tiny-media-manager-3
LOW
maintainer eddie_vs
6 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a prebuilt tarball from the project's own archive domain, which is plausibly official; despite the non-whitelisted host, it is not a swappable personal file host, and the checksum is provided, reducing supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt tarball from the project's own archive domain, which is plausibly official; despite the non-whitelisted host, it is not a swappable personal file host, and the checksum is provided, reducing supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
source=("tmm_${pkgver}_${pkgrel}_linux.tar.gz::https://archive.tinymediamanager.org/v${pkgver}/tmm_${pkgver}_linux.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Luca Canavese <l.canavese@protonmail.com>
2
# Contributor: Simon Legner <Simon.Legner@gmail.com>
3
# Contributor: Filippo Berto <berto.f at protonmail dot com>
4
# Contributor: Viktor Hundahl Strate <viktorstrate@gmail.com>
5
6
_gitname=tinyMediaManager
7
pkgname=tiny-media-manager-3
8
pkgver=3.1.18
9
pkgrel=1
10
pkgdesc="A multi-OS media managment tool (v3)"
11
arch=('any')
12
url="https://www.tinymediamanager.org/"
13
license=('Apache')
14
depends=('libmediainfo' 'java-runtime')
15
install=tinyMediaManager.install
16
noextract=("tmm_${pkgver}_linux.tar.gz")
17
conflicts=('tiny-media-manager')
18
# https://gitlab.com/tinyMediaManager/tinyMediaManager/-/packages
19
source=("tmm_${pkgver}_${pkgrel}_linux.tar.gz::https://archive.tinymediamanager.org/v${pkgver}/tmm_${pkgver}_linux.tar.gz"
20
"tinyMediaManager.desktop"
21
"tinymediamanager"
22
"tinymediamanager-cli"
23
"tinymediamanager.JAVA_OPTS")
24
sha256sums=('12b53e5dd000987b4bcca57c00a5a2522f9786a0ebef0d577b20c462cffcee47'
25
'02bbfd492d10114cd314fc24fd7016532b0b992077d722d8bfccc4f99a79b7a3'
26
'4bf36dd16bfc02a39ddde88cfcf30b4f4a5f0b08d2b34ffbab03f6553f57d596'
27
'2d3df36c67a710b03b8fea3ac58c49307da8db22b7c6f8fd0011552fe94dde26'
28
'0ef3bc3693a346dde08c0d01693a48ccf630bea2cb2aa2e31ce9ce77a408f2ba')
29
30
package() {
31
destpath="$pkgdir/usr/share/$_gitname"
32
mkdir -p "$destpath"
33
tar -xvf "tmm_${pkgver}_${pkgrel}_linux.tar.gz" -C "$destpath"
34
install -m644 tinymediamanager.JAVA_OPTS "$destpath/tmm.JAVA_OPTS"
35
36
# Install desktop entry
37
install -D "$srcdir/tinyMediaManager.desktop" "$pkgdir/usr/share/applications/tinyMediaManager.desktop"
38
install -D "$destpath/tmm.png" "$pkgdir/usr/share/pixmaps/tmm.png"
39
40
# Install launch scripts
41
install -D "$srcdir/tinymediamanager-cli" "$pkgdir/usr/bin/tinymediamanager-cli"
42
install -D "$srcdir/tinymediamanager" "$pkgdir/usr/bin/tinymediamanager"
43
}
44
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |