minimserver

maintainer orphaned · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binary tarballs from jminim.com (an unofficial/personal host, not the canonical minimserver.com) with SKIP checksums for the binaries themselves. The binaries are executed at runtime (a UPnP server with JRE). SKIP checksums mean there is zero integrity verification on the downloaded executables — if jminim.com is compromised or the files are swapped, arbitrary code runs on the user's system. The auxiliary scripts (startd, stopall, minimserver.service) do have checksums. This is a genuine supply-chain concern: unofficial host + no checksum on executed binaries = medium risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_aarch64=("http://jminim.com/brac/MinimServer-$pkgver-linux-arm64.tar.gz" "minimserver.service" "startd" "stopall")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads prebuilt binary tarballs from jminim.com (an unofficial/personal host, not the canonical minimserver.com) with SKIP checksums for the binaries themselves. The binaries are executed at runtime (a UPnP server with JRE). SKIP checksums mean there is zero integrity verification on the downloaded executables — if jminim.com is compromised or the files are swapped, arbitrary code runs on the user's system. The auxiliary scripts (startd, stopall, minimserver.service) do have checksums. This is a genuine supply-chain concern: unofficial host + no checksum on executed binaries = medium risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AudioLinux  <audiolinux AT fastmail DOT fm>
    
      2
    
      3pkgname=minimserver
    
      4pkgver=0.8.5.2
    
      5pkgrel=6
    
      6pkgdesc="UPnP Audio Server"
    
      7arch=('x86_64' 'aarch64')
    
      8url="http://www.minimserver.com"
    
      9license=('custom:minimserver')
    
      10depends=('jre8-openjdk' 'bash')
    
      11install=${pkgname}.install
    
      12source_aarch64=("http://jminim.com/brac/MinimServer-$pkgver-linux-arm64.tar.gz" "minimserver.service" "startd" "stopall")
    
      13source_x86_64=("http://jminim.com/brac/MinimServer-$pkgver-linux-intel.tar.gz" "minimserver.service" "startd" "stopall")
    
      14sha256sums_aarch64=('SKIP' 'bf4aa3138405551d56799a46853c5aec3a5fa596535623945ea03fc9dcba60e7' 'b62defecce18a435d01a516c9f00005372eef402697df1c7fc61f0a661c81819' '3eb10e9e28b08b708e02328661ffe8810ae1e0fc653c396c41e4cd15d393dfea')
    
      15sha256sums_x86_64=('SKIP' 'bf4aa3138405551d56799a46853c5aec3a5fa596535623945ea03fc9dcba60e7' 'b62defecce18a435d01a516c9f00005372eef402697df1c7fc61f0a661c81819' '3eb10e9e28b08b708e02328661ffe8810ae1e0fc653c396c41e4cd15d393dfea')
    
      16
    
      17package() {
    
      18  cd $srcdir
    
      19  
    
      20  mkdir -p -m 777 $pkgdir/opt/minimserver/tmp/
    
      21  cp -r $srcdir/$pkgname/$pkgname-$pkgver/* "$pkgdir/opt/minimserver/"
    
      22  rm $pkgdir/opt/minimserver/bin/startd
    
      23  rm $pkgdir/opt/minimserver/bin/stopall
    
      24  install -Dm755 startd ${pkgdir}/opt/minimserver/bin/startd
    
      25  install -Dm755 stopall ${pkgdir}/opt/minimserver/bin/stopall
    
      26  install -Dm644 "minimserver.service" $pkgdir/usr/lib/systemd/user/minimserver.service
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2