tencent-meeting

MEDIUM

maintainer orphaned 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Downloads and installs a prebuilt x86_64 .deb binary from a Tencent CDN URL (updatecdn.meeting.qq.com) which is plausibly official Tencent infrastructure, but the host is a CDN endpoint rather than a canonical release page, the checksum is MD5 only, and the package installs a closed-source prebuilt binary directly — acceptable risk level for a known vendor app but warrants caution as the binary is unverifiable beyond the weak MD5.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://updatecdn.meeting.qq.com/ad878a99-76c4-4058-ae83-22ee948cce98/TencentMeeting_0300000000_${pkgver}_x86_64.publish.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and installs a prebuilt x86_64 .deb binary from a Tencent CDN URL (updatecdn.meeting.qq.com) which is plausibly official Tencent infrastructure, but the host is a CDN endpoint rather than a canonical release page, the checksum is MD5 only, and the package installs a closed-source prebuilt binary directly — acceptable risk level for a known vendor app but warrants caution as the binary is unverifiable beyond the weak MD5.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=tencent-meeting
    
      2pkgver=2.8.0.0
    
      3pkgrel=4
    
      4pkgdesc="Tencent Meeting Linux Client 腾讯会议Linux客户端"
    
      5arch=('x86_64')
    
      6url="https://wemeet.qq.com"
    
      7license=('unknown')
    
      8depends=('nss' 'libx11' 'desktop-file-utils' 'libpulse' 'flac' 'libbsd' 'openssl' 'libxrandr' 'qt5-webkit' 'qt5-x11extras')
    
      9makedepends=('tar')
    
      10options=(!strip)
    
      11provides=('wemeet')
    
      12source=("https://updatecdn.meeting.qq.com/ad878a99-76c4-4058-ae83-22ee948cce98/TencentMeeting_0300000000_${pkgver}_x86_64.publish.deb")
    
      13md5sums=('bd9afb4c22035c77afb7ac033eeebeee')
    
      14
    
      15package() {
    
      16    tar xf data.tar.xz -C "${pkgdir}"
    
      17    mv "${pkgdir}/opt/wemeet/icons" "${pkgdir}/usr/share"
    
      18    sed -i 'N;2aName[zh_CN]=腾讯会议\nComment=Tencent Meeting Linux Client\nComment[zh_CN]=腾讯会议Linux客户端' "${pkgdir}/usr/share/applications/wemeetapp.desktop"
    
      19}
    
      20

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 00:06:47	Medium	3
2026-10-13 00:23:45	Medium	3
2026-10-12 00:18:51	Medium	3
2026-10-11 00:26:05	Medium	3
2026-10-10 00:11:52	Medium	3
2026-10-09 08:12:07	Medium	3
2026-10-09 08:10:33	Medium	3