jellium-desktop-bin
maintainer siiire
· 3 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt AppImage from a non-standard host (nightly.link), which is an unverifiable executable artifact that could be silently swapped, constituting a supply-chain risk.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
source=("linux-appimage-${CARCH}.zip::https://nightly.link/andrewrabert/jellium-desktop/workflows/build-linux-appimage/main/linux-appimage-${CARCH}.zip")
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-standard host (nightly.link), which is an unverifiable executable artifact that could be silently swapped, constituting a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Siiire <siiire@pm.me>
2
pkgname=jellium-desktop-bin
3
pkgver=0.r1093.f3ba9cd
4
pkgrel=1
5
epoch=1
6
pkgdesc="A desktop client for Jellyfin"
7
arch=('x86_64')
8
url="https://github.com/andrewrabert/jellium-desktop"
9
license=('GPL-2.0-only')
10
depends=('hicolor-icon-theme')
11
provides=('jellyfin-desktop' 'jellium-desktop')
12
conflicts=('jellyfin-desktop' 'jellyfin-media-player' 'jellyfin-desktop-bin' 'jellyfin-desktop-git' 'jellyfin-desktop-cef-git' 'jellium-desktop' 'jellyfin-desktop-git-bin' 'jellium-desktop-git')
13
options=('!strip')
14
source=("linux-appimage-${CARCH}.zip::https://nightly.link/andrewrabert/jellium-desktop/workflows/build-linux-appimage/main/linux-appimage-${CARCH}.zip")
15
sha256sums=('SKIP')
16
17
prepare() {
18
cd "$srcdir"
19
chmod +x *.AppImage
20
./*.AppImage --appimage-extract
21
}
22
23
package() {
24
install -d "${pkgdir}/opt/${pkgname}"
25
install -d "${pkgdir}/usr/bin"
26
install -d "${pkgdir}/usr/share/applications"
27
28
cp -a "${srcdir}/squashfs-root/"* "${pkgdir}/opt/${pkgname}/"
29
30
ln -s "/opt/${pkgname}/AppRun" "${pkgdir}/usr/bin/jellium-desktop"
31
ln -s "/opt/${pkgname}/AppRun" "${pkgdir}/usr/bin/jellyfin-desktop"
32
33
_desktop=$(find "${pkgdir}/opt/${pkgname}" -maxdepth 1 -name "*.desktop" -print -quit)
34
install -Dm644 "$_desktop" "${pkgdir}/usr/share/applications/jellium-desktop.desktop"
35
sed -i "s|^Exec=[^ ]*|Exec=/usr/bin/jellium-desktop|g" "${pkgdir}/usr/share/applications/jellium-desktop.desktop"
36
37
if [ -d "${pkgdir}/opt/${pkgname}/usr/share/icons" ]; then
38
install -d "${pkgdir}/usr/share/icons"
39
cp -a "${pkgdir}/opt/${pkgname}/usr/share/icons/"* "${pkgdir}/usr/share/icons/"
40
fi
41
}
42
Changes since previous scan
--- PKGBUILD @ 2026-07-23 11:23+++ PKGBUILD @ 2026-08-03 00:08@@ -1,6 +1,6 @@ # Maintainer: Siiire <siiire@pm.me> pkgname=jellium-desktop-bin-pkgver=0.r1092.4d7de92+pkgver=0.r1093.f3ba9cd pkgrel=1 epoch=1 pkgdesc="A desktop client for Jellyfin"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 3 |
| 2026-07-29 00:25:53 | MEDIUM | 3 |
| 2026-07-28 00:07:28 | MEDIUM | 3 |
| 2026-07-27 00:24:32 | MEDIUM | 3 |
| 2026-07-26 00:07:32 | MEDIUM | 3 |
| 2026-07-25 00:13:44 | MEDIUM | 3 |
| 2026-07-24 00:02:28 | MEDIUM | 3 |
| 2026-07-23 15:24:42 | MEDIUM | 3 |
| 2026-07-23 11:23:42 | MEDIUM | 3 |
| 2026-07-23 00:14:47 | MEDIUM | 3 |
| 2026-07-22 17:21:24 | MEDIUM | 3 |
| 2026-07-22 11:20:06 | MEDIUM | 3 |
| 2026-07-22 00:29:32 | MEDIUM | 3 |
| 2026-07-21 19:17:41 | MEDIUM | 3 |
| 2026-07-21 17:17:32 | MEDIUM | 3 |
| 2026-07-21 00:24:15 | MEDIUM | 3 |