proton-meet
MEDIUM
maintainer AlphaLynx
1 votes
scanned 2026-10-23 07:37:02.440193
Why flagged
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:36
pnpm install --frozen-lockfile --filter 'proton-meet-desktop...' --ignore-scripts --trust-lockfile \
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
2
3
pkgname=proton-meet
4
pkgver=1.0.14
5
pkgrel=1
6
pkgdesc='Secure, end-to-end encrypted video conferencing'
7
arch=(any)
8
url='https://proton.me/meet'
9
license=(GPL-3.0-or-later)
10
_electron=electron43
11
depends=(bash $_electron hicolor-icon-theme)
12
makedepends=(git jq nodejs-lts-krypton pnpm)
13
source=(ProtonWebClients::git+https://github.com/ProtonMail/WebClients.git#tag=proton-meet-desktop@$pkgver
14
proton-meet.desktop
15
proton-meet.sh)
16
b2sums=('c22d1338e74a34a73aa93f295c8094334f6262405af2fd13f570af3aa08b7480c7de36b4a3d5cade0d376bed710bba1035394f37b20acdaf5cec7bb1e9e2cdf4'
17
'efdcc089844bf0287c61e7d5f8c6aa9f5721a6000751b887a586f3a5b5caf36686500b09c10dc3039e6914be804c155edf67a0be17640602221d96a25e1a197c'
18
'cc16def864fd2e9134c194b473db94b0588871af895803fe4151ab7b715f66bbbb695a0964c03577da12b72397230626dabf186885cd206de412c8eac3a47e4a')
19
20
prepare() {
21
cd ProtonWebClients
22
23
# Find out which major release of electron this version of proton-mail requires
24
local _electron_major=$(jq --raw-output '.devDependencies.electron' < "applications/meet-desktop/package.json" | sed 's/^[~^]\?\([0-9]\+\)\(\.[0-9]\+\)*$/\1/')
25
26
# Check if we depend on the correct electron version
27
if [ "$_electron" != "electron$_electron_major" ] ; then
28
echo "Error: Incorrect electron version detected. Please change the value of \"_electron\" from \"$_electron\" to \"electron$_electron_major\"."
29
return 1
30
fi
31
32
# Specify electron version in launcher
33
sed -i "s|@ELECTRON@|$_electron|" "$srcdir/proton-meet.sh"
34
35
sed -i '/tarball: https:\/\/nexus\.protontech\.ch/s/, tarball: [^}]*//' pnpm-lock.yaml
36
pnpm install --frozen-lockfile --filter 'proton-meet-desktop...' --ignore-scripts --trust-lockfile \
37
--config.@protontech:registry=https://registry.npmjs.org/ \
38
--config.@proton-meet:registry=https://registry.npmjs.org/ \
39
--store-dir "$srcdir/.pnpm-store"
40
}
41
42
build() {
43
cd ProtonWebClients
44
pnpm --filter proton-meet-desktop run package
45
}
46
47
check() {
48
cd ProtonWebClients
49
pnpm --filter proton-meet-desktop run test
50
}
51
52
package() {
53
install -Dm755 $pkgname.sh "$pkgdir/usr/bin/$pkgname"
54
install -Dm644 $pkgname.desktop -t "$pkgdir/usr/share/applications"
55
56
cd ProtonWebClients/applications/meet-desktop
57
install -d "$pkgdir/usr/share/$pkgname"
58
cp out/"Proton Meet"-linux-*/resources/* "$pkgdir/usr/share/$pkgname/"
59
60
cd assets
61
install -Dm644 icons/icon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
62
install -Dm644 icons/icon@2x.png "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/$pkgname.png"
63
install -Dm644 linux/icon.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/$pkgname.svg"
64
}
65
Changes since previous scan
--- PKGBUILD @ 2026-10-05 23:40+++ PKGBUILD @ 2026-10-23 07:37@@ -1,7 +1,7 @@ # Maintainer: AlphaLynx <alphalynx at alphalynx dot dev> pkgname=proton-meet-pkgver=1.0.12+pkgver=1.0.14 pkgrel=1 pkgdesc='Secure, end-to-end encrypted video conferencing' arch=(any)@@ -9,11 +9,11 @@ license=(GPL-3.0-or-later) _electron=electron43 depends=(bash $_electron hicolor-icon-theme)-makedepends=(git jq nodejs-lts-jod yarn)+makedepends=(git jq nodejs-lts-krypton pnpm) source=(ProtonWebClients::git+https://github.com/ProtonMail/WebClients.git#tag=proton-meet-desktop@$pkgver proton-meet.desktop proton-meet.sh)-b2sums=('5dffb0b142f92c355044f499e4c3945144278abff767e503a8e004b2f3b6c8a3f57f5c8b20e5ad862138f6affae92842c01fccf1a80e575c796cbe2cf960dea6'+b2sums=('c22d1338e74a34a73aa93f295c8094334f6262405af2fd13f570af3aa08b7480c7de36b4a3d5cade0d376bed710bba1035394f37b20acdaf5cec7bb1e9e2cdf4' 'efdcc089844bf0287c61e7d5f8c6aa9f5721a6000751b887a586f3a5b5caf36686500b09c10dc3039e6914be804c155edf67a0be17640602221d96a25e1a197c' 'cc16def864fd2e9134c194b473db94b0588871af895803fe4151ab7b715f66bbbb695a0964c03577da12b72397230626dabf186885cd206de412c8eac3a47e4a') @@ -32,22 +32,21 @@ # Specify electron version in launcher sed -i "s|@ELECTRON@|$_electron|" "$srcdir/proton-meet.sh" - # Configure Yarn workspaces to build only meet-desktop instead of all applications- sed -i 's/"applications\/\*",/"applications\/meet-desktop",/' package.json-- export YARN_CACHE_FOLDER="$srcdir/.yarn-cache"- export SENTRYCLI_SKIP_DOWNLOAD=1- yarn install+ sed -i '/tarball: https:\/\/nexus\.protontech\.ch/s/, tarball: [^}]*//' pnpm-lock.yaml+ pnpm install --frozen-lockfile --filter 'proton-meet-desktop...' --ignore-scripts --trust-lockfile \+ --config.@protontech:registry=https://registry.npmjs.org/ \+ --config.@proton-meet:registry=https://registry.npmjs.org/ \+ --store-dir "$srcdir/.pnpm-store" } build() { cd ProtonWebClients- yarn workspace proton-meet-desktop package+ pnpm --filter proton-meet-desktop run package } check() { cd ProtonWebClients- yarn workspace proton-meet-desktop test+ pnpm --filter proton-meet-desktop run test } package() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-23 07:37:02 | Medium | 1 |
| 2026-10-05 23:40:58 | Clean | 0 |
| 2026-09-25 23:13:47 | Clean | 0 |
| 2026-09-16 23:24:19 | Clean | 0 |
| 2026-07-17 21:55:56 | Clean | 0 |
| 2026-06-18 16:11:54 | Clean | 0 |