collabora-office

maintainer rash419 · 6 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source hosted on GitHub (project's own repository) and includes a prebuilt assets bundle from a maintainer's GitHub release, which is low risk as it's non-executable branding/data; all sources are verifiable via checksums.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on GitHub (project's own repository) and includes a prebuilt assets bundle from a maintainer's GitHub release, which is low risk as it's non-executable branding/data; all sources are verifiable via checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:53 "https://www.collaboraoffice.com/downloads/collabora-office-brand/collabora-office-brand-26.04.2.1.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rashesh Padia
    
      2pkgname=collabora-office
    
      3pkgver=26.04.2.1
    
      4pkgrel=1
    
      5_source_tag=cp-26.04.2-1
    
      6_source_dir=online.mirror-${_source_tag}
    
      7pkgdesc='Collabora Office - Qt6 desktop document editor powered by Collabora Online'
    
      8arch=('x86_64')
    
      9url='https://collaboraoffice.com'
    
      10license=('MPL-2.0')
    
      11depends=(
    
      12    'qt6-base'
    
      13    'qt6-webengine'
    
      14    'qt6-declarative'
    
      15    'qt6-websockets'
    
      16    'dbus'
    
      17    'fontconfig'
    
      18    'libcap'
    
      19    'libpng'
    
      20    'openssl'
    
      21    'pam'
    
      22    'zlib'
    
      23    'zstd'
    
      24    'hicolor-icon-theme'
    
      25)
    
      26makedepends=(
    
      27    'git'
    
      28    'autoconf'
    
      29    'automake'
    
      30    'libtool'
    
      31    'pkgconf'
    
      32    'qt6-tools'
    
      33    'cppunit'
    
      34    'python'
    
      35    'python-lxml'
    
      36    'python-polib'
    
      37    'nodejs'
    
      38    'npm'
    
      39    'rsync'
    
      40)
    
      41optdepends=(
    
      42    'hunspell-en_us: English spell checking'
    
      43    'hyphen-en: English hyphenation'
    
      44    'noto-fonts: Noto font family'
    
      45    'noto-fonts-cjk: CJK font support'
    
      46    'ttf-liberation: Liberation fonts for document compatibility'
    
      47    'ttf-dejavu: DejaVu fonts'
    
      48)
    
      49options=('!strip' '!debug')
    
      50source=(
    
      51    "online-${_source_tag}.tar.gz::https://github.com/CollaboraOnline/online.mirror/archive/refs/tags/${_source_tag}.tar.gz"
    
      52    "https://github.com/Rash419/collabora-core-assets/releases/download/cp-26.04.2-1/core-co-26.04-assets.tar.gz"
    
      53    "https://www.collaboraoffice.com/downloads/collabora-office-brand/collabora-office-brand-26.04.2.1.tar.gz"
    
      54)
    
      55sha256sums=('7701031ffd4736e55658dd371b2e42d9f0dc262628398536f0d3d960926cfdd5'
    
      56            'fb91e40eaa52cbfc824f2a1d62b3f87093567284d1f22a5979415e0623afb6c8'
    
      57            '321112b8f29d338ca9530dc604448c9eb465c4f9308468722f16a95fc6f830a8')
    
      58
    
      59build() {
    
      60    cd "$_source_dir"
    
      61
    
      62    ./autogen.sh
    
      63
    
      64    ./configure \
    
      65        --prefix=/usr \
    
      66        --enable-qtapp \
    
      67        --disable-ssl \
    
      68        --disable-werror \
    
      69        --disable-tests \
    
      70        --with-lokit-path="$srcdir/include" \
    
      71        --with-lo-path=/usr/lib/collabora-office
    
      72
    
      73    make
    
      74}
    
      75
    
      76package() {
    
      77    cd "$_source_dir"
    
      78    make DESTDIR="$pkgdir" install
    
      79
    
      80    # Install pre-built Collabora Office engine runtime
    
      81    install -d "$pkgdir/usr/lib/collabora-office"
    
      82    cp -a "$srcdir/instdir"/* "$pkgdir/usr/lib/collabora-office/"
    
      83
    
      84    # License
    
      85    install -Dm644 "$srcdir/$_source_dir/COPYING" \
    
      86        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      87
    
      88    # Install Collabora Office branding (online/browser UI theme and assets)
    
      89    local _brand="$srcdir/collabora-office-brand"
    
      90    cp -a "$_brand/online-theme" \
    
      91        "$pkgdir/usr/lib/collabora-office/share/theme_definitions/online/"
    
      92    cp -a "$_brand"/branding* "$_brand"/images "$_brand"/welcome \
    
      93        "$pkgdir/usr/share/coolwsd/browser/dist/"
    
      94
    
      95    # Remove bundled dictionaries; the app uses system hunspell dicts
    
      96    rm -rf "$pkgdir/usr/lib/collabora-office/share/extensions"/dict-*
    
      97
    
      98    # Remove bundled fonts; the app uses system fonts via fontconfig
    
      99    rm -rf "$pkgdir/usr/lib/collabora-office/share/fonts"
    
      100
    
      101    # Remove server-only binaries not needed for the desktop app
    
      102    rm -f "$pkgdir/usr/bin/coolwsd" \
    
      103          "$pkgdir/usr/bin/coolconfig" \
    
      104          "$pkgdir/usr/bin/coolforkit" \
    
      105          "$pkgdir/usr/bin/coolmount"
    
      106}
    
      107

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2