jitsi-meet-bin

LOW

maintainer celogeek 14 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The package downloads official Jitsi Meet .deb files from the project's own domain (download.jitsi.org), which is the legitimate release host; the files are extracted and installed as static web assets, with no execution of remote code or use of untrusted third-party sources.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official Jitsi Meet .deb files from the project's own domain (download.jitsi.org), which is the legitimate release host; the files are extracted and installed as static web assets, with no execution of remote code or use of untrusted third-party sources.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "https://download.jitsi.org/stable/jitsi-meet-web_${_version}-1_all.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: C0rn3j <spleefer90@gmail.com>
    
      2# Contributor: Celogeek <private-4zokpdq6@mrhyde.xyz>
    
      3
    
      4_basename=jitsi
    
      5_pkgname=meet
    
      6_version=1.0.9442
    
      7
    
      8_pkgbase=${_basename}-${_pkgname}
    
      9_debname=${_basename}-${_pkgname}-web
    
      10pkgname=${_pkgbase}-bin
    
      11pkgver=${_version}
    
      12pkgrel=1
    
      13pkgdesc="Jitsi Meet Web binary"
    
      14arch=('any')
    
      15url="https://jitsi.org/jitsi-meet/"
    
      16license=('Apache')
    
      17depends=()
    
      18optdepends=("nginx")
    
      19makedepends=('tar')
    
      20options=('!strip')
    
      21backup=(
    
      22  "etc/webapps/${_pkgbase}/config.js"
    
      23  "etc/webapps/${_pkgbase}/interface_config.js"
    
      24)
    
      25source=(
    
      26        "https://download.jitsi.org/stable/jitsi-meet-web_${_version}-1_all.deb"
    
      27        "config_${_version}.deb::https://download.jitsi.org/stable/jitsi-meet-web-config_${_version}-1_all.deb"
    
      28)
    
      29noextract=(
    
      30    "config_${_version}.deb"
    
      31)
    
      32provides=(${_pkgbase})
    
      33conflicts=(${_pkgbase})
    
      34install=jitsi.install
    
      35
    
      36build() {
    
      37        rm -rf ${_pkgbase}
    
      38        mkdir ${_pkgbase}
    
      39        tar xJf data.tar.xz -C ${_pkgbase}
    
      40        ar p "config_${_version}.deb" data.tar.xz | tar xJC ${_pkgbase}
    
      41}
    
      42
    
      43package() {
    
      44        cd "$srcdir/${_pkgbase}"
    
      45
    
      46        DESTDIR="${pkgdir}/usr/share/webapps/${_pkgbase}"
    
      47        CONFDIR="${pkgdir}/etc/webapps/${_pkgbase}"
    
      48        DOCDIR="${pkgdir}/usr/share/doc/${_pkgbase}"
    
      49
    
      50        install -d "$DESTDIR"
    
      51        install -d "$CONFDIR"
    
      52        install -d "$DOCDIR"
    
      53
    
      54        cp -R usr/share/jitsi-meet/* "${DESTDIR}"
    
      55        cp usr/share/jitsi-meet-web-config/config.js "${DESTDIR}"
    
      56        cp -R usr/share/jitsi-meet-web-config/* "${DOCDIR}"
    
      57
    
      58        for i in interface_config.js config.js
    
      59        do
    
      60                install -Dm644 "$DESTDIR/${i}" "$CONFDIR/${i}"
    
      61                ln -sf "/etc/webapps/${_pkgbase}/${i}" "$DESTDIR/${i}"
    
      62        done
    
      63
    
      64        sed -i 's@/usr/share/jitsi-meet@/usr/share/webapps/'${_pkgbase}'@' "${pkgdir}/usr/share/doc/${_pkgbase}/"*
    
      65        sed -i 's@/etc/jitsi/meet@/etc/webapps/'${_pkgbase}'@' "${pkgdir}/usr/share/doc/${_pkgbase}/"*
    
      66        
    
      67        chown -R root:root "${pkgdir}"
    
      68}
    
      69sha256sums=('c2991fd93bd7f5a382b5168ad6e284fd9593cd1fff41220d54f1d21404a3a447'
    
      70            '2c290db91cddf937cf5b67cb3371a08cb5cf06e559dad1b8c35a2971e36616a9')
    
      71

Changes since previous scan

--- PKGBUILD @ 2026-09-23 00:28
+++ PKGBUILD @ 2026-10-02 00:00
@@ -3,7 +3,7 @@
 
 _basename=jitsi
 _pkgname=meet
-_version=1.0.9365
+_version=1.0.9442
 
 _pkgbase=${_basename}-${_pkgname}
 _debname=${_basename}-${_pkgname}-web
@@ -66,6 +66,6 @@
         
         chown -R root:root "${pkgdir}"
 }
-sha256sums=('9d5ee46c16b75ad96d09be9c4eeee215e798c95ecbd3f57d74b17ad6ed6737d2'
-            'b6cdaa60310ee6a76ce75095d6935e3937c0f3825725a98307f949a69a01dc00')
+sha256sums=('c2991fd93bd7f5a382b5168ad6e284fd9593cd1fff41220d54f1d21404a3a447'
+            '2c290db91cddf937cf5b67cb3371a08cb5cf06e559dad1b8c35a2971e36616a9')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 13:40:34	Medium	1
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2