proton-meet-bin

MEDIUM

maintainer AlphaLynx 4 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard host (proton.me/download/meet/linux), which is an unverifiable executable artifact; if the host were compromised, an attacker could silently replace the binary, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=($_name-$pkgver.deb::https://proton.me/download/meet/linux/$pkgver/ProtonMeet-desktop.deb

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard host (proton.me/download/meet/linux), which is an unverifiable executable artifact; if the host were compromised, an attacker could silently replace the binary, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
    
      2
    
      3pkgname=proton-meet-bin
    
      4_name=${pkgname%-bin}
    
      5pkgver=1.0.14
    
      6pkgrel=1
    
      7pkgdesc='Secure, end-to-end encrypted video conferencing'
    
      8arch=(any)
    
      9url='https://proton.me/meet'
    
      10license=(GPL-3.0-or-later)
    
      11_electron=electron43
    
      12depends=(bash $_electron hicolor-icon-theme xdg-utils)
    
      13provides=($_name)
    
      14conflicts=($_name)
    
      15source=($_name-$pkgver.deb::https://proton.me/download/meet/linux/$pkgver/ProtonMeet-desktop.deb
    
      16        $_name.sh)
    
      17sha512sums=('883f0375567275b252e202c4a4e4114a0ac44a61fab62058dd8e1eb6f5e55be1b8db50ff675ac4cecbd5045390ba7b0c4c43960105e39a695cfec2a9de73ff52'
    
      18            '558644ebe5a0fb43fead451e93b65f4006108ea76fb5241b591fe06951f9d1be742ef6fbac307d86020d132eeee3a2c182604351144f7c750fe4f275c876ae9b')
    
      19b2sums=('63e875d1fe73a91bd51cc44539ce277f8d174ad26b51d25403b865cefe06ce93e41786582974f5674693372f4a798ddd66d9087ef1d1edc0ac39b5d7c32fe3ce'
    
      20        'cc16def864fd2e9134c194b473db94b0588871af895803fe4151ab7b715f66bbbb695a0964c03577da12b72397230626dabf186885cd206de412c8eac3a47e4a')
    
      21
    
      22prepare() {
    
      23    # Extract only the files we need
    
      24    tar -xf data.tar.xz \
    
      25        "./usr/lib/$_name/resources/" \
    
      26        "./usr/lib/$_name/version" \
    
      27        "./usr/share/applications/$_name.desktop" \
    
      28        "./usr/share/icons"
    
      29
    
      30    # Find out which major release of electron this version of proton-meet requires
    
      31    local _electron_major=$(cat "usr/lib/$_name/version" | sed 's/^[~^]\?\([0-9]\+\)\(\.[0-9]\+\)*$/\1/')
    
      32
    
      33    # Check if we depend on the correct electron version
    
      34    if [ "$_electron" != "electron$_electron_major" ] ; then
    
      35        echo "Error: Incorrect electron version detected. Please change the value of \"_electron\" from \"$_electron\" to \"electron$_electron_major\"."
    
      36        return 1
    
      37    fi
    
      38
    
      39    # Specify electron version in launcher
    
      40    sed -i "s|@ELECTRON@|$_electron|" "$srcdir/proton-meet.sh"
    
      41}
    
      42
    
      43package() {
    
      44    install -Dm755 $_name.sh "$pkgdir/usr/bin/$_name"
    
      45
    
      46    install -d "$pkgdir/usr/share/$_name"
    
      47    cp usr/lib/proton-meet/resources/* "$pkgdir/usr/share/$_name/"
    
      48    cp -a usr/share/icons "$pkgdir/usr/share/"
    
      49
    
      50    install -Dm644 usr/share/applications/$_name.desktop -t "$pkgdir/usr/share/applications"
    
      51}
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-10-14 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,8 +2,8 @@
 
 pkgname=proton-meet-bin
 _name=${pkgname%-bin}
-pkgver=1.0.11
-pkgrel=2
+pkgver=1.0.14
+pkgrel=1
 pkgdesc='Secure, end-to-end encrypted video conferencing'
 arch=(any)
 url='https://proton.me/meet'
@@ -14,9 +14,9 @@
 conflicts=($_name)
 source=($_name-$pkgver.deb::https://proton.me/download/meet/linux/$pkgver/ProtonMeet-desktop.deb
         $_name.sh)
-sha512sums=('92e56382abc334913c42a4fd9e3d889d5b306bddce75e2c38cd79210d4788d0549167b5b2c407c3a67f71bb2779ecf870e77dc29c3b9ca4cdcf99e2193325972'
+sha512sums=('883f0375567275b252e202c4a4e4114a0ac44a61fab62058dd8e1eb6f5e55be1b8db50ff675ac4cecbd5045390ba7b0c4c43960105e39a695cfec2a9de73ff52'
             '558644ebe5a0fb43fead451e93b65f4006108ea76fb5241b591fe06951f9d1be742ef6fbac307d86020d132eeee3a2c182604351144f7c750fe4f275c876ae9b')
-b2sums=('d01f7b8d84fd899163e9dde8d3e86acc92662e222dbe1aa8d5cbe5692cc0b2ea2912fd768d05c24525e92074decd6c9a3e0594f64f4b33c54a7c47e073fd7865'
+b2sums=('63e875d1fe73a91bd51cc44539ce277f8d174ad26b51d25403b865cefe06ce93e41786582974f5674693372f4a798ddd66d9087ef1d1edc0ac39b5d7c32fe3ce'
         'cc16def864fd2e9134c194b473db94b0588871af895803fe4151ab7b715f66bbbb695a0964c03577da12b72397230626dabf186885cd206de412c8eac3a47e4a')
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 01:18:27	Medium	2
2026-10-14 00:06:47	Medium	2