proton-meet-bin
maintainer AlphaLynx
· 4 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt .deb from proton.me, a project-owned domain, but the binary nature of the artifact means a compromised source could lead to unreviewed code execution, though the domain legitimacy reduces risk.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
source=($_name-$pkgver.deb::https://proton.me/download/meet/linux/$pkgver/ProtonMeet-desktop.deb
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from proton.me, a project-owned domain, but the binary nature of the artifact means a compromised source could lead to unreviewed code execution, though the domain legitimacy reduces risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
2
3
pkgname=proton-meet-bin
4
_name=${pkgname%-bin}
5
pkgver=1.0.10
6
pkgrel=1
7
pkgdesc='Secure, end-to-end encrypted video conferencing'
8
arch=(any)
9
url='https://proton.me/meet'
10
license=(GPL-3.0-or-later)
11
_electron=electron39
12
depends=(bash $_electron xdg-utils)
13
provides=($_name)
14
conflicts=($_name)
15
source=($_name-$pkgver.deb::https://proton.me/download/meet/linux/$pkgver/ProtonMeet-desktop.deb
16
$_name.sh)
17
sha512sums=('7de2519bd29a6634d6f74055bee3bbbf4e696b69a803e9f986bd1ca2a5900a545896f5e6bf2d2848d4a44e5917d819c961e2293cc62ae854f35ee2d43ce41f53'
18
'558644ebe5a0fb43fead451e93b65f4006108ea76fb5241b591fe06951f9d1be742ef6fbac307d86020d132eeee3a2c182604351144f7c750fe4f275c876ae9b')
19
b2sums=('48d2562f24deb09428ff637ec404df46f79f74ea122d98f0e6fded49c9c5d0e6268ec2d7f6982a4b32db24b70d3b6bff9bce08de2d772aa9d35fa69df1abb714'
20
'cc16def864fd2e9134c194b473db94b0588871af895803fe4151ab7b715f66bbbb695a0964c03577da12b72397230626dabf186885cd206de412c8eac3a47e4a')
21
22
prepare() {
23
# Extract only the files we need
24
tar -xf data.tar.xz \
25
"./usr/lib/$_name/resources/" \
26
"./usr/lib/$_name/version" \
27
"./usr/share/applications/$_name.desktop" \
28
29
# Find out which major release of electron this version of proton-meet requires
30
local _electron_major=$(cat "usr/lib/$_name/version" | sed 's/^[~^]\?\([0-9]\+\)\(\.[0-9]\+\)*$/\1/')
31
32
# Check if we depend on the correct electron version
33
if [ "$_electron" != "electron$_electron_major" ] ; then
34
echo "Error: Incorrect electron version detected. Please change the value of \"_electron\" from \"$_electron\" to \"electron$_electron_major\"."
35
return 1
36
fi
37
38
# Specify electron version in launcher
39
sed -i "s|@ELECTRON@|$_electron|" "$srcdir/proton-meet.sh"
40
}
41
42
package() {
43
install -Dm755 $_name.sh "$pkgdir/usr/bin/$_name"
44
45
install -d "$pkgdir/usr/share/$_name"
46
cp usr/lib/proton-meet/resources/* "$pkgdir/usr/share/$_name/"
47
48
install -Dm644 usr/share/applications/$_name.desktop -t "$pkgdir/usr/share/applications"
49
}
50
Changes since previous scan
--- PKGBUILD @ 2026-06-19 19:07+++ PKGBUILD @ 2026-08-03 00:08@@ -2,21 +2,21 @@ pkgname=proton-meet-bin _name=${pkgname%-bin}-pkgver=1.0.9+pkgver=1.0.10 pkgrel=1 pkgdesc='Secure, end-to-end encrypted video conferencing' arch=(any) url='https://proton.me/meet' license=(GPL-3.0-or-later) _electron=electron39-depends=(bash $_electron hicolor-icon-theme xdg-utils)+depends=(bash $_electron xdg-utils) provides=($_name) conflicts=($_name) source=($_name-$pkgver.deb::https://proton.me/download/meet/linux/$pkgver/ProtonMeet-desktop.deb $_name.sh)-sha512sums=('0f1c0189d894b899a1370b7649e2a70763024397572f117817573ec3b7f9d9e9606e8a58aac4ed90779b85c2ec86bcfeb7483ded9e52d8afc7e76a45fe2c435d'+sha512sums=('7de2519bd29a6634d6f74055bee3bbbf4e696b69a803e9f986bd1ca2a5900a545896f5e6bf2d2848d4a44e5917d819c961e2293cc62ae854f35ee2d43ce41f53' '558644ebe5a0fb43fead451e93b65f4006108ea76fb5241b591fe06951f9d1be742ef6fbac307d86020d132eeee3a2c182604351144f7c750fe4f275c876ae9b')-b2sums=('4a1f632dd6fe691df56812af07498c43fca6c6cb2ff1894b205adc06d6cce4519bef7df6c428733d8a430c3a746ab8741add02618d96900407d3b269320d4d78'+b2sums=('48d2562f24deb09428ff637ec404df46f79f74ea122d98f0e6fded49c9c5d0e6268ec2d7f6982a4b32db24b70d3b6bff9bce08de2d772aa9d35fa69df1abb714' 'cc16def864fd2e9134c194b473db94b0588871af895803fe4151ab7b715f66bbbb695a0964c03577da12b72397230626dabf186885cd206de412c8eac3a47e4a') prepare() {@@ -25,7 +25,6 @@ "./usr/lib/$_name/resources/" \ "./usr/lib/$_name/version" \ "./usr/share/applications/$_name.desktop" \- "./usr/share/pixmaps/$_name.png" # Find out which major release of electron this version of proton-meet requires local _electron_major=$(cat "usr/lib/$_name/version" | sed 's/^[~^]\?\([0-9]\+\)\(\.[0-9]\+\)*$/\1/')@@ -47,6 +46,5 @@ cp usr/lib/proton-meet/resources/* "$pkgdir/usr/share/$_name/" install -Dm644 usr/share/applications/$_name.desktop -t "$pkgdir/usr/share/applications"- install -Dm644 usr/share/pixmaps/$_name.png "$pkgdir/usr/share/icons/hicolor/scalable/apps/$_name.svg" } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 21:55:56 | MEDIUM | 2 |
| 2026-06-19 19:07:35 | CLEAN | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |