stremio

maintainer dbermond · 86 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The downloaded server.js and stremio.asar are part of the official Stremio application bundle from the project's own domain (dl.strem.io), used as intended assets; checksums are provided for both, and the build integrates them in a standard, transparent way without code execution at build time.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The downloaded server.js and stremio.asar are part of the official Stremio application bundle from the project's own domain (dl.strem.io), used as intended assets; checksums are provided for both, and the build integrates them in a standard, transparent way without code execution at build time.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 "stremio-${_serverjs_ver}-server.js"::"https://dl.strem.io/four/v${_serverjs_ver}/server.js"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Daniel Bermond <dbermond@archlinux.org>
    
      2
    
      3pkgname=stremio
    
      4pkgver=4.4.183
    
      5pkgrel=1
    
      6_serverjs_ver=4.4.172
    
      7pkgdesc='A one-stop hub for video content aggregation (Movies, TV shows, series, live television or web channels)'
    
      8arch=('x86_64')
    
      9url='https://www.stremio.com/'
    
      10license=('GPL-3.0-only')
    
      11depends=(
    
  'glibc'
    
  'hicolor-icon-theme'
    
  'libgcc'
    
  'libstdc++'
    
  'mpv'
    
  'nodejs'
    
  'openssl'
    
  'qt5-base'
    
  'qt5-declarative'
    
  'qt5-webengine'
    
  'qt5-quickcontrols'
    
  'qt5-quickcontrols2'
    
  'qt5-translations'
    
  'qt5-webchannel')
    
      26makedepends=(
    
  'cmake'
    
  'git'
    
  'librsvg')
    
      30source=("git+https://github.com/Stremio/stremio-shell.git#tag=v${pkgver}"
    
      'git+https://github.com/Ivshti/libmpv.git'
    
      'git+https://github.com/itay-grudev/SingleApplication.git'
    
      "stremio-${_serverjs_ver}-server.js"::"https://dl.strem.io/four/v${_serverjs_ver}/server.js"
    
      "stremio-${_serverjs_ver}-stremio.asar"::"https://dl.strem.io/four/v${_serverjs_ver}/stremio.asar"
    
      '010-stremio-do-not-download-server-js.patch')
    
      36sha256sums=('c98f9aaa299b6a0b812809cd380073d55f302e9972e4f8420512ebd587f1378b'
    
          'SKIP'
    
          'SKIP'
    
          '08d5510a771c3d07a8b1f9c0e521324551d6055b001c5a56c7a79e3e3e0474ef'
    
          'a6cb74bd82323ecaa898323c0b710d4297ebad50dd4f2389d84b8426ef6d943a'
    
          'b5eff88b30d8c6030e36ca4949ebf6ff9515efbedc0b9bc748110cd1fbc0671a')
    
      42
    
      43prepare() {
    
  git -C stremio-shell submodule init
    
  git -C stremio-shell config --local submodule.deps/libmpv.url "${srcdir}/libmpv"
    
  git -C stremio-shell config --local submodule.deps/singleapplication.url "${srcdir}/SingleApplication"
    
  git -C stremio-shell -c protocol.file.allow='always' submodule update
    
  
    
  # do not download server.js during 'make'
    
  ln -s "../stremio-${_serverjs_ver}-server.js" stremio-shell/server.js
    
  patch -d stremio-shell -Np1 -i "${srcdir}/010-stremio-do-not-download-server-js.patch"
    
      52}
    
      53
    
      54build() {
    
  make -C stremio-shell -f release.makefile PREFIX="$pkgdir"
    
      56}
    
      57
    
      58package() {
    
  make -C stremio-shell -f release.makefile PREFIX="$pkgdir" install
    
  
    
  # streaming server files
    
  install -D -m644 "stremio-${_serverjs_ver}-server.js"    "${pkgdir}/opt/stremio/server.js"
    
  install -D -m644 "stremio-${_serverjs_ver}-stremio.asar" "${pkgdir}/opt/stremio/stremio.asar"
    
  
    
  # binary and desktop file
    
  install -d -m755 "${pkgdir}/usr/"{bin,share/applications}
    
  ln -sr "${pkgdir}/opt/stremio/stremio" "${pkgdir}/usr/bin/stremio"
    
  ln -sr "${pkgdir}/opt/stremio/smartcode-stremio.desktop" "${pkgdir}/usr/share/applications/com.stremio.stremio.desktop"
    
  
    
  # icons
    
  local _file
    
  local _res
    
  while read -r -d '' _file
    
  do
    
      _res="$(printf '%s' "$_file" | sed 's/\.png$//;s/^.*_//')"
    
      install -d -m755 "${pkgdir}/usr/share/icons/hicolor/${_res}x${_res}/apps"
    
      ln -sr "${pkgdir}/opt/stremio/icons/smartcode-stremio_${_res}.png" \
    
          "${pkgdir}/usr/share/icons/hicolor/${_res}x${_res}/apps/smartcode-stremio.png"
    
      ln -sr "${pkgdir}/opt/stremio/icons/smartcode-stremio-tray_${_res}.png" \
    
          "${pkgdir}/usr/share/icons/hicolor/${_res}x${_res}/apps/smartcode-stremio-tray.png"
    
  done < <(find "${pkgdir}/opt/stremio/icons" -maxdepth 1 -type f -name 'smartcode-stremio_*.png' -print0)
    
      82}
    
      83

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2