jitsi-meet-turnserver-nightly-bin
MEDIUM
maintainer celogeek
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from an official but non-whitelisted host; while the source is from the project's official domain, the binary nature and lack of verifiable build process create a supply-chain risk if the artifact were swapped.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
"https://download.jitsi.org/unstable/jitsi-meet-turnserver_${_version}-1_all.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from an official but non-whitelisted host; while the source is from the project's official domain, the binary nature and lack of verifiable build process create a supply-chain risk if the artifact were swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Celogeek <arch-aur-f5d67e@celogeek.com>
2
3
_basename=jitsi-meet
4
_pkgname=turnserver
5
_version=1.0.9473
6
7
_pkgbase=${_basename}-${_pkgname}-nightly
8
_debname=${_basename}-${_pkgname}
9
pkgname=${_pkgbase}-bin
10
pkgver=${_version}
11
pkgrel=1
12
pkgdesc="Jitsi Meet Prosody Plugins nightly binary"
13
arch=('any')
14
url="https://jitsi.org/jitsi-meet/"
15
license=('Apache')
16
depends=()
17
optdepends=("coturn")
18
makedepends=(
19
)
20
options=('!strip')
21
backup=(
22
)
23
makedepends=('tar')
24
source=(
25
"https://download.jitsi.org/unstable/jitsi-meet-turnserver_${_version}-1_all.deb"
26
)
27
28
provides=(${_pkgbase})
29
conflicts=(${_pkgbase})
30
31
build() {
32
rm -rf ${_pkgbase}
33
mkdir ${_pkgbase}
34
tar xJf data.tar.xz -C ${_pkgbase}
35
}
36
37
package() {
38
cd "$srcdir/${_pkgbase}"
39
DOCDIR="${pkgdir}/usr/share/doc/${_pkgbase}"
40
install -d "$DOCDIR"
41
cp -R usr/share/jitsi-meet-turnserver/* "${DOCDIR}"
42
# install -Dm644 -t "${pkgdir}/usr/share/doc/${pkgname}" doc/debian/jitsi-meet-turn/turnserver.conf doc/debian/jitsi-meet/jitsi-meet.conf doc/debian/jitsi-meet-turn/coturn-certbot-deploy.sh
43
chown -R root:root "${pkgdir}"
44
}
45
sha256sums=('2d0b7507f9a17cb909fd1a9b9c616079b92a9f19a20264e9d1c395b0130ed4ed')
46
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |