teamtalk-client-source

maintainer heath-toby · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from upstream source and uses a prebuilt SDK from the official project domain (bearware.dk), which is a legitimate and expected part of the build process; the non-whitelisted host is the project's own, and the SDK is used as a shared library, not executed directly.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from upstream source and uses a prebuilt SDK from the official project domain (bearware.dk), which is a legitimate and expected part of the build process; the non-whitelisted host is the project's own, and the SDK is used as a shared library, not executed directly.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "teamtalk-sdk-${pkgver}.tgz::https://bearware.dk/teamtalk/v${pkgver}/teamtalk-v${pkgver}-ubuntu22-${arch}.tgz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Toby Heath <heathtobias@gmail.com>
    
      2pkgname=teamtalk-client-source
    
      3pkgver=5.22
    
      4pkgrel=2
    
      5pkgdesc='TeamTalk 5 Qt client built from upstream source against the official BearWare SDK'
    
      6arch=('x86_64')
    
      7url='https://github.com/BearWare/TeamTalk5'
    
      8license=('GPL3')
    
      9depends=('qt6-base' 'qt6-multimedia' 'qt6-speech' 'libxss' 'libx11'
    
      10         'alsa-lib' 'libpulse' 'openssl')
    
      11makedepends=('cmake' 'qt6-tools' 'git')
    
      12provides=('teamtalk-client')
    
      13conflicts=('teamtalk-client')
    
      14replaces=('teamtalk-client')
    
      15
    
      16source=("TeamTalk5-source-${pkgver}.tar.gz::https://github.com/BearWare/TeamTalk5/archive/refs/tags/v${pkgver}.tar.gz"
    
      17        "teamtalk-sdk-${pkgver}.tgz::https://bearware.dk/teamtalk/v${pkgver}/teamtalk-v${pkgver}-ubuntu22-${arch}.tgz"
    
      18        'teamtalk'
    
      19        'teamtalk.desktop'
    
      20        '0001-fix-qt-tts-engine-reinit.patch'
    
      21        '0002-fix-sound-device-name-fallback.patch'
    
      22        '0003-build-cmake-minimum-required.patch'
    
      23        '0004-ui-pulseaudio-pipewire-label.patch')
    
      24sha256sums=('b776f75c7707151e4f22d8abaa002a84fb9e36ea083b28a440b922da91c43c77'
    
      25            'c9eeb88e7c8c26f796eeff783d382a7bd36666c8a090c201cb758f5a6aeb9376'
    
      26            '9862ee801789f3a767b8e45ed0f3e63ab70caec72fe4aa425f166d7cde0dacc4'
    
      27            '4ec3b73e303841bfa14fd8c182e1446b9512fe66dcfa39803df0958a2f350b2c'
    
      28            '3a17058dd009306a84f63cab69560caf5fbec7acb2e0f18e665e8765280b6f85'
    
      29            '22574bd3a7d5b81356dda7f579fc635315b9d22272cd2dcbbdf0a22d16351c21'
    
      30            '5a694ae9847c8ef567783cb574b79863936a6b54ae4e7599a4c91cbc689882f2'
    
      31            'ff279125befa35598af2c51d1d8a7fd7fd58ca4a45528b28c83aa5b1cf12cf69')
    
      32install="${pkgname}.install"
    
      33
    
      34# Install paths -- chosen to be drop-in compatible with the official AUR
    
      35# `teamtalk-client` package so users can `paru -S teamtalk-client-source`
    
      36# without changing menu shortcuts, scripts or muscle memory.
    
      37_optdir='/opt/teamtalk-client'
    
      38_srcdir="TeamTalk5-${pkgver}"
    
      39_sdkdir="teamtalk-v${pkgver}-ubuntu22-${arch}"
    
      40
    
      41prepare() {
    
      42    cd "${srcdir}/${_srcdir}"
    
      43
    
      44    # Vendor the prebuilt SDK shared library so the qtTeamTalk subproject
    
      45    # links against it (BUILD_TEAMTALK_LIBRARY_DLL=OFF expects this path).
    
      46    install -m644 "${srcdir}/${_sdkdir}/client/libTeamTalk5.so" \
    
      47        Library/TeamTalk_DLL/libTeamTalk5.so
    
      48
    
      49    # Align the source's hard-coded TEAMTALK_VERSION with whatever the SDK
    
      50    # binary actually reports. The two can drift by a point release between
    
      51    # tagged source releases and SDK uploads; without this alignment the
    
      52    # client pops a "DLL load error" warning at startup.
    
