mts-link-meetings

maintainer asalde_le1 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt proprietary Electron binary tarball from apps.webinar.ru. MTS Link (formerly Webinar.ru) is a Russian video-conferencing platform, and apps.webinar.ru appears to be their official distribution host for desktop clients — the URL pattern matches the product name and the domain is the legacy brand name for the same service. However, this is still a closed-source, prebuilt binary from a vendor-controlled host with no source code available for inspection, installed directly to /opt. There are no checksums beyond sha256 of the tarball itself, and the binary runs with full user privileges as an Electron app. This is a legitimate medium-risk concern: not clearly malicious, but a prebuilt proprietary binary from a non-primary domain that cannot be independently verified beyond the hash. The sha256sum provides integrity but not authenticity (no GPG signature). This is a standard pattern for proprietary AUR packages but the non-primary domain (apps.webinar.ru vs mts-link.ru) adds marginal supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 https://apps.webinar.ru/desktop/mts-link-${pkgver}.tar.gz

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package installs a prebuilt proprietary Electron binary tarball from apps.webinar.ru. MTS Link (formerly Webinar.ru) is a Russian video-conferencing platform, and apps.webinar.ru appears to be their official distribution host for desktop clients — the URL pattern matches the product name and the domain is the legacy brand name for the same service. However, this is still a closed-source, prebuilt binary from a vendor-controlled host with no source code available for inspection, installed directly to /opt. There are no checksums beyond sha256 of the tarball itself, and the binary runs with full user privileges as an Electron app. This is a legitimate medium-risk concern: not clearly malicious, but a prebuilt proprietary binary from a non-primary domain that cannot be independently verified beyond the hash. The sha256sum provides integrity but not authenticity (no GPG signature). This is a standard pattern for proprietary AUR packages but the non-primary domain (apps.webinar.ru vs mts-link.ru) adds marginal supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: asalde_le1 <asalde.le1@gmail.com>
    
      2
    
      3pkgname=mts-link-meetings
    
      4pkgver=1.2.13
    
      5pkgrel=1
    
      6pkgdesc='MTS Link Meetings desktop application based on Electron and React'
    
      7arch=(x86_64)
    
      8url='https://mts-link.ru'
    
      9license=(custom:proprietary)
    
      10changelog=${pkgname}.changelog
    
      11replaces=('mts-link')
    
      12depends=(
    
      13  alsa-lib
    
      14  at-spi2-core
    
      15  gtk3
    
      16  libnotify
    
      17  libsecret
    
      18  libuuid.so=1-64
    
      19  libxss
    
      20  libxtst
    
      21  nss
    
      22  xdg-utils
    
      23)
    
      24optdepends=(
    
      25  'libappindicator-gtk3: Systray indicator support'
    
      26)
    
      27source=(
    
      28  https://apps.webinar.ru/desktop/mts-link-${pkgver}.tar.gz
    
      29  mts-link-meetings.desktop
    
      30)
    
      31sha256sums=('111161ab96822923e4352cd2523f57cc2bf7f5b76c9d5e654cc12b11cf567295'
    
      32            'e1de286d013a8c0bba6fe44a8f4138a68d600835b5320b3ab2bbb29b0c5cbb2e')
    
      33
    
      34package() {
    
      35  install -dm755 "${pkgdir}/opt/${pkgname}"
    
      36  cp -r "${srcdir}/${pkgname}-desktop/"* "${pkgdir}/opt/${pkgname}"
    
      37
    
      38  install -dm755 "${pkgdir}/usr/bin"
    
      39  ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      40  
    
      41  install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      42
    
      43  install -dm755 "${pkgdir}/usr/share/icons/hicolor/512x512/apps"
    
      44  ln -s "/opt/${pkgname}/resources/assets/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png"
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2