plex-desktop
maintainer username227
· 22 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
This PKGBUILD downloads a prebuilt Snap package (a SquashFS containing compiled binaries) from api.snapcraft.io and a prebuilt Debian package from ftp.us.debian.org, then extracts and installs them directly into the system. Both are legitimate official sources (Canonical's Snap store API and Debian's official FTP mirror), so the cheaper model's concern about 'non-whitelisted hosts' is somewhat overstated — these are real vendor/distro infrastructure. However, the core concern remains valid: prebuilt binaries from a Snap package are being extracted and installed without any build-from-source step, meaning the user trusts Canonical's snap store signing/distribution chain rather than building from upstream source. The sha256sums are pinned, which mitigates tampering in transit. The appimage-exec-wrapper is pinned to a specific commit from KDE's invent.kde.org. The libwebp.so.6 is extracted from the Debian package and bundled. Overall this is a common AUR pattern for proprietary software distributed as Snap/AppImage/deb, with checksums present — the risk is real (prebuilt binary execution) but not elevated beyond the standard medium concern for such packaging approaches.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:70
source=("${pkgname}_${_snaprev}.snap::https://api.snapcraft.io/api/v1/snaps/download/${_snapid}_${_snaprev}.snap"
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt Snap package (a SquashFS containing compiled binaries) from api.snapcraft.io and a prebuilt Debian package from ftp.us.debian.org, then extracts and installs them directly into the system. Both are legitimate official sources (Canonical's Snap store API and Debian's official FTP mirror), so the cheaper model's concern about 'non-whitelisted hosts' is somewhat overstated — these are real vendor/distro infrastructure. However, the core concern remains valid: prebuilt binaries from a Snap package are being extracted and installed without any build-from-source step, meaning the user trusts Canonical's snap store signing/distribution chain rather than building from upstream source. The sha256sums are pinned, which mitigates tampering in transit. The appimage-exec-wrapper is pinned to a specific commit from KDE's invent.kde.org. The libwebp.so.6 is extracted from the Debian package and bundled. Overall this is a common AUR pattern for proprietary software distributed as Snap/AppImage/deb, with checksums present — the risk is real (prebuilt binary execution) but not elevated beyond the standard medium concern for such packaging approaches.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: username227 <gfrank227 [at] gmail [dot] com>
2
# Contributor: Ludvig Hozman <ludvig.hozman@gmail.com>
3
# Contributor: el-gazzle
4
# Contributor: Adam Hellberg <sharparam@sharparam.com>
5
6
pkgname=plex-desktop
7
pkgver=1.112.0.359
8
_pkghash=0d79a49f
9
_snapid=qc6MFRM433ZhI1XjVzErdHivhSOhlpf0
10
_snaprev=87
11
_execwrapper=appimage-exec-wrapper
12
pkgrel=1
13
pkgdesc="Plex desktop client for linux"
14
arch=('x86_64')
15
url='http://plex.tv'
16
license=('unknown')
17
depends=(libgl
18
hicolor-icon-theme
19
alsa-lib
20
dbus
21
expat
22
ffmpeg
23
fontconfig
24
freetype2
25
