collabora-office
LOW
maintainer rash419
6 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package builds from source hosted on GitHub (project's own repository) and downloads prebuilt assets from GitHub and the official collaboraoffice.com domain; the latter two are legitimate for branding and core assets, posing no execution risk beyond normal build processes.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on GitHub (project's own repository) and downloads prebuilt assets from GitHub and the official collaboraoffice.com domain; the latter two are legitimate for branding and core assets, posing no execution risk beyond normal build processes.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:56
"https://www.collaboraoffice.com/downloads/collabora-office-brand/collabora-office-brand-26.04.2.1.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Rashesh Padia
2
pkgname=collabora-office
3
pkgver=26.04.2.1
4
pkgrel=1
5
_source_tag=cp-26.04.2-1
6
_source_dir=online.mirror-${_source_tag}
7
pkgdesc='Collabora Office - Qt6 desktop document editor powered by Collabora Online'
8
arch=('x86_64')
9
url='https://collaboraoffice.com'
10
license=('MPL-2.0')
11
depends=(
12
'qt6-base'
13
'qt6-webengine'
14
'qt6-declarative'
15
'qt6-websockets'
16
'dbus'
17
'fontconfig'
18
'libcap'
19
'libpng'
20
'nspr'
21
'nss'
22
'openssl'
23
'pam'
24
'poco'
25
'zlib'
26
'zstd'
27
'hicolor-icon-theme'
28
)
29
makedepends=(
30
'git'
31
'autoconf'
32
'automake'
33
'libtool'
34
'pkgconf'
35
'qt6-tools'
36
'cppunit'
37
'python'
38
'python-lxml'
39
'python-polib'
40
'nodejs'
41
'npm'
42
'rsync'
43
)
44
optdepends=(
45
'hunspell-en_us: English spell checking'
46
'hyphen-en: English hyphenation'
47
'noto-fonts: Noto font family'
48
'noto-fonts-cjk: CJK font support'
49
'ttf-liberation: Liberation fonts for document compatibility'
50
'ttf-dejavu: DejaVu fonts'
51
)
52
options=('!strip' '!debug')
53
source=(
54
"online-${_source_tag}.tar.gz::https://github.com/CollaboraOnline/online.mirror/archive/refs/tags/${_source_tag}.tar.gz"
55
"https://github.com/Rash419/collabora-core-assets/releases/download/cp-26.04.2-1/core-co-26.04-assets.tar.gz"
56
"https://www.collaboraoffice.com/downloads/collabora-office-brand/collabora-office-brand-26.04.2.1.tar.gz"
57
)
58
sha256sums=('7701031ffd4736e55658dd371b2e42d9f0dc262628398536f0d3d960926cfdd5'
59
'fb91e40eaa52cbfc824f2a1d62b3f87093567284d1f22a5979415e0623afb6c8'
60
'321112b8f29d338ca9530dc604448c9eb465c4f9308468722f16a95fc6f830a8')
61
62
build() {
63
cd "$_source_dir"
64
65
./autogen.sh
66
67
./configure \
68
--prefix=/usr \
69
--enable-qtapp \
70
--disable-ssl \
71
--disable-werror \
72
--disable-tests \
73
--with-lokit-path="$srcdir/include" \
74
--with-lo-path=/usr/lib/collabora-office
75
76
# npm 12 dropped npm-shrinkwrap.json support for "npm ci" and now requires
77
# package-lock.json. configure generates browser/npm-shrinkwrap.json, so
78
# copy it to package-lock.json. This works on npm 12 and stays fine on
79
# older npm, which still reads either file.
80
cp browser/npm-shrinkwrap.json browser/package-lock.json
81
82
make
83
}
84
85
package() {
86
cd "$_source_dir"
87
make DESTDIR="$pkgdir" install
88
89
# Install pre-built Collabora Office engine runtime
90
install -d "$pkgdir/usr/lib/collabora-office"
91
cp -a "$srcdir/instdir"/* "$pkgdir/usr/lib/collabora-office/"
92
93
# License
94
install -Dm644 "$srcdir/$_source_dir/COPYING" \
95
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
96
97
# Install Collabora Office branding (online/browser UI theme and assets)
98
local _brand="$srcdir/collabora-office-brand"
99
cp -a "$_brand/online-theme" \
100
"$pkgdir/usr/lib/collabora-office/share/theme_definitions/online/"
101
cp -a "$_brand"/branding* "$_brand"/images "$_brand"/welcome \
102
"$pkgdir/usr/share/coolwsd/browser/dist/"
103
104
# Remove bundled dictionaries; the app uses system hunspell dicts
105
rm -rf "$pkgdir/usr/lib/collabora-office/share/extensions"/dict-*
106
107
# Remove bundled fonts; the app uses system fonts via fontconfig
108
rm -rf "$pkgdir/usr/lib/collabora-office/share/fonts"
109
110
# Remove server-only binaries not needed for the desktop app
111
rm -f "$pkgdir/usr/bin/coolwsd" \
112
"$pkgdir/usr/bin/coolconfig" \
113
"$pkgdir/usr/bin/coolforkit" \
114
"$pkgdir/usr/bin/coolmount"
115
}
116
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |