ivideon-server-headless

maintainer k0ste · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads official .deb files from the vendor's own domain (ivideon.com) to extract and repackage binaries; this is a normal source for the software, and the checksums are verified, making it low risk despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official .deb files from the vendor's own domain (ivideon.com) to extract and repackage binaries; this is a normal source for the software, and the checksums are verified, making it low risk despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://packages.ivideon.com/ubuntu/pool/non-free/i/${pkgname}/${pkgname}_${pkgver}-${pkgrel}~${_rel}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Shalygin Konstantin <k0ste@k0ste.ru>
    
      2# Contributor: Shalygin Konstantin <k0ste@k0ste.ru>
    
      3
    
      4pkgname='ivideon-server-headless'
    
      5pkgver='3.14.0'
    
      6pkgrel='11543'
    
      7_rel='d694e54'
    
      8pkgdesc='Ivideon-server daemon'
    
      9arch=('x86_64')
    
      10url='https://ivideon.com'
    
      11license=('freeware')
    
      12depends=('portaudio' 'ffmpeg' 'gst-plugins-good' 'gst-plugins-base')
    
      13makedepends=('libarchive')
    
      14conflicts=('ivideon-video-server-nogui')
    
      15source=("https://packages.ivideon.com/ubuntu/pool/non-free/i/${pkgname}/${pkgname}_${pkgver}-${pkgrel}~${_rel}_amd64.deb"
    
      16	"https://packages.ivideon.com/ubuntu/pool/non-free/i/ivideon-server-dahua-bin-module/ivideon-server-dahua-bin-module_${pkgver}-${pkgrel}~${_rel}_amd64.deb"
    
      17	"https://packages.ivideon.com/ubuntu/pool/non-free/libd/libdahuasdk/libdahuasdk_1.0.2_amd64.deb"
    
      18	"videoserverd.service"
    
      19	"videoserverd.conf"
    
      20	"sysusers.conf"
    
      21	"videoservertmp.conf")
    
      22noextract=("${source[@]%%::*}")
    
      23sha256sums=('310741022f4d0a54099d0da4bbcf157415aa5398abf37cb31897f8ddfa3b167b'
    
      24            '6fb3230a8e8cdc0bceeb6d2900b0f54248f3fab6c7fc73a5e98faba5502c2971'
    
      25            '7da74ca97c53669f95efea718bbf05ddd7b0d5b0b97dc93d2777ed8c64388254'
    
      26            '4b0fcdf8cc77eb8748041fbc78d2d7b3e75ced0d1b96b6ce38c17241441bc022'
    
      27            'f0010bc64cd7c1b5aefcc7241f0e0074528aec1a4b51dd08bd429e95acd26012'
    
      28            '91c4b133ad4d1fda72679ab393b647ac24a56e3c0d46cd2a908a47ed8524ec81'
    
      29            'ad8029bf201260608daf7ed4d109731bbf247e8597e36cc1dea915fceae51b56')
    
      30backup=("etc/videoserverd.conf")
    
      31
    
      32prepare() {
    
      33  bsdtar xf "${srcdir}/${pkgname}_${pkgver}-${pkgrel}~${_rel}_amd64.deb"
    
      34  bsdtar xf "data.tar.gz"
    
      35  sed -i 's|$(dirname "$(readlink /etc/init.d/videoserver)")|/opt/ivideon/ivideon-server|g' "opt/ivideon/ivideon-server/serverctl.sh"
    
      36
    
      37  mkdir "${srcdir}/ivideon-server-dahua-bin-module"
    
      38  cd "${srcdir}/ivideon-server-dahua-bin-module"
    
      39  bsdtar xf "${srcdir}/ivideon-server-dahua-bin-module_${pkgver}-${pkgrel}~${_rel}_amd64.deb"
    
      40  bsdtar xf "data.tar.gz"
    
      41
    
      42  mkdir "${srcdir}/libdahuasdk"
    
      43  cd "${srcdir}/libdahuasdk"
    
      44  bsdtar xf "${srcdir}/libdahuasdk_1.0.2_amd64.deb"
    
      45  bsdtar xf "data.tar.xz"
    
      46}
    
      47
    
      48build() {
    
      49  rm "opt/ivideon/ivideon-server/ivideon-server.service"
    
      50  rm "opt/ivideon/ivideon-server/remote-svc.service"
    
      51  rm "opt/ivideon/ivideon-server/remote_service"
    
      52  rm "opt/ivideon/ivideon-server/serverctl.sh"
    
      53}
    
      54
    
      55package() {
    
      56  cp -ax "opt" "${pkgdir}"
    
      57  cp -ax "${srcdir}/ivideon-server-dahua-bin-module/opt" "${pkgdir}"
    
      58  cp -ax "${srcdir}/libdahuasdk/opt" "${pkgdir}"
    
      59  install -Dm0644 "videoserverd.service" "${pkgdir}/usr/lib/systemd/system/videoserverd.service"
    
      60  install -Dm0644 "videoserverd.conf" "${pkgdir}/etc/videoserverd.conf"
    
      61  install -Dm0644 "sysusers.conf" "${pkgdir}/usr/lib/sysusers.d/videoserverd.conf"
    
      62  install -Dm0644 "videoservertmp.conf" "${pkgdir}/usr/lib/tmpfiles.d/videoserverd.conf"
    
      63  install -dm0755 -o 176 -g 176 "${pkgdir}/run/videoserverd"
    
      64  install -dm0775 -o 176 -g 176 "${pkgdir}/var/log/videoserverd"
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2