emby-server-beta
LOW
maintainer nicolahinssen
14 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads source files from GitHub and a GitHub Pages domain (mediabrowser.github.io), which are legitimate project-related hosts; the ffmpeg binary is from the project's own tooling site and not a third-party untrusted host, making the supply chain risk low despite the static analyzer flag.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files from GitHub and a GitHub Pages domain (mediabrowser.github.io), which are legitimate project-related hosts; the ffmpeg binary is from the project's own tooling site and not a third-party untrusted host, making the supply chain risk low despite the static analyzer flag.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:56
"https://mediabrowser.github.io/embytools/ffmpeg-${_ffmpeg_ver}-x64.tar.xz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Nicola Hinssen <nicola.hinssen@gmail.com>
2
# Contributor: Bjorn Nostvold <bjorn.nostvold@gmail.com>
3
# Contributor: Maxime Gauduin <alucryd@archlinux.org>
4
# Contributor: Daniel Seymour <dannyseeless@gmail.com>
5
6
pkgname=emby-server-beta
7
pkgver=4.11.0.13
8
pkgrel=1
9
_ffmpeg_ver=2023_06_25
10
pkgdesc='Bring together your videos, music, photos, and live television'
11
arch=('x86_64')
12
url='https://emby.media'
13
license=('custom')
14
depends=('alsa-lib'
15
'aom'
16
'aspnet-runtime-8.0'
17
'bzip2'
18
'dotnet-runtime-8.0'
19
'expat'
20
'fontconfig'
21
'fribidi'
22
'glibc'
23
'gmp'
24
'gnutls'
25
'lame'
26
'libass.so'
27
'libchromaprint.so'
28
'libdav1d.so'
29
'libdrm'
30
'libfreetype.so'
31
'libjpeg-turbo'
32
'libmfx'
33
'libpng'
34
'libtesseract.so'
35
'libtheora'
36
'libva-drm.so'
37
'libva.so'
38
'libvips'
39
'libvorbisenc.so'
40
'libvorbis.so'
41
'libwebp'
42
'libx264.so'
43
'libx265.so'
44
'ocl-icd'
45
'opus'
46
'skia-sharp'
47
'sqlite'
48
'zvbi'
49
'zlib')
50
makedepends=()
51
optdepends=('intel-media-sdk: Intel QuickSync support (requires Emby Premiere)'
52
'nvidia-utils: Nvidia NVDEC/NVENC support (requires Emby Premiere)')
53
provides=('emby-server')
54
conflicts=('emby-server')
55
source=("https://github.com/MediaBrowser/Emby.Releases/releases/download/${pkgver}/embyserver-netcore_${pkgver}.zip"
56
"https://mediabrowser.github.io/embytools/ffmpeg-${_ffmpeg_ver}-x64.tar.xz"
57
'emby-server'
58
'emby-server.conf'
59
'emby-server.service'
60
'license.docx')
61
noextract=('license.docx')
62
backup=('etc/conf.d/emby-server')
63
install=emby-server.install
64
sha256sums=('d068b0377a1f596a9800f7a60a3242324ea6eb33d300285ddebd9b763b6e5297'
65
'70db9e2c1d5eb4345e34a6329918219da12684dded8226afff0f779a4a12f78c'
66
'0351d6e9118853e3aa275d62b67dce4444b3d85130b05fb889b2069f364f47ca'
67
'8bd03d803e295bea89e9c7bad17e774218f8dc4be9826af124b1f83bc4b256b6'
68
'a7f2e38d2d196984d1c1632c851215aea9072b3af998d10a6b68477ad886ea14'
69
'a6d7ea65dcb06392479a85e1a10a7aeb872d803da6f784f6935fcd4ee63008c6')
70
71
prepare() {
72
rm -rf system/{electron,runtimes/{osx,tizen*,win*}}
73
}
74
75
package() {
76
install -dm 755 "${pkgdir}"/usr/lib
77
cp -dr --no-preserve='ownership' system "${pkgdir}"/usr/lib/emby-server
78
install -Dm 755 emby-server -t "${pkgdir}"/usr/bin/
79
install -Dm 644 emby-server.service -t "${pkgdir}"/usr/lib/systemd/system/
80
install -Dm 644 emby-server.conf "${pkgdir}"/etc/conf.d/emby-server
81
install -Dm 644 license.docx -t "${pkgdir}"/usr/share/licenses/$pkgname/license.docx
82
83
install -dm 755 "${pkgdir}/opt/emby-server/bin"
84
install -dm 755 "${pkgdir}/opt/emby-server/lib"
85
86
cp -dr --no-preserve='ownership' bin "${pkgdir}/opt/emby-server"
87
cp -dr --no-preserve='ownership' lib "${pkgdir}/opt/emby-server"
88
}
89
Changes since previous scan
--- PKGBUILD @ 2026-10-31 00:07+++ PKGBUILD @ 2026-11-01 00:21@@ -4,7 +4,7 @@ # Contributor: Daniel Seymour <dannyseeless@gmail.com> pkgname=emby-server-beta-pkgver=4.11.0.12+pkgver=4.11.0.13 pkgrel=1 _ffmpeg_ver=2023_06_25 pkgdesc='Bring together your videos, music, photos, and live television'@@ -61,7 +61,7 @@ noextract=('license.docx') backup=('etc/conf.d/emby-server') install=emby-server.install-sha256sums=('4f0e3dfb83a23cdbc6e7a352484182b81d6f7cb7e906cdaebcbd732b750b030c'+sha256sums=('d068b0377a1f596a9800f7a60a3242324ea6eb33d300285ddebd9b763b6e5297' '70db9e2c1d5eb4345e34a6329918219da12684dded8226afff0f779a4a12f78c' '0351d6e9118853e3aa275d62b67dce4444b3d85130b05fb889b2069f364f47ca' '8bd03d803e295bea89e9c7bad17e774218f8dc4be9826af124b1f83bc4b256b6'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 07:58:04 | Medium | 1 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 01:51:16 | Medium | 1 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 03:46:34 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 21:38:30 | Medium | 1 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 01:27:05 | Medium | 1 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |