jubbio-bin

MEDIUM

maintainer fr0stb1rd 0 votes scanned 2026-10-27 21:53:24.851394

View on AUR

Why flagged

Installs a prebuilt proprietary binary (.deb) from cdn.jubbio.com, an unofficial/unverifiable CDN for a low-vote, recently uploaded package for an obscure platform; the binary is executed directly and cannot be audited, making silent substitution a realistic supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:54 source_x86_64=("${pkgname}-${pkgver}.deb::https://cdn.jubbio.com/downloads/v${pkgver}/Jubbio.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 60%): Installs a prebuilt proprietary binary (.deb) from cdn.jubbio.com, an unofficial/unverifiable CDN for a low-vote, recently uploaded package for an obscure platform; the binary is executed directly and cannot be audited, making silent substitution a realistic supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fr0stb1rd <fr0stb1rd@proton.me>
    
      2
    
      3pkgname=jubbio-bin
    
      4_pkgname=jubbio
    
      5pkgver=3.8.5
    
      6pkgrel=1
    
      7pkgdesc="Official desktop client for Jubbio (community chat & voice platform)"
    
      8arch=('x86_64')
    
      9url="https://jubbio.com"
    
      10license=('LicenseRef-proprietary')
    
      11depends=(
    
      12    'alsa-lib'
    
      13    'at-spi2-core'
    
      14    'cairo'
    
      15    'cups'
    
      16    'dbus'
    
      17    'expat'
    
      18    'glib2'
    
      19    'gtk3'
    
      20    'hicolor-icon-theme'
    
      21    'libcups'
    
      22    'libdrm'
    
      23    'libnotify'
    
      24    'libsecret'
    
      25    'libx11'
    
      26    'libxcb'
    
      27    'libxcomposite'
    
      28    'libxdamage'
    
      29    'libxext'
    
      30    'libxfixes'
    
      31    'libxkbcommon'
    
      32    'libxrandr'
    
      33    'libxss'
    
      34    'libxtst'
    
      35    'mesa'
    
      36    'nspr'
    
      37    'nss'
    
      38    'pango'
    
      39    'systemd-libs'
    
      40    'xdg-utils'
    
      41)
    
      42optdepends=(
    
      43    'libappindicator-gtk3: Status tray icon support'
    
      44    'org.freedesktop.secrets: Password and token credential storage'
    
      45)
    
      46provides=("${_pkgname}" "${_pkgname}-client")
    
      47conflicts=("${_pkgname}" "${_pkgname}-client")
    
      48options=('!strip' '!debug')
    
      49
    
      50source=(
    
      51    "${_pkgname}.desktop"
    
      52    "${_pkgname}.png"
    
      53)
    
      54source_x86_64=("${pkgname}-${pkgver}.deb::https://cdn.jubbio.com/downloads/v${pkgver}/Jubbio.deb")
    
      55sha512sums=('870726a3806b8e113789930b9c0ad8ee114f0af338af24b0d8936bf9e318f786423acca9fbce28c1cb2fdbe68920c7a52e7c220d0a23d94fae4dee33257c2152'
    
      56            'd6138717ab0626837f86de6a734f198319d70a7acf79fc982420b1b1436620eb33e02d095883d19e5aef35e796cf1028febf9187cec18d97fb38b34e7147d9ac')
    
      57sha512sums_x86_64=('75707ae6decf785e0b28a1a6a3ed2f05c8bfedfff306ddea7fe1fd04f511ebdc9cf7ae677ee403ee8dfe5db944b12acf2036e572db47dea6c76954511bb2cb93')
    
      58
    
      59package() {
    
      60    # Extract data archive unpacked by makepkg into $srcdir
    
      61    bsdtar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}"
    
      62
    
      63    # Remove upstream deb desktop file and deb icons
    
      64    rm -f "${pkgdir}/usr/share/applications/${_pkgname}-client.desktop"
    
      65    rm -rf "${pkgdir}/usr/share/icons"
    
      66
    
      67    # Install binary symlinks
    
      68    install -d "${pkgdir}/usr/bin"
    
      69    ln -sf "/opt/Jubbio/jubbio-client" "${pkgdir}/usr/bin/${_pkgname}"
    
      70    ln -sf "/opt/Jubbio/jubbio-client" "${pkgdir}/usr/bin/${_pkgname}-client"
    
      71
    
      72    # Install main desktop entry
    
      73    install -Dm644 "${srcdir}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      74
    
      75    # Install fallback desktop entry for Wayland app_id (hidden from app menu)
    
      76    install -d "${pkgdir}/usr/share/applications"
    
      77    cat << EOF > "${pkgdir}/usr/share/applications/${_pkgname}-client.desktop"
    
      78[Desktop Entry]
    
      79Name=Jubbio
    
      80Exec=/usr/bin/${_pkgname} %U
    
      81Terminal=false
    
      82Type=Application
    
      83Icon=${_pkgname}
    
      84StartupWMClass=${_pkgname}-client
    
      85NoDisplay=true
    
      86EOF
    
      87
    
      88    # Install icon to hicolor and pixmaps
    
      89    install -Dm644 "${srcdir}/${_pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png"
    
      90    ln -sf "${_pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}-client.png"
    
      91
    
      92    install -d "${pkgdir}/usr/share/pixmaps"
    
      93    install -Dm644 "${srcdir}/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      94    ln -sf "${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}-client.png"
    
      95
    
      96    # Set appropriate permissions
    
      97    chmod -R u=rwX,go=rX "${pkgdir}/opt/Jubbio"
    
      98    chmod +x "${pkgdir}/opt/Jubbio/jubbio-client"
    
      99    chmod +x "${pkgdir}/opt/Jubbio/chrome_crashpad_handler"
    
      100    chmod 4755 "${pkgdir}/opt/Jubbio/chrome-sandbox"
    
      101
    
      102    # Install licenses
    
      103    install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      104    if [ -f "${pkgdir}/opt/Jubbio/LICENSES.chromium.html" ]; then
    
      105        ln -sf "/opt/Jubbio/LICENSES.chromium.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      106    fi
    
      107    if [ -f "${pkgdir}/opt/Jubbio/LICENSE.electron.txt" ]; then
    
      108        ln -sf "/opt/Jubbio/LICENSE.electron.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      109    fi
    
      110}
    
      111

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 21:53:24	Medium	3
2026-10-27 21:48:49	Medium	3