teamtalk

maintainer jticket1024 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball (tt5srv server daemon) from bearware.dk, which is the official upstream vendor domain for TeamTalk. However, the artifact is an Ubuntu 22 build being installed on Arch Linux — a binary from a different distro's build pipeline. The binary is installed as an executable system daemon (/usr/bin/tt5srv) and registered as a systemd service, meaning it runs with elevated trust at boot. The sha256sum is present and pinned, which mitigates substitution risk, but there is no GPG signature verification. The core concern is that this is a prebuilt, closed-source binary from an Ubuntu build (not an Arch build), installed as a persistent system service. While bearware.dk is the legitimate upstream, the use of a distro-mismatched prebuilt binary without signature verification for a network-facing daemon warrants medium severity — the supply-chain risk is real even if not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://bearware.dk/${pkgname}/v${pkgver}/${pkgname}-v${pkgver}-ubuntu22-${arch}.tgz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball (tt5srv server daemon) from bearware.dk, which is the official upstream vendor domain for TeamTalk. However, the artifact is an Ubuntu 22 build being installed on Arch Linux — a binary from a different distro's build pipeline. The binary is installed as an executable system daemon (/usr/bin/tt5srv) and registered as a systemd service, meaning it runs with elevated trust at boot. The sha256sum is present and pinned, which mitigates substitution risk, but there is no GPG signature verification. The core concern is that this is a prebuilt, closed-source binary from an Ubuntu build (not an Arch build), installed as a persistent system service. While bearware.dk is the legitimate upstream, the use of a distro-mismatched prebuilt binary without signature verification for a network-facing daemon warrants medium severity — the supply-chain risk is real even if not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jeremiah Ticket <seashellpromises@gmail.com>
    
      2# Maintainer: Leonard de Ruijter <dev@systeemdenker.nl>
    
      3pkgname=('teamtalk')
    
      4pkgver=5.22
    
      5pkgrel=1
    
      6        pkgdesc='a software conferencing system server which enables a group of people to collaborate and share information using voice and video'
    
      7arch=('x86_64')
    
      8        depends=('gcc-libs')
    
      9        install="${pkgname}.install"
    
      10backup=("etc/${pkgname}/tt5srv.xml")
    
      11license=('custom')
    
      12url='http://www.bearware.dk'
    
      13source=("https://bearware.dk/${pkgname}/v${pkgver}/${pkgname}-v${pkgver}-ubuntu22-${arch}.tgz"
    
      14        "${pkgname}.install")
    
      15sha256sums=('c9eeb88e7c8c26f796eeff783d382a7bd36666c8a090c201cb758f5a6aeb9376'
    
      16            '621938e7a6b07988ff05a032ba098e5d7e8a10040c6dac3c1f3255ac89938a6e')
    
      17
    
      18package() {
    
      19
    
      20        install -D -m644 ${srcdir}/${pkgname}-v${pkgver}-ubuntu22-${arch}/License.txt ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      21        install -D -m755 ${srcdir}/${pkgname}-v${pkgver}-ubuntu22-${arch}/server/tt5srv ${pkgdir}/usr/bin/tt5srv
    
      22        install -D -m644 ${srcdir}/${pkgname}-v${pkgver}-ubuntu22-${arch}/server/systemd/tt5server.service ${pkgdir}/usr/lib/systemd/system/tt5srv.service
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2