plex-media-server

maintainer fryfrog · 346 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads official Plex Media Server binaries from the vendor's own domain (plex.tv), which is the legitimate source; despite the static analyzer flag, this is a standard and trusted practice for distributing prebuilt binaries.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads official Plex Media Server binaries from the vendor's own domain (plex.tv), which is the legitimate source; despite the static analyzer flag, this is a standard and trusted practice for distributing prebuilt binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 source_aarch64=("https://downloads.plex.tv/plex-media-server-new/${pkgver}-${_pkgsum}/debian/plexmediaserver_${pkgver}-${_pkgsum}_arm64.deb")

PKGBUILD

1 offending line(s) highlighted

      1
    
      2# Maintainer: Donald Webster <fryfrog@gmail.com>
    
      3# Contributor: Tom Moore <t.moore01@gmail.com>
    
      4# Contributor: Mikael Eriksson <mikael_eriksson@miffe.org>
    
      5# Contributor: Maxime Gauduin <alucryd@archlinux.org>
    
      6# Contributor: Rob Sletten <rsletten@gmail.com>
    
      7# Contributor: monty <linksoft@gmx.de>
    
      8# Contributor: Jon Wiersma <archaur@jonw.org>
    
      9# Contributor: Arthur <arthur.darcet@m4x.org>
    
      10# Contributor: Praekon <praekon@googlemail.com>
    
      11
    
      12pkgname=plex-media-server
    
      13pkgver=1.43.3.10861
    
      14_pkgsum=07dfddaeb
    
      15pkgrel=1
    
      16pkgdesc='The back-end media server component of Plex.'
    
      17arch=('x86_64' 'i686' 'armv7h' 'aarch64')
    
      18url='https://plex.tv/'
    
      19license=('custom')
    
      20options=('!emptydirs'  '!strip' 'staticlibs')
    
      21conflicts=('plex-media-server-plexpass')
    
      22backup=('etc/conf.d/plexmediaserver')
    
      23install='plex-media-server.install'
    
      24source=('plexmediaserver.conf.d'
    
      25        'plexmediaserver.service'
    
      26        'plexmediaserver.hook'
    
      27        'plex.sysusers'
    
      28        'plex.tmpfiles'
    
      29        'terms.txt')
    
      30
    
      31source_aarch64=("https://downloads.plex.tv/plex-media-server-new/${pkgver}-${_pkgsum}/debian/plexmediaserver_${pkgver}-${_pkgsum}_arm64.deb")
    
      32source_armv7h=("https://downloads.plex.tv/plex-media-server-new/${pkgver}-${_pkgsum}/debian/plexmediaserver_${pkgver}-${_pkgsum}_armhf.deb")
    
      33source_x86_64=("https://downloads.plex.tv/plex-media-server-new/${pkgver}-${_pkgsum}/redhat/plexmediaserver-${pkgver}-${_pkgsum}.x86_64.rpm")
    
      34source_i686=("https://downloads.plex.tv/plex-media-server-new/${pkgver}-${_pkgsum}/redhat/plexmediaserver-${pkgver}-${_pkgsum}.i686.rpm")
    
      35
    
      36sha256sums=('398ba7958598609453f5289b3d5f2389d2756158b340cf28e83c39d9ed60280b'
    
      37            '525b4b3b7db69c4abf696116c9f41d7a3cb3b572186200d0720bb96ec155fbd4'
    
      38            'a94c798e3a1b5614020e3dd6ec80d378c0401fa08f411769527ad87a6898e80c'
    
      39            'c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557'
    
      40            'b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad'
    
      41            'dbfb5a9a7146a975863c0932f1a68c4b040ec5d7e693361f39ddfbf60885e631')
    
      42sha256sums_x86_64=('2c1ff73ffd2ab8c8523fb5d37394c3cccffe0e8bd662b8a78749a7385874fb6b')
    
      43sha256sums_i686=('2d22d0061aefa7c9662fb86f6fcc19f02e6e2478f5b0fadc2dad24c4bd9d371c')
    
