jriver-media-center25

maintainer orphaned · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 binary .deb from files.jriver.com (the official JRiver distribution host) and installs it directly. While files.jriver.com is the legitimate vendor's own distribution server, the checksum is set to SKIP, meaning any change to the binary — whether from a compromised host, a MITM, or a silent upstream update — would go undetected. Installing a prebuilt proprietary binary with no integrity verification is a genuine supply-chain concern: if the host were compromised or the file silently replaced, arbitrary code would execute on the user's system. The host itself is the official vendor host (not a personal/unofficial mirror), which reduces but does not eliminate the risk. The missing checksum is the primary concern here, keeping this at medium rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("http://files.jriver.com/mediacenter/channels/v25/latest/MediaCenter-$_debpkgver-amd64.deb" 'License.txt')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 binary .deb from files.jriver.com (the official JRiver distribution host) and installs it directly. While files.jriver.com is the legitimate vendor's own distribution server, the checksum is set to SKIP, meaning any change to the binary — whether from a compromised host, a MITM, or a silent upstream update — would go undetected. Installing a prebuilt proprietary binary with no integrity verification is a genuine supply-chain concern: if the host were compromised or the file silently replaced, arbitrary code would execute on the user's system. The host itself is the official vendor host (not a personal/unofficial mirror), which reduces but does not eliminate the risk. The missing checksum is the primary concern here, keeping this at medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AudioLinux  <audiolinux AT fastmail DOT fm>
    
      2
    
      3pkgname=jriver-media-center25
    
      4_debpkgver=25.0.114
    
      5pkgver=25.0.114
    
      6pkgrel=1
    
      7pkgdesc="The Most Comprehensive Media Software"
    
      8arch=('x86_64')
    
      9url="http://www.jriver.com/"
    
      10license=('custom')
    
      11depends=('alsa-lib' 'gcc-libs' 'libx11' 'libxext' 'libxcb' 'libxau' 'libxdmcp' 'util-linux' 'libxext' 'gtk3' 'webkit2gtk' 'gstreamer' 'gst-plugins-base' 'gst-plugins-base-libs' 'gst-plugins-good' 'gst-plugins-ugly' 'gst-libav')
    
      12optdepends=('mesa-libgl: nouveau video support' 'nvidia-libgl: nvidia video support' 'vorbis-tools' 'musepack-tools')
    
      13conflicts=('jriver-media-center' 'jriver-media-center24')
    
      14source=("http://files.jriver.com/mediacenter/channels/v25/latest/MediaCenter-$_debpkgver-amd64.deb" 'License.txt')
    
      15sha256sums=('SKIP' 'ee00f430918df6be37777a61e12812875b5583379c78daaa969bae7383a41fbd')
    
      16
    
      17package() {
    
      18  cd "$srcdir"
    
      19  bsdtar xf data.tar.xz -C "$pkgdir"
    
      20    install -Dm644 "License.txt" \
    
      21    "$pkgdir/usr/share/licenses/$pkgname/COPYING"
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2