droidcam-client-bin

MEDIUM

maintainer dark_witcher 0 votes scanned 2026-08-25 09:27:42.314125

View on AUR

Why flagged

The .deb binary is fetched from a non-official redirect URL (droidcam.app/go/...) with a SKIP'd checksum, making it an unverifiable prebuilt executable that could be silently swapped; the bundled helper script (droidcam-virtual-camera-helper) is also installed as an executable with no upstream provenance, compounding the supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 "droidcam_client_amd64.deb::https://droidcam.app/go/droidCam.client.setup.deb"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 72%): The .deb binary is fetched from a non-official redirect URL (droidcam.app/go/...) with a SKIP'd checksum, making it an unverifiable prebuilt executable that could be silently swapped; the bundled helper script (droidcam-virtual-camera-helper) is also installed as an executable with no upstream provenance, compounding the supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dark Witcher <archlinux.sulfide764@passmail.net>
    
      2
    
      3pkgname=droidcam-client-bin
    
      4pkgver=7.2.1
    
      5pkgrel=1
    
      6pkgdesc="DroidCam Client with bundled OBS runtime (prebuilt binary)"
    
      7arch=('x86_64')
    
      8url="https://www.dev47apps.com/"
    
      9license=('LicenseRef-Proprietary')
    
      10options=('!debug')
    
      11install=droidcam-client-bin.install
    
      12
    
      13pkgver() {
    
      14    ar p "$srcdir/droidcam_client_amd64.deb" control.tar.xz |
    
      15        tar -xJO ./control |
    
      16        sed -n 's/^Version: //p'
    
      17}
    
      18
    
      19depends=(
    
      20  'qt5-base'
    
      21  'qt5-svg'
    
      22  'qt5-wayland'
    
      23  'curl'
    
      24  'libpulse'
    
      25  'pciutils'
    
      26  'speexdsp'
    
      27  'v4l2loopback-dkms'
    
      28  'v4l2loopback-utils'
    
      29)
    
      30
    
      31source=(
    
      32  "droidcam_client_amd64.deb::https://droidcam.app/go/droidCam.client.setup.deb"
    
      33  "droidcam-virtual-camera.service"
    
      34  "droidcam-virtual-camera-helper"
    
      35)
    
      36
    
      37sha256sums=(
    
      38  'SKIP'
    
      39  'b9b5e2413e0f962bb1d33fd055fc49903b30dcb6696338fc4458dee6456c396d'
    
      40  'b617ed996389419ab4f11033ff0042a5391be179eeb29a1469f6cfa0e15a8f30'
    
      41)
    
      42
    
      43package() {
    
      44  # Extract Debian package
    
      45  ar x "$srcdir/droidcam_client_amd64.deb"
    
      46
    
      47  # Extract package payload
    
      48  local data_tar
    
      49  data_tar=$(find . -maxdepth 1 -name 'data.tar.*' -print -quit)
    
      50
    
      51  if [[ -z "$data_tar" ]]; then
    
      52    printf '%s\n' "ERROR: Could not find data.tar.* in Debian package" >&2
    
      53    return 1
    
      54  fi
    
      55
    
      56  tar -xf "$data_tar" -C "$pkgdir"
    
      57
    
      58  # Move upstream launcher to the Arch-standard location
    
      59  install -d "$pkgdir/usr/bin"
    
      60  mv "$pkgdir/usr/local/bin/droidcam" "$pkgdir/usr/bin/droidcam"
    
      61
    
      62  # Remove now-empty /usr/local hierarchy
    
      63  rmdir "$pkgdir/usr/local/bin"
    
      64  rmdir "$pkgdir/usr/local"
    
      65
    
      66  # Install DroidCam virtual camera integration
    
      67  install -Dm755 \
    
      68    "$srcdir/droidcam-virtual-camera-helper" \
    
      69    "$pkgdir/opt/droidcam-obs-client/bin/64bit/droidcam-virtual-camera-helper"
    
      70
    
      71  install -Dm644 \
    
      72    "$srcdir/droidcam-virtual-camera.service" \
    
      73    "$pkgdir/usr/lib/systemd/system/droidcam-virtual-camera.service"
    
      74
    
      75  # Provide the v4l2loopback control utility where DroidCam expects it
    
      76  ln -sf /usr/bin/v4l2loopback-ctl \
    
      77    "$pkgdir/opt/droidcam-obs-client/bin/64bit/v4l2loopback-ctl"
    
      78
    
      79  # Update desktop entry to use the Arch-standard launcher path
    
      80  sed -i \
    
      81    's#^Exec=/usr/local/bin/droidcam#Exec=/usr/bin/droidcam#' \
    
      82    "$pkgdir/usr/share/applications/com.dev47apps.droidcam.desktop"
    
      83
    
      84  # Install DroidCam license information
    
      85  install -Dm644 /dev/stdin \
    
      86    "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<'EOF'
    
      87DroidCam is proprietary software.
    
      88See https://www.dev47apps.com/ for license terms.
    
      89EOF
    
      90
    
      91  # Preserve the bundled OBS Studio GPLv2 license
    
      92  install -Dm644 \
    
      93    "$pkgdir/opt/droidcam-obs-client/data/obs-studio/license/gplv2.txt" \
    
      94    "$pkgdir/usr/share/licenses/$pkgname/gplv2.txt"
    
      95}
    
      96

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-25 09:27:42	Medium	3
2026-08-25 09:25:51	Medium	3