iriunwebcam-bin

maintainer xiota · 18 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from iriun.gitlab.io (a GitLab Pages host controlled by the 'iriun' GitLab account, not the official iriun.com domain). The binary is then extracted and installed as an executable. While the sha256 checksum provides integrity verification against the specific artifact, the source is not the official vendor download page (iriun.com) but a GitLab Pages site. This is a real supply-chain concern: if the GitLab account were compromised or the artifact silently replaced before the checksum was recorded, users would execute arbitrary code. The pattern of installing a prebuilt closed-source binary from an unofficial/personal hosting location (even if it appears to be the developer's own GitLab) rather than the official website warrants medium severity. The checksum mitigates replay attacks but not initial poisoning.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "iriunwebcam-${pkgver}.deb"::"http://iriun.gitlab.io/iriunwebcam-${pkgver}.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from iriun.gitlab.io (a GitLab Pages host controlled by the 'iriun' GitLab account, not the official iriun.com domain). The binary is then extracted and installed as an executable. While the sha256 checksum provides integrity verification against the specific artifact, the source is not the official vendor download page (iriun.com) but a GitLab Pages site. This is a real supply-chain concern: if the GitLab account were compromised or the artifact silently replaced before the checksum was recorded, users would execute arbitrary code. The pattern of installing a prebuilt closed-source binary from an unofficial/personal hosting location (even if it appears to be the developer's own GitLab) rather than the official website warrants medium severity. The checksum mitigates replay attacks but not initial poisoning.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:
    
      2# Contributor: Barfin
    
      3# Contributor: DanielH, agstrc
    
      4
    
      5_pkgname="iriunwebcam"
    
      6pkgname="$_pkgname-bin"
    
      7pkgver=2.9.1
    
      8pkgrel=1
    
      9pkgdesc="Use your phone's camera as a wireless webcam in your PC"
    
      10url="https://iriun.com/"
    
      11license=('LicenseRef-Iriun')
    
      12arch=('x86_64')
    
      13
    
      14optdepends=(
    
      15  'android-tools: adb'
    
      16  'qt5-wayland'
    
      17)
    
      18
    
      19source=(
    
      20  "iriunwebcam-${pkgver}.deb"::"http://iriun.gitlab.io/iriunwebcam-${pkgver}.deb"
    
      21  "LICENSE.iriun.txt" # extracted from mac archive
    
      22)
    
      23sha256sums=(
    
      24  'b25a53c9eb53f7ac1a47b5ef7174990dd97f66269c7388603395c2c57f160b84'
    
      25  'eb2ba875d0b419ab7d6327a933d619d1b9eed51f89d49e55ed789bf8f37f75be'
    
      26)
    
      27
    
      28options=("!emptydirs" "!debug")
    
      29
    
      30package() {
    
      31  depends=(
    
      32    'alsa-lib'
    
      33    'avahi'
    
      34    'libdrm'
    
      35    'qt5-base'
    
      36    'v4l2loopback-dkms'
    
      37  )
    
      38
    
      39  tar -xf "$srcdir/data.tar.zst" -C "$pkgdir"
    
      40
    
      41  # binary
    
      42  install -Dm755 "$pkgdir/usr/local/bin/iriunwebcam" -t "$pkgdir/usr/bin/"
    
      43  rm -rf "$pkgdir/usr/local"
    
      44
    
      45  # fixes
    
      46  sed -E -e 's&/usr/local/bin/&&' -i "$pkgdir/usr/share/applications/iriunwebcam.desktop"
    
      47
    
      48  # license
    
      49  install -Dm644 LICENSE.iriun.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      50
    
      51  # permissions
    
      52  chmod -R u+rwX,go+rX,go-w "$pkgdir"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2