gcc-libs
26
glib2
27
glibc
28
harfbuzz
29
lcms2
30
libdrm
31
libjpeg-turbo
32
libwebp
33
libx11
34
libxcb
35
libxcomposite
36
libxdamage
37
libxext
38
libxfixes
39
libxkbcommon
40
libxkbfile
41
libxml2-legacy
42
libxrandr
43
libxslt
44
libxtst
45
mesa
46
minizip
47
nspr
48
nss
49
opus
50
xcb-util-renderutil
51
pciutils
52
libxss
53
xcb-util-image
54
libxkbcommon-x11
55
libxinerama
56
xcb-util-keysyms
57
xcb-util-wm
58
zlib
59
snappy
60
libva
61
libpulse
62
libxrender
63
wayland
64
qt6-base
65
)
66
makedepends=(
67
git
68
squashfs-tools
69
)
70
source=("${pkgname}_${_snaprev}.snap::https://api.snapcraft.io/api/v1/snaps/download/${_snapid}_${_snaprev}.snap"
71
"http://ftp.us.debian.org/debian/pool/main/libw/libwebp/libwebp6_0.6.1-2.1+deb11u2_amd64.deb"
72
"https://github.com/flathub/tv.plex.PlexDesktop/raw/master/tv.plex.PlexDesktop.desktop"
73
"https://github.com/flathub/tv.plex.PlexDesktop/raw/master/tv.plex.PlexDesktop.png"
74
"iconpatch.patch"
75
"launcher.patch"
76
"${_execwrapper}::git+https://invent.kde.org/brauch/appimage-exec-wrapper.git#commit=f8be7f43cfd5d4e81c8c888256b4efc1b269bb4c")
77
sha256sums=('b1ff3f3eeefc77cdfa2f0362f46ce00683235e7ef1873f90c09328d893a9b944'
78
'8abc2b1ca77a458bbbcdeb6af5d85316260977370fa2518d017222b3584d9653'
79
'2215f6bb3a2bbe50ceb3bedcb93f53d11f6a51ec7512f08f68af91da8253261b'
80
'565178841c318fb4926acf65a68df6dae484c0b705be6dd736858e7408a261d5'
81
'ba597b7083d64e3ffbcd610aec269a53cc404e4e6ec2a4d31064b5dbe75afb8b'
82
'f2e52b94e31cc2ed7b4e070024b4db9c7fce5e9909960a102100348167c6a288'
83
'5ffb1d27fcd19f75e97e1df5cc82bf791896ef326f207c8a6dd058999f858c05')
84
noextract=("${pkgname}_${_snaprev}.snap")
85
options=(!debug)
86
87
build() {
88
cd "$srcdir/$_execwrapper"
89
make
90
}
91
92
package() {
93
local _snapdir="${srcdir}/snap-extract"
94
95
rm -rf "${_snapdir}"
96
unsquashfs -d "${_snapdir}" "${srcdir}/${pkgname}_${_snaprev}.snap"
97
98
install -d "${pkgdir}/opt/${pkgname}"
99
100
for _dir in bin lib plugins qml resources data-dir; do
101
[[ -d "${_snapdir}/${_dir}" ]] && cp -a "${_snapdir}/${_dir}" "${pkgdir}/opt/${pkgname}/"
102
done
103
install -Dm755 "${_snapdir}/Plex.sh" "${pkgdir}/opt/${pkgname}/Plex.sh"
104
105
install -Dm644 "${_snapdir}/usr/lib/x86_64-linux-gnu/libwebp.so.6.0.2" \
106
"${pkgdir}/opt/${pkgname}/lib/libwebp.so.6"
107
108
install -Dm644 "$_execwrapper"/exec.so "${pkgdir}/opt/${pkgname}"/lib/exec.so
109
110
rm -rf "$pkgdir/opt/${pkgname}"/lib/dri
111
rm -rf "$pkgdir/opt/${pkgname}"/lib/libEGL.so*
112
rm -rf "$pkgdir/opt/${pkgname}"/lib/libdrm.so*
113
rm -rf "$pkgdir/opt/${pkgname}"/lib/libdrm_*.so*
114
rm -rf "$pkgdir/opt/${pkgname}"/lib/libpciaccess.so*
115
rm -rf "$pkgdir/opt/${pkgname}"/lib/libva.so*
116
rm -rf "$pkgdir/opt/${pkgname}"/lib/libva-*.so*
117
118
install -d "${pkgdir}"/usr/bin
119
ln -s /opt/${pkgname}/Plex.sh "${pkgdir}"/usr/bin/Plex
120
121
install -Dm644 "${srcdir}/tv.plex.PlexDesktop.desktop" -t "${pkgdir}/usr/share/applications"
122
install -Dm644 "${srcdir}/tv.plex.PlexDesktop.png" -t "${pkgdir}/usr/share/icons/hicolor/256x256/apps/"
123
patch "$pkgdir"/usr/share/applications/tv.plex.PlexDesktop.desktop "$srcdir"/iconpatch.patch
124
patch "$pkgdir/opt/${pkgname}"/Plex.sh "$srcdir"/launcher.patch
125
}
126
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |