, need to change it to something else!
127
# Using chromium.
128
sed -i '/options.executablePath/ s!/usr/bin/google-chrome!/usr/bin/chromium!' \
129
export.js liveJoin.js liveRTMP.js
130
}
131
132
build() {
133
cd "$srcdir"/bbb-recorder
134
npm install --ignore-scripts --silent --no-package-lock --no-update-notifier
135
npm install --ignore-scripts --silent --no-package-lock --no-update-notifier examples
136
find -name package.json -exec sed -i '/_where/d' {} +
137
}
138
139
package() {
140
install -Dm755 bbb-recorder-export.sh "$pkgdir"/usr/bin/bbb-recorder
141
142
# AFAICT the other scripts are only usable if you adminstrate the BBB server too.
143
# install -Dm755 bbb-recorder-livejoin.sh "$pkgdir"/usr/bin/bbb-recorder-livejoin
144
# install -Dm755 bbb-recorder-broadcast.sh "$pkgdir"/usr/bin/bbb-recorder-broadcast
145
146
# Storing it together with the node modules in /opt, so that the node modules do not need to be installed globally.
147
install -Dm644 "$srcdir"/bbb-recorder/.env.example -t "$pkgdir"/opt/bbb-recorder/
148
cp -a "$srcdir"/bbb-recorder/* "$pkgdir"/opt/bbb-recorder/
149
150
# Did that already by listing them as package dependencies.
151
rm "$pkgdir"/opt/bbb-recorder/dependencies_check.sh
152
153
# Need to do that differently (like in the bbb-recorder.install script).
154
# It even seems that the namespaceing for users is not needed.
155
rm "$pkgdir"/opt/bbb-recorder/namespace_checker.sh
156
157
# Example script for usage with docker-compose, should not be used without it.
158
chmod 644 "$pkgdir"/opt/bbb-recorder/start_stream.sh
159
mv "$pkgdir"/opt/bbb-recorder/start_stream.sh "$pkgdir"/opt/bbb-recorder/docker-compose.start_stream.sh
160
161
install -dm755 "$pkgdir"/usr/share/licenses/$pkgname/
162
mv "$pkgdir"/opt/bbb-recorder/LICENSE "$pkgdir"/usr/share/licenses/$pkgname/
163
}
164
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |