mts-link-meetings

MEDIUM

maintainer asalde_le1 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs a prebuilt proprietary Electron binary tarball from apps.webinar.ru. MTS Link (formerly Webinar.ru) is a Russian video-conferencing platform, and apps.webinar.ru appears to be their official distribution host for desktop clients — the URL pattern matches the product name and the domain is the legacy brand name for the same service. However, this is still a closed-source, prebuilt binary from a vendor-controlled host with no source code available for inspection, installed directly to /opt. There are no checksums beyond sha256 of the tarball itself, and the binary runs with full user privileges as an Electron app. This is a legitimate medium-risk concern: not clearly malicious, but a prebuilt proprietary binary from a non-primary domain that cannot be independently verified beyond the hash. The sha256sum provides integrity but not authenticity (no GPG signature). This is a standard pattern for proprietary AUR packages but the non-primary domain (apps.webinar.ru vs mts-link.ru) adds marginal supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 https://apps.webinar.ru/desktop/mts-link-${pkgver}.tar.gz

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package installs a prebuilt proprietary Electron binary tarball from apps.webinar.ru. MTS Link (formerly Webinar.ru) is a Russian video-conferencing platform, and apps.webinar.ru appears to be their official distribution host for desktop clients — the URL pattern matches the product name and the domain is the legacy brand name for the same service. However, this is still a closed-source, prebuilt binary from a vendor-controlled host with no source code available for inspection, installed directly to /opt. There are no checksums beyond sha256 of the tarball itself, and the binary runs with full user privileges as an Electron app. This is a legitimate medium-risk concern: not clearly malicious, but a prebuilt proprietary binary from a non-primary domain that cannot be independently verified beyond the hash. The sha256sum provides integrity but not authenticity (no GPG signature). This is a standard pattern for proprietary AUR packages but the non-primary domain (apps.webinar.ru vs mts-link.ru) adds marginal supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: asalde_le1 <asalde.le1@gmail.com>
    
      2
    
      3pkgname=mts-link-meetings
    
      4pkgver=1.2.13
    
      5pkgrel=1
    
      6pkgdesc='MTS Link Meetings desktop application based on Electron and React'
    
      7arch=(x86_64)
    
      8url='https://mts-link.ru'
    
      9license=(custom:proprietary)
    
      10changelog=${pkgname}.changelog
    
      11replaces=('mts-link')
    
      12depends=(
    
      13  alsa-lib
    
      14  at-spi2-core
    
      15  gtk3
    
      16  libnotify
    
      17  libsecret
    
      18  libuuid.so=1-64
    
      19  libxss
    
      20  libxtst
    
      21  nss
    
      22  xdg-utils
    
      23)
    
      24optdepends=(
    
      25  'libappindicator-gtk3: Systray indicator support'
    
      26)
    
      27source=(
    
      28  https://apps.webinar.ru/desktop/mts-link-${pkgver}.tar.gz
    
      29  mts-link-meetings.desktop
    
      30)
    
      31sha256sums=('111161ab96822923e4352cd2523f57cc2bf7f5b76c9d5e654cc12b11cf567295'
    
      32            'e1de286d013a8c0bba6fe44a8f4138a68d600835b5320b3ab2bbb29b0c5cbb2e')
    
      33
    
      34package() {
    
      35  install -dm755 "${pkgdir}/opt/${pkgname}"
    
      36  cp -r "${srcdir}/${pkgname}-desktop/"* "${pkgdir}/opt/${pkgname}"
    
      37
    
      38  install -dm755 "${pkgdir}/usr/bin"
    
      39  ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      40  
    
      41  install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      42
    
      43  install -dm755 "${pkgdir}/usr/share/icons/hicolor/512x512/apps"
    
      44  ln -s "/opt/${pkgname}/resources/assets/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2