      53    local sdk_ver
    
      54    sdk_ver=$(strings Library/TeamTalk_DLL/libTeamTalk5.so \
    
      55        | grep -m1 -E '^5\.[0-9]+\.[0-9]+\.[0-9]+$')
    
      56    if [[ -n "${sdk_ver}" ]]; then
    
      57        sed -i "s|^#define TEAMTALK_VERSION .*|#define TEAMTALK_VERSION \"${sdk_ver}\"|" \
    
      58            Library/TeamTalk_DLL/TeamTalk.h
    
      59    fi
    
      60
    
      61    # Apply the four pending upstream PRs so users get the bug fixes
    
      62    # while the patches are still under review. Drop a patch from this
    
      63    # list once it has been merged to upstream master.
    
      64    local p
    
      65    for p in "${srcdir}"/0*.patch; do
    
      66        echo "Applying $(basename "$p")"
    
      67        patch -p1 -i "$p"
    
      68    done
    
      69}
    
      70
    
      71build() {
    
      72    cd "${srcdir}/${_srcdir}"
    
      73
    
      74    cmake -S Client/qtTeamTalk -B build \
    
      75        -DCMAKE_BUILD_TYPE=Release \
    
      76        -DBUILD_TEAMTALK_LIBRARY_DLL=OFF \
    
      77        -DQT_DEFAULT_MAJOR_VERSION=6
    
      78    cmake --build build -j"$(nproc)"
    
      79    cmake --build build --target QtTeamTalk5-Translations || true
    
      80}
    
      81
    
      82package() {
    
      83    cd "${srcdir}"
    
      84
    
      85    # Stage the SDK's data files (sounds, help, ini default) into
    
      86    # /opt/teamtalk-client/, mirroring the upstream install layout.
    
      87    # Skip TeamTalk5.ini -- that's the writable user config and the
    
      88    # post-install hook handles it.
    
      89    install -d "${pkgdir}${_optdir}"
    
      90    cp -r "${_sdkdir}/client/help"   "${pkgdir}${_optdir}/"
    
      91    cp -r "${_sdkdir}/client/sounds" "${pkgdir}${_optdir}/"
    
      92    install -m644 "${_sdkdir}/client/TeamTalk5.ini.default" \
    
      93        "${pkgdir}${_optdir}/TeamTalk5.ini.default"
    
      94    install -m644 "${_sdkdir}/client/README" "${pkgdir}${_optdir}/README"
    
      95
    
      96    # SDK shared library we built against.
    
      97    install -m644 "${_sdkdir}/client/libTeamTalk5.so" \
    
      98        "${pkgdir}${_optdir}/libTeamTalk5.so"
    
      99
    
      100    # Our freshly-built binary replaces the SDK-shipped teamtalk5.
    
      101    install -m755 "${_srcdir}/Client/qtTeamTalk/teamtalk5" \
    
      102        "${pkgdir}${_optdir}/teamtalk5"
    
      103
    
      104    # Translations rebuilt from the source tree's .ts files.
    
      105    install -d "${pkgdir}${_optdir}/languages"
    
      106    if compgen -G "${_srcdir}/Client/qtTeamTalk/languages/*.qm" > /dev/null; then
    
      107        install -m644 "${_srcdir}"/Client/qtTeamTalk/languages/*.qm \
    
      108            "${pkgdir}${_optdir}/languages/"
    
      109    fi
    
      110
    
      111    # Tiny LD_LIBRARY_PATH wrapper so the binary finds libTeamTalk5.so.
    
      112    cat > "${pkgdir}${_optdir}/run.sh" <<'EOF'
    
      113#!/bin/sh
    
      114LD_LIBRARY_PATH="$(dirname "$0"):$LD_LIBRARY_PATH" \
    
      115    exec "$(dirname "$0")/teamtalk5" "$@"
    
      116EOF
    
      117    chmod 755 "${pkgdir}${_optdir}/run.sh"
    
      118
    
      119    # User-facing launcher + .desktop entry. Same names used by the
    
      120    # original teamtalk-client package so existing menu pins, scripts
    
      121    # and `teamtalk` muscle memory keep working.
    
      122    install -Dm755 teamtalk         "${pkgdir}/usr/bin/teamtalk"
    
      123    install -Dm644 teamtalk.desktop "${pkgdir}/usr/share/applications/teamtalk.desktop"
    
      124
    
      125    # Icon (reuse the source tree's app icon).
    
      126    install -Dm644 "${_srcdir}/Client/qtTeamTalk/images/teamtalk.png" \
    
      127        "${pkgdir}/usr/share/icons/hicolor/128x128/apps/teamtalk.png"
    
      128
    
      129    # License lifted from the SDK tarball, since the source tree itself
    
      130    # only carries per-file GPL headers and we ship the SDK alongside.
    
      131    install -Dm644 "${_sdkdir}/License.txt" \
    
      132        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      133}
    
      134

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2