wemeet-bin

maintainer sukanka · 82 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt .deb binaries from a non-standard, non-whitelisted host (updatecdn.meeting.qq.com) which is not a common open-source forge; while likely official, the unverifiable prebuilt binaries present a supply-chain risk if the host were compromised or subverted.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_x86_64=("${_pkgname}-${pkgver}-x86_64.deb::https://updatecdn.meeting.qq.com/cos/${_x86_md5}/TencentMeeting_0300000000_${pkgver}_x86_64_default.publish.deb"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-standard, non-whitelisted host (updatecdn.meeting.qq.com) which is not a common open-source forge; while likely official, the unverifiable prebuilt binaries present a supply-chain risk if the host were compromised or subverted.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: sukanka<su975853527[AT]gmail.com>
    
      2# Contributor: Sam L. Yes <samlukeyes123 at gmail dot com>
    
      3
    
      4_pkgname=wemeet
    
      5pkgname=$_pkgname-bin
    
      6provides=('wemeet' 'tencent-meeting')
    
      7pkgver=3.26.10.401
    
      8_pkgver_arm=3.26.10.401
    
      9_x86_md5=72e0e0023e1d1e6d4123fba28821aea1
    
      10_arm_md5=c06d6bc4a3370dbfb2f43bbc6ff8969e
    
      11pkgrel=5
    
      12pkgdesc="Tencent Video Conferencing, tencent meeting 腾讯会议"
    
      13arch=('x86_64' 'aarch64')
    
      14license=('unknown')
    
      15url="https://source.meeting.qq.com/download-center.html"
    
      16source_x86_64=("${_pkgname}-${pkgver}-x86_64.deb::https://updatecdn.meeting.qq.com/cos/${_x86_md5}/TencentMeeting_0300000000_${pkgver}_x86_64_default.publish.deb"
    
      17)
    
      18source_aarch64=("${_pkgname}-${_pkgver_arm}-aarch64.deb::https://updatecdn.meeting.qq.com/cos/${_arm_md5}/TencentMeeting_0300000000_${_pkgver_arm}_arm64_default.publish.deb")
    
      19source=("${_pkgname}".sh 'wrap.c')
    
      20depends=(
    
      21    # most deps are not used, but kept for a
    
      22    bash
    
      23    qt5-x11extras libxinerama
    
      24    libpulse # 无 pulseaudio 无法连接到系统音频
    
      25    # dependencies detected by namcap
    
      26    gcc-libs qt5-declarative libglvnd libxfixes alsa-lib openssl
    
      27    libxrandr libxext libx11 hicolor-icon-theme glibc zlib libxcomposite
    
      28    qt5-base systemd-libs libxdamage qt5-svg
    
      29    libyuv
    
      30)
    
      31optdepends=(
    
      32    'qt5-wayland: Wayland support'
    
      33    'bubblewrap: Fix abnormal text color in dark mode and prevent messing files.'
    
      34)
    
      35makedepends=('patchelf')
    
      36sha512sums=('5d70007528b4b4dfbedecf09d76bc1859e1b34479f6239fd378bc5a12711ff5b22919f312e66aac758799b709a64bd2964c4a53be25829738aa6d1195d871f5a'
    
      37            'f98e9ae5842c05a19ad4f883c8f9d88ef3b64e04b034e7fd8b23ddca81510f0bd38688ad7c63ddf8badaa727a7b599ceede87419e9694c06d7a4b06138b94c15')
    
      38sha512sums_x86_64=('acaa1eba8eccd3a5bd4cb57dc0fadce5c33950857677783944ac2bfbefbed927ca3b4b7d9d0c9e864dcdc3b9f9f8a359c456e9b63b38ac0fa9436fc336aa9ea7')
    
      39sha512sums_aarch64=('6fb54c4972b6ebaf8e1ce576b4ea075ec1b1cd5d02702feef5382712a8bafc2ff85cbd6ab43c90e6e6c55627da77ecc1c8c58f4154e0a160247387f5b2972abc')
    
      40
    
      41# strip了反而变大
    
      42options=(!strip)
    
      43
    
      44prepare() {
    
      45    cd "$srcdir"
    
