collabora-office-bin

LOW

maintainer rash419 0 votes scanned 2026-09-15 15:19:57.334228

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release by a maintainer; while the host is not whitelisted, it is a legitimate project source with no obfuscated downloads or remote code execution.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from a GitHub release by a maintainer; while the host is not whitelisted, it is a legitimate project source with no obfuscated downloads or remote code execution.

PKGBUILD

      1# Maintainer: Rashesh Padia
    
      2pkgname=collabora-office-bin
    
      3pkgver=26.04.3.3
    
      4pkgrel=1
    
      5_source_tag=cp-26.04.3-3
    
      6pkgdesc='Collabora Office - Qt6 desktop document editor powered by Collabora Online'
    
      7arch=('x86_64')
    
      8url='https://collaboraoffice.com'
    
      9license=('MPL-2.0')
    
      10provides=("collabora-office=${pkgver}")
    
      11conflicts=('collabora-office')
    
      12replaces=('collabora-office')
    
      13# Derived from the system-libraries.txt asset that the build publishes next to
    
      14# the payload, which lists every library the payload loads from outside itself.
    
      15# fontconfig is here for /etc/fonts and fc-cache, because the payload carries
    
      16# its own libfontconfig-lo. Everything else the engine used to link against is
    
      17# built into the payload.
    
      18depends=(
    
      19    'qt6-base'
    
      20    'qt6-declarative'
    
      21    'qt6-positioning'
    
      22    'qt6-webchannel'
    
      23    'qt6-webengine'
    
      24    'qt6-websockets'
    
      25    'fontconfig'
    
      26    'hicolor-icon-theme'
    
      27    'mpdecimal'
    
      28    'nspr'
    
      29    'nss'
    
      30    'util-linux-libs'
    
      31    'zlib'
    
      32)
    
      33optdepends=(
    
      34    'hunspell-en_us: English spell checking'
    
      35    'hyphen-en: English hyphenation'
    
      36    'ttf-carlito: metric substitute for the sans-serif font OOXML documents ask for'
    
      37    'ttf-caladea: metric substitute for the serif font OOXML documents ask for'
    
      38    'ttf-liberation: metric substitutes for Arial, Courier New and Times New Roman'
    
      39    'noto-fonts: Noto font family'
    
      40    'noto-fonts-cjk: CJK font support'
    
      41    'ttf-dejavu: DejaVu fonts'
    
      42)
    
      43options=('!strip' '!debug')
    
      44# Nothing is compiled here. The payload is built on GitHub Actions from one
    
      45# cp-26.04 monorepo tree: engine runtime, online/Qt app and branding are built
    
      46# together in an Arch Linux container and published as a single release asset.
    
      47# This package only unpacks that asset.
    
      48# https://github.com/Rash419/collabora-office-asset
    
      49source=("collabora-office-${_source_tag}-x86_64.tar.zst::https://github.com/Rash419/collabora-office-asset/releases/download/${_source_tag}/collabora-office-${_source_tag}-x86_64.tar.zst")
    
      50sha256sums=('f1830f3ac5f384d9c2e6347748a0bd967a301253dc4c8c664f0397a8639ab968')
    
      51
    
      52package() {
    
      53    cp -a "$srcdir/usr" "$pkgdir/"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-15 15:19:57	Low	2