jitsi-meet-nightly-bin

maintainer celogeek · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads official Jitsi Meet Web nightly .deb files from the project's own domain (download.jitsi.org), which is plausibly the project's official release infrastructure; despite the static analyzer flag for a non-standard host, this is a normal AUR packaging practice for building from upstream binaries, and the source is verifiable via provided checksums.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official Jitsi Meet Web nightly .deb files from the project's own domain (download.jitsi.org), which is plausibly the project's official release infrastructure; despite the static analyzer flag for a non-standard host, this is a normal AUR packaging practice for building from upstream binaries, and the source is verifiable via provided checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "https://download.jitsi.org/unstable/jitsi-meet-web_${_version}-1_all.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Celogeek <arch-aur-f5d67e@celogeek.com>
    
      2
    
      3_basename=jitsi
    
      4_pkgname=meet
    
      5_version=1.0.9378
    
      6
    
      7_pkgbase=${_basename}-${_pkgname}-nightly
    
      8_debname=${_basename}-${_pkgname}-web
    
      9pkgname=${_pkgbase}-bin
    
      10pkgver=${_version}
    
      11pkgrel=1
    
      12pkgdesc="Jitsi Meet Web nightly binary"
    
      13arch=('any')
    
      14url="https://jitsi.org/jitsi-meet/"
    
      15license=('Apache')
    
      16depends=()
    
      17optdepends=("nginx")
    
      18makedepends=('tar')
    
      19options=('!strip')
    
      20backup=(
    
      21  "etc/webapps/${_pkgbase}/config.js"
    
      22  "etc/webapps/${_pkgbase}/interface_config.js"
    
      23)
    
      24source=(
    
      25        "https://download.jitsi.org/unstable/jitsi-meet-web_${_version}-1_all.deb"
    
      26        "config_${_version}.deb::https://download.jitsi.org/unstable/jitsi-meet-web-config_${_version}-1_all.deb"
    
      27)
    
      28noextract=(
    
      29    "config_${_version}.deb"
    
      30)
    
      31provides=(${_pkgbase})
    
      32conflicts=(${_pkgbase})
    
      33
    
      34build() {
    
      35        rm -rf ${_pkgbase}
    
      36        mkdir ${_pkgbase}
    
      37        tar xJf data.tar.xz -C ${_pkgbase}
    
      38        ar p "config_${_version}.deb" data.tar.xz | tar xJC ${_pkgbase}
    
      39}
    
      40
    
      41package() {
    
      42        cd "$srcdir/${_pkgbase}"
    
      43
    
      44        DESTDIR="${pkgdir}/usr/share/webapps/${_pkgbase}"
    
      45        CONFDIR="${pkgdir}/etc/webapps/${_pkgbase}"
    
      46        DOCDIR="${pkgdir}/usr/share/doc/${_pkgbase}"
    
      47
    
      48        install -d "$DESTDIR"
    
      49        install -d "$CONFDIR"
    
      50        install -d "$DOCDIR"
    
      51
    
      52        cp -R usr/share/jitsi-meet/* "${DESTDIR}"
    
      53        cp usr/share/jitsi-meet-web-config/config.js "${DESTDIR}"
    
      54        cp -R usr/share/jitsi-meet-web-config/* "${DOCDIR}"
    
      55
    
      56        for i in interface_config.js config.js
    
      57        do
    
      58                install -Dm644 "$DESTDIR/${i}" "$CONFDIR/${i}"
    
      59                ln -sf "/etc/webapps/${_pkgbase}/${i}" "$DESTDIR/${i}"
    
      60        done
    
      61
    
      62        sed -i 's@/usr/share/jitsi-meet@/usr/share/webapps/'${_pkgbase}'@' "${pkgdir}/usr/share/doc/${_pkgbase}/"*
    
      63        sed -i 's@/etc/jitsi/meet@/etc/webapps/'${_pkgbase}'@' "${pkgdir}/usr/share/doc/${_pkgbase}/"*
    
      64
    
      65        chown -R root:root "${pkgdir}"
    
      66}
    
      67sha256sums=('19c551f660e737f4f3942d24b01fb72e9bdf7d289b1d02448a17c53b348576e5'
    
      68            '2e7570b452157004ad9ebb9dd123520db2a1cbc490603487839df0cc852bc817')
    
      69

Changes since previous scan

--- PKGBUILD @ 2026-06-22 14:13
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,7 +2,7 @@
 
 _basename=jitsi
 _pkgname=meet
-_version=1.0.9287
+_version=1.0.9378
 
 _pkgbase=${_basename}-${_pkgname}-nightly
 _debname=${_basename}-${_pkgname}-web
@@ -64,6 +64,6 @@
 
         chown -R root:root "${pkgdir}"
 }
-sha256sums=('8007134895e88d4ebc6befb5c8a01ab1922086601b3110d9d0b36c1910d281ee'
-            '9ea7da8ae1e65a5c2d8631de9bebe300b043aefc045cd823d8ebafa65f63fb26')
+sha256sums=('19c551f660e737f4f3942d24b01fb72e9bdf7d289b1d02448a17c53b348576e5'
+            '2e7570b452157004ad9ebb9dd123520db2a1cbc490603487839df0cc852bc817')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 19:21:46	MEDIUM	1
2026-06-22 14:13:37	CLEAN	2
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1