rocketchat-server-standalone

maintainer VVL · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the official releases.rocket.chat domain, which is the project's own release infrastructure; building from this source is standard practice and not inherently dangerous despite the static analyzer flag for non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official releases.rocket.chat domain, which is the project's own release infrastructure; building from this source is standard practice and not inherently dangerous despite the static analyzer flag for non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("rocketchat-${pkgver}.tar::https://releases.rocket.chat/${pkgver}/download"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vladislav Minakov <v@minakov.pro>
    
      2
    
      3pkgname=rocketchat-server-standalone
    
      4pkgver=8.6.1
    
      5pkgrel=1
    
      6pkgdesc="The Ultimate Open Source WebChat Platform"
    
      7arch=("any")
    
      8url="https://github.com/RocketChat/Rocket.Chat"
    
      9license=("MIT")
    
      10depends=("mongodb" "graphicsmagick" "curl" "python3")
    
      11provides=(rocketchat-server)
    
      12conflicts=(rocketchat-server)
    
      13makedepends=("nvm")
    
      14backup=("etc/rocketchat-server.conf")
    
      15install="${pkgname}.install"
    
      16source=("rocketchat-${pkgver}.tar::https://releases.rocket.chat/${pkgver}/download"
    
      17    "rocketchat-server-standalone.install"
    
      18    "rocketchat-server.conf"
    
      19    "rocketchat-user.conf"
    
      20"rocketchat.service")
    
      21sha512sums=('3f84d3bc151aea6cea03f4f81bb7e05b537e983a5d651aeb2038f302f9fe87b4e2d64213a5fc4e18bb4c447fca8a8be0f48fac533d0d972a5844214416604fbb'
    
      22            '5a981ef5f4a0ecb3e21a62c368c4086c683e9eefda94b195d01d0c64c03f3b10a960ef41b1fc0d55d20848aa4fcd6e8c774118ac2d6d53e3e5b3772fe872a1c2'
    
      23            '4ff8899a47612a81f73c1c6449fb30a7ddfb0b199756db7f73e0a3078cf818b88e481fd828296b148a348d137ae529ce591d6c2bd6b57ae9278188e715086b59'
    
      24            '0086f72f16a594116586d4b6783b104f7bba779e4f8e31e5988c7fa67e1c7d9fc95215d0a04c4f24c72b4183774a9768a29b05c828990125dd4a3379a69aa648'
    
      25            'e3eedb9d4949f9498bd3a1710983ce91b811f0907946d43b93eff3fda88bfd831097355b40e7ebe4db3c44e01525e81b317e339a82ffc1611ea141516a09ccb7')
    
      26_node=20
    
      27
    
      28prepare() {
    
      29source /usr/share/nvm/init-nvm.sh
    
      30nvm install $_node
    
      31nvm use $_node
    
      32}
    
      33package() {
    
      34install -dm755 "${pkgdir}/usr/share/webapps/rocketchat-server"
    
      35cp -dr --preserve=mode --no-preserve=ownership ${srcdir}/bundle/* "${pkgdir}/usr/share/webapps/rocketchat-server"
    
      36pushd "${pkgdir}/usr/share/webapps/rocketchat-server/programs/server"
    
      37npm install --cache "${srcdir}/npm-cache"
    
      38popd
    
      39install -dm755 "${pkgdir}/usr/share/webapps/rocketchat-server/node"
    
      40cp -dr $(find ~/.nvm/versions/node/ -maxdepth 1 -type d -name "v${_node}.*" | sort -V | tail -n 1)/* "${pkgdir}/usr/share/webapps/rocketchat-server/node/"
    
      41install -Dm644 rocketchat-server.conf "${pkgdir}/etc/rocketchat-server.conf"
    
      42install -Dm644 rocketchat.service "${pkgdir}/usr/lib/systemd/system/rocketchat.service"
    
      43install -Dm644 rocketchat-user.conf "${pkgdir}/usr/lib/sysusers.d/rocketchat.conf"
    
      44}
    
      45

Changes since previous scan

--- PKGBUILD @ 2026-07-18 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Vladislav Minakov <v@minakov.pro>
 
 pkgname=rocketchat-server-standalone
-pkgver=8.5.1
+pkgver=8.6.1
 pkgrel=1
 pkgdesc="The Ultimate Open Source WebChat Platform"
 arch=("any")
@@ -18,7 +18,7 @@
     "rocketchat-server.conf"
     "rocketchat-user.conf"
 "rocketchat.service")
-sha512sums=('83db05320ab04e46c3e655b5852e6b9f294f87fff9afc71a06b2da22bb6ada58f8e4115125f81d46f7b4c469b2dfe835ec035c04a18ea9d6fe61598216cd003a'
+sha512sums=('3f84d3bc151aea6cea03f4f81bb7e05b537e983a5d651aeb2038f302f9fe87b4e2d64213a5fc4e18bb4c447fca8a8be0f48fac533d0d972a5844214416604fbb'
             '5a981ef5f4a0ecb3e21a62c368c4086c683e9eefda94b195d01d0c64c03f3b10a960ef41b1fc0d55d20848aa4fcd6e8c774118ac2d6d53e3e5b3772fe872a1c2'
             '4ff8899a47612a81f73c1c6449fb30a7ddfb0b199756db7f73e0a3078cf818b88e481fd828296b148a348d137ae529ce591d6c2bd6b57ae9278188e715086b59'
             '0086f72f16a594116586d4b6783b104f7bba779e4f8e31e5988c7fa67e1c7d9fc95215d0a04c4f24c72b4183774a9768a29b05c828990125dd4a3379a69aa648'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 07:57:03	MEDIUM	1
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2