stremio
LOW
maintainer dbermond
85 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The downloaded server.js and stremio.asar are part of the official Stremio application bundle from the project's own domain (dl.strem.io), used as intended assets; checksums are provided for both, and the build integrates them in a standard, transparent way without code execution at build time.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The downloaded server.js and stremio.asar are part of the official Stremio application bundle from the project's own domain (dl.strem.io), used as intended assets; checksums are provided for both, and the build integrates them in a standard, transparent way without code execution at build time.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
"stremio-${_serverjs_ver}-server.js"::"https://dl.strem.io/four/v${_serverjs_ver}/server.js"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Daniel Bermond <dbermond@archlinux.org>
2
3
pkgname=stremio
4
pkgver=4.4.183
5
pkgrel=1
6
_serverjs_ver=4.4.172
7
pkgdesc='A one-stop hub for video content aggregation (Movies, TV shows, series, live television or web channels)'
8
arch=('x86_64')
9
url='https://www.stremio.com/'
10
license=('GPL-3.0-only')
11
depends=(
12
'glibc'
13
'hicolor-icon-theme'
14
'libgcc'
15
'libstdc++'
16
'mpv'
17
'nodejs'
18
'openssl'
19
'qt5-base'
20
'qt5-declarative'
21
'qt5-webengine'
22
'qt5-quickcontrols'
23
'qt5-quickcontrols2'
24
'qt5-translations'
25
'qt5-webchannel')
26
makedepends=(
27
'cmake'
28
'git'
29
'librsvg')
30
source=("git+https://github.com/Stremio/stremio-shell.git#tag=v${pkgver}"
31
'git+https://github.com/Ivshti/libmpv.git'
32
'git+https://github.com/itay-grudev/SingleApplication.git'
33
"stremio-${_serverjs_ver}-server.js"::"https://dl.strem.io/four/v${_serverjs_ver}/server.js"
34
"stremio-${_serverjs_ver}-stremio.asar"::"https://dl.strem.io/four/v${_serverjs_ver}/stremio.asar"
35
'010-stremio-do-not-download-server-js.patch')
36
sha256sums=('c98f9aaa299b6a0b812809cd380073d55f302e9972e4f8420512ebd587f1378b'
37
'SKIP'
38
'SKIP'
39
'08d5510a771c3d07a8b1f9c0e521324551d6055b001c5a56c7a79e3e3e0474ef'
40
'a6cb74bd82323ecaa898323c0b710d4297ebad50dd4f2389d84b8426ef6d943a'
41
'b5eff88b30d8c6030e36ca4949ebf6ff9515efbedc0b9bc748110cd1fbc0671a')
42
43
prepare() {
44
git -C stremio-shell submodule init
45
git -C stremio-shell config --local submodule.deps/libmpv.url "${srcdir}/libmpv"
46
git -C stremio-shell config --local submodule.deps/singleapplication.url "${srcdir}/SingleApplication"
47
git -C stremio-shell -c protocol.file.allow='always' submodule update
48
49
# do not download server.js during 'make'
50
ln -s "../stremio-${_serverjs_ver}-server.js" stremio-shell/server.js
51
patch -d stremio-shell -Np1 -i "${srcdir}/010-stremio-do-not-download-server-js.patch"
52
}
53
54
build() {
55
make -C stremio-shell -f release.makefile PREFIX="$pkgdir"
56
}
57
58
package() {
59
make -C stremio-shell -f release.makefile PREFIX="$pkgdir" install
60
61
# streaming server files
62
install -D -m644 "stremio-${_serverjs_ver}-server.js" "${pkgdir}/opt/stremio/server.js"
63
install -D -m644 "stremio-${_serverjs_ver}-stremio.asar" "${pkgdir}/opt/stremio/stremio.asar"
64
65
# binary and desktop file
66
install -d -m755 "${pkgdir}/usr/"{bin,share/applications}
67
ln -sr "${pkgdir}/opt/stremio/stremio" "${pkgdir}/usr/bin/stremio"
68
ln -sr "${pkgdir}/opt/stremio/smartcode-stremio.desktop" "${pkgdir}/usr/share/applications/com.stremio.stremio.desktop"
69
70
# icons
71
local _file
72
local _res
73
while read -r -d '' _file
74
do
75
_res="$(printf '%s' "$_file" | sed 's/\.png$//;s/^.*_//')"
76
install -d -m755 "${pkgdir}/usr/share/icons/hicolor/${_res}x${_res}/apps"
77
ln -sr "${pkgdir}/opt/stremio/icons/smartcode-stremio_${_res}.png" \
78
"${pkgdir}/usr/share/icons/hicolor/${_res}x${_res}/apps/smartcode-stremio.png"
79
ln -sr "${pkgdir}/opt/stremio/icons/smartcode-stremio-tray_${_res}.png" \
80
"${pkgdir}/usr/share/icons/hicolor/${_res}x${_res}/apps/smartcode-stremio-tray.png"
81
done < <(find "${pkgdir}/opt/stremio/icons" -maxdepth 1 -type f -name 'smartcode-stremio_*.png' -print0)
82
}
83
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |