jitsi-meet-prosody-bin

maintainer celogeek · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-whitelisted host (download.jitsi.org), which is an official Jitsi domain, but the source is a binary blob that cannot be verified, posing a supply-chain risk if the host were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "https://download.jitsi.org/stable/jitsi-meet-prosody_${_version}-1_all.deb"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (download.jitsi.org), which is an official Jitsi domain, but the source is a binary blob that cannot be verified, posing a supply-chain risk if the host were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: C0rn3j <spleefer90@gmail.com>
    
      2# Contributor: Celogeek <private-4zokpdq6@mrhyde.xyz>
    
      3
    
      4_basename=jitsi-meet
    
      5_pkgname=prosody
    
      6_version=1.0.9268
    
      7
    
      8_pkgbase=${_basename}-${_pkgname}
    
      9_debname=${_basename}-${_pkgname}
    
      10pkgname=${_pkgbase}-bin
    
      11pkgver=${_version}
    
      12pkgrel=1
    
      13pkgdesc="Jitsi Meet Prosody Plugins binary"
    
      14arch=('any')
    
      15url="https://jitsi.org/jitsi-meet/"
    
      16license=('Apache')
    
      17depends=()
    
      18optdepends=("prosody" "lua52" "lua52-sec" "lua52-zip" "lua52-event")
    
      19makedepends=('tar')
    
      20options=('!strip')
    
      21backup=(
    
      22)
    
      23source=(
    
      24        "https://download.jitsi.org/stable/jitsi-meet-prosody_${_version}-1_all.deb"
    
      25)
    
      26provides=(${_pkgbase})
    
      27conflicts=(${_pkgbase})
    
      28install=jitsi.install
    
      29
    
      30build() {
    
      31        rm -rf ${_pkgbase}
    
      32        mkdir ${_pkgbase}
    
      33        tar xJf data.tar.xz -C ${_pkgbase}
    
      34}
    
      35
    
      36package() {
    
      37        cd "$srcdir/${_pkgbase}"
    
      38
    
      39        DESTDIR="${pkgdir}/usr/lib/${_pkgbase}"
    
      40        DOCDIR="${pkgdir}/usr/share/doc/${_pkgbase}"
    
      41        install -d "$DESTDIR"
    
      42	install -d "$DOCDIR"
    
      43	cp -R usr/share/jitsi-meet/prosody-plugins/* "${DESTDIR}"
    
      44	cp -R usr/share/jitsi-meet-prosody/* "${DOCDIR}"
    
      45
    
      46        sed -i 's@/usr/share/jitsi-meet/prosody-plugins/@/usr/lib/'${_pkgbase}'@' "${pkgdir}/usr/share/doc/${_pkgbase}/prosody.cfg.lua-jvb.example"
    
      47
    
      48        chown -R root:root "${pkgdir}"
    
      49	
    
      50
    
      51}
    
      52sha256sums=('22d0379a5402f8c66bc2e050b5713ac17362efd269bca770a9728b5416d7dabc')
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2