rmeet

maintainer ernest · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from rmeetapp.crc.com.cn, which appears to be the vendor's own download server (the project URL is rmeet.crc.com.cn, same domain crc.com.cn). This is consistent with a legitimate vendor hosting their own software on a subdomain. However, the package installs a closed-source prebuilt binary (an Electron/native app from the .deb) directly into the system, with only an MD5 checksum (weak, collision-prone) for integrity verification. There is no GPG signature verification. The binary is executed code from a Chinese corporate host with no reproducibility. This is a genuine medium-risk supply-chain concern: not because the host is clearly unofficial (it shares the same domain as the project URL), but because it is a prebuilt closed-source binary with weak integrity checking from a single corporate host that could silently swap the artifact. This is the standard AUR pattern for proprietary software distributed as .deb, but the weak checksum and lack of signature keep it at medium rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("https://rmeetapp.crc.com.cn/downloads/apps/linux/x86/Rmeet-v${pkgver}-${pkgrel}-x86-prod-setup.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from rmeetapp.crc.com.cn, which appears to be the vendor's own download server (the project URL is rmeet.crc.com.cn, same domain crc.com.cn). This is consistent with a legitimate vendor hosting their own software on a subdomain. However, the package installs a closed-source prebuilt binary (an Electron/native app from the .deb) directly into the system, with only an MD5 checksum (weak, collision-prone) for integrity verification. There is no GPG signature verification. The binary is executed code from a Chinese corporate host with no reproducibility. This is a genuine medium-risk supply-chain concern: not because the host is clearly unofficial (it shares the same domain as the project URL), but because it is a prebuilt closed-source binary with weak integrity checking from a single corporate host that could silently swap the artifact. This is the standard AUR pattern for proprietary software distributed as .deb, but the weak checksum and lack of signature keep it at medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ernest <307141632@qq.com>
    
      2pkgname=rmeet
    
      3pkgdesc="Rmeet" 
    
      4pkgver=2.0.0
    
      5pkgrel=1
    
      6arch=('x86_64')
    
      7url="https://rmeet.crc.com.cn/"
    
      8license=('LicenseRef-rmeet')
    
      9source=("https://rmeetapp.crc.com.cn/downloads/apps/linux/x86/Rmeet-v${pkgver}-${pkgrel}-x86-prod-setup.deb")
    
      10
    
      11md5sums=('25c7e5c4d0db1c880414eec936c88f4f')
    
      12options=('!strip' '!debug')
    
      13DLAGENTS=('https::/usr/bin/curl -A "Mozilla/5.0" -fLC - --retry 3 --retry-delay 3 -o %o %u')
    
      14prepare() {
    
      15    mv "Rmeet-v${pkgver}-${pkgrel}-x86-prod-setup.deb" "${pkgver}.deb"
    
      16    ar -x "${pkgver}.deb"
    
      17    mkdir -p "${pkgname}-${pkgver}"
    
      18
    
      19    tar -xf data.tar.xz --directory="${pkgname}-${pkgver}"
    
      20}
    
      21
    
      22package() {
    
      23    cd "$pkgname-$pkgver"
    
      24    rm -f opt/Rmeet/libm.so
    
      25    rm -f opt/Rmeet/libm.so.6
    
      26    rm -f opt/Rmeet/libm-2.31.so
    
      27    rm -f opt/Rmeet/libstdc++.so.6
    
      28    rm -f opt/Rmeet/libstdc++.so.6.0.28
    
      29    cp -r ./ ${pkgdir}/
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2