rocketchat-server-standalone

LOW

maintainer VVL 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a prebuilt tarball from the official project's release domain (releases.rocket.chat), which is plausibly controlled by the project maintainers; although the host is not on a standard whitelist, it is not a personal or third-party file host, and the checksums are provided and verified, making the risk low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt tarball from the official project's release domain (releases.rocket.chat), which is plausibly controlled by the project maintainers; although the host is not on a standard whitelist, it is not a personal or third-party file host, and the checksums are provided and verified, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("rocketchat-${pkgver}.tar::https://releases.rocket.chat/${pkgver}/download"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vladislav Minakov <v@minakov.pro>
    
      2
    
      3pkgname=rocketchat-server-standalone
    
      4pkgver=8.7.1
    
      5pkgrel=1
    
      6pkgdesc="The Ultimate Open Source WebChat Platform"
    
      7arch=("any")
    
      8url="https://github.com/RocketChat/Rocket.Chat"
    
      9license=("MIT")
    
      10depends=("mongodb" "graphicsmagick" "curl" "python3")
    
      11provides=(rocketchat-server)
    
      12conflicts=(rocketchat-server)
    
      13makedepends=("nvm")
    
      14backup=("etc/rocketchat-server.conf")
    
      15install="${pkgname}.install"
    
      16source=("rocketchat-${pkgver}.tar::https://releases.rocket.chat/${pkgver}/download"
    
      17    "rocketchat-server-standalone.install"
    
      18    "rocketchat-server.conf"
    
      19    "rocketchat-user.conf"
    
      20"rocketchat.service")
    
      21sha512sums=('1bbc3e535c53583fa388fe88273b4534115a23dc31974628c6061da3f24259283d0a213b82737e73510f851f3a877dfaf7fcbf33bce391164c900a2a3abfa7b6'
    
      22            '5a981ef5f4a0ecb3e21a62c368c4086c683e9eefda94b195d01d0c64c03f3b10a960ef41b1fc0d55d20848aa4fcd6e8c774118ac2d6d53e3e5b3772fe872a1c2'
    
      23            '4ff8899a47612a81f73c1c6449fb30a7ddfb0b199756db7f73e0a3078cf818b88e481fd828296b148a348d137ae529ce591d6c2bd6b57ae9278188e715086b59'
    
      24            '0086f72f16a594116586d4b6783b104f7bba779e4f8e31e5988c7fa67e1c7d9fc95215d0a04c4f24c72b4183774a9768a29b05c828990125dd4a3379a69aa648'
    
      25            'e3eedb9d4949f9498bd3a1710983ce91b811f0907946d43b93eff3fda88bfd831097355b40e7ebe4db3c44e01525e81b317e339a82ffc1611ea141516a09ccb7')
    
      26_node=20
    
      27
    
      28prepare() {
    
      29source /usr/share/nvm/init-nvm.sh
    
      30nvm install $_node
    
      31nvm use $_node
    
      32}
    
      33package() {
    
      34install -dm755 "${pkgdir}/usr/share/webapps/rocketchat-server"
    
      35cp -dr --preserve=mode --no-preserve=ownership ${srcdir}/bundle/* "${pkgdir}/usr/share/webapps/rocketchat-server"
    
      36pushd "${pkgdir}/usr/share/webapps/rocketchat-server/programs/server"
    
      37npm install --cache "${srcdir}/npm-cache"
    
      38popd
    
      39install -dm755 "${pkgdir}/usr/share/webapps/rocketchat-server/node"
    
      40cp -dr $(find ~/.nvm/versions/node/ -maxdepth 1 -type d -name "v${_node}.*" | sort -V | tail -n 1)/* "${pkgdir}/usr/share/webapps/rocketchat-server/node/"
    
      41install -Dm644 rocketchat-server.conf "${pkgdir}/etc/rocketchat-server.conf"
    
      42install -Dm644 rocketchat.service "${pkgdir}/usr/lib/systemd/system/rocketchat.service"
    
      43install -Dm644 rocketchat-user.conf "${pkgdir}/usr/lib/sysusers.d/rocketchat.conf"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2