      44sha256sums_armv7h=('f22851c1611d03df736fd0cd9af0bc15f53c8767fd1ff69a85febbaeb22feab9')
    
      45sha256sums_aarch64=('2d4006110e55cd3920c82d8aec83db21b943d57430a94db486ffbd01902f15ae')
    
      46
    
      47prepare() {
    
      48  if [[ $CARCH = armv7h ]] || [[ $CARCH = aarch64 ]]; then
    
      49    bsdtar -xf data.tar.xz
    
      50  fi
    
      51}
    
      52
    
      53package() {
    
      54  install -d -m 755 "${pkgdir}/usr/lib/plexmediaserver"
    
      55  cp -dr --no-preserve='ownership' "${srcdir}/usr/lib/plexmediaserver" "${pkgdir}/usr/lib/"
    
      56
    
      57  install -D -m 644 "${srcdir}/plexmediaserver.conf.d" "${pkgdir}/etc/conf.d/plexmediaserver"
    
      58  install -D -m 644 "${srcdir}/plexmediaserver.service" "${pkgdir}/usr/lib/systemd/system/plexmediaserver.service"
    
      59  install -D -m 644 "${srcdir}/plex.sysusers" "${pkgdir}/usr/lib/sysusers.d/plex.conf"
    
      60  install -D -m 644 "${srcdir}/plex.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/plex.conf"
    
      61
    
      62  install -D -m 644 "${srcdir}/terms.txt" "${pkgdir}/usr/share/licenses/${pkgname}/terms.txt"
    
      63  install -D -m 644 "${srcdir}/plexmediaserver.hook" "${pkgdir}/usr/share/doc/${pkgname}/plexmediaserver.hook"
    
      64}
    
      65
    
      66# vim: ts=2 sw=2 et:
    
      67

Changes since previous scan

--- PKGBUILD @ 2026-07-15 00:09
+++ PKGBUILD @ 2026-08-18 00:03
@@ -10,8 +10,8 @@
 # Contributor: Praekon <praekon@googlemail.com>
 
 pkgname=plex-media-server
-pkgver=1.43.3.10828
-_pkgsum=00f62d37d
+pkgver=1.43.3.10861
+_pkgsum=07dfddaeb
 pkgrel=1
 pkgdesc='The back-end media server component of Plex.'
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')
@@ -39,10 +39,10 @@
             'c597bee0bcbb59ed791651555a904e5f7e9d2e82f6c6986b6352e5fc38e5b557'
             'b7ff6525a3c7a8be885edc85bb523095f8e25ddb38873127e2a4e97b28f2c7ad'
             'dbfb5a9a7146a975863c0932f1a68c4b040ec5d7e693361f39ddfbf60885e631')
-sha256sums_x86_64=('2ff1d3e1ac1052cfadfcaa932c17f6fa775e625859aa93224c85983f00052183')
-sha256sums_i686=('6ec375fe8d4de3bd5f3734865b6aa4245a791d7029a1216362f0625c5354cf1f')
-sha256sums_armv7h=('a24a65361bb28ebeecadf82d4c02d023ee9b3a34ee2baa0635bfc51e1d01b1be')
-sha256sums_aarch64=('f08c0ae850e331fa8204e9aa88226598d8da9181ae91f97fe01f76964ba962a0')
+sha256sums_x86_64=('2c1ff73ffd2ab8c8523fb5d37394c3cccffe0e8bd662b8a78749a7385874fb6b')
+sha256sums_i686=('2d22d0061aefa7c9662fb86f6fcc19f02e6e2478f5b0fadc2dad24c4bd9d371c')
+sha256sums_armv7h=('f22851c1611d03df736fd0cd9af0bc15f53c8767fd1ff69a85febbaeb22feab9')
+sha256sums_aarch64=('2d4006110e55cd3920c82d8aec83db21b943d57430a94db486ffbd01902f15ae')
 
 prepare() {
   if [[ $CARCH = armv7h ]] || [[ $CARCH = aarch64 ]]; then

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 15:21:23	LOW	2
2026-07-15 00:09:25	CLEAN	2
2026-07-14 15:45:30	LOW	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	LOW	1