      46    tar xpf data.tar.xz
    
      47
    
      48    pushd usr/share/applications
    
      49    sed -i 's|^Exec=.*|Exec=wemeet %u|g;s|^Icon=.*|Icon=wemeet|g' ${_pkgname}app.desktop
    
      50    sed -i '$i Comment=Tencent Meeting Linux Client\nComment[zh_CN]=腾讯会议Linux客户端\nKeywords=wemeet;tencent;meeting;' \
    
      51        "$srcdir/usr/share/applications/wemeetapp.desktop"
    
      52    popd
    
      53
    
      54    pushd opt/$_pkgname
    
      55    if [ -d 'icons' ]; then
    
      56        for res in 16 32 64 128 256; do
    
      57            install -dm755 "$srcdir/usr/share/icons/hicolor/${res}x${res}/apps"
    
      58            mv "icons/hicolor/${res}x${res}/mimetypes/${_pkgname}app.png" \
    
      59                "$srcdir/usr/share/icons/hicolor/${res}x${res}/apps/${_pkgname}app.png"
    
      60        done
    
      61    else
    
      62        echo 'icons directory not found'
    
      63    fi
    
      64
    
      65    # rm bin/qt.conf
    
      66    sed -i "s|^Prefix.*|Prefix = /usr/lib/wemeet|" bin/qt.conf
    
      67    patchelf --set-rpath '$ORIGIN:/usr/lib/wemeet' bin/wemeetapp
    
      68    popd
    
      69
    
      70    pushd opt/$_pkgname/bin
    
      71
    
      72    find modules/ -type f -name '*.so' | xargs -I {} patchelf --set-rpath '$ORIGIN:/usr/lib/wemeet' {}
    
      73    popd
    
      74}
    
      75
    
      76build() {
    
      77    cd "$srcdir"
    
      78    read -ra openssl_args < <(pkgconf --libs openssl)
    
      79    read -ra libpulse_args < <(pkgconf --cflags --libs libpulse)
    
      80    # Comment out `-D WRAP_FORCE_SINK_HARDWARE` to disable the patch that forces wemeet detects sink as hardware sink
    
      81    "${CC:-cc}" $CFLAGS -Wall -Wextra -fPIC -shared "${openssl_args[@]}" "${libpulse_args[@]}" -o libwemeetwrap.so wrap.c -D WRAP_FORCE_SINK_HARDWARE
    
      82}
    
      83
    
      84package() {
    
      85    cd "$srcdir"
    
      86    cp -r usr "$pkgdir"
    
      87    cd opt/$_pkgname
    
      88
    
      89    install -Dm755 "$srcdir/$_pkgname.sh" "$pkgdir/usr/bin/$_pkgname"
    
      90    ln -s "/usr/bin/$_pkgname" "$pkgdir/usr/bin/$_pkgname-x11"
    
      91    install -Dm644 $_pkgname.svg -t "$pkgdir/usr/share/icons/hicolor/scalable/apps"
    
      92
    
      93    # libbugly is not likely to be necessary
    
      94    install -Dm755 lib/lib{desktop_common,crash_guard,ImSDK,nxui*,qt_*,ui*,wemeet*,xcast*,xnn*}.so \
    
      95        -t "$pkgdir/usr/lib/$_pkgname"
    
      96    if [ -f 'lib/libcrbase.so' ]; then
    
      97        install -Dm755 lib/libcrbase.so -t "$pkgdir/usr/lib/$_pkgname"
    
      98    else
    
      99        echo 'lib/libcrbase.so not found'
    
      100    fi
    
      101    # copy Qt
    
      102    cp -r plugins resources translations "$pkgdir/usr/lib/$_pkgname"
    
      103    cp -a lib/lib{Qt,icu}* "$pkgdir/usr/lib/$_pkgname"
    
      104
    
      105    find "$pkgdir/usr/lib/$_pkgname" -type f -name '*.so*' | xargs -I {} patchelf --set-rpath '$ORIGIN:/usr/lib/wemeet' {}
    
      106
    
      107    install -dm755 "$pkgdir/opt/$_pkgname"
    
      108    cp -r bin "$pkgdir/opt/$_pkgname"
    
      109    ln -s raw/xcast.conf "$pkgdir/opt/$_pkgname/bin/xcast.conf"
    
      110    install -Dm755 "$srcdir/libwemeetwrap.so" -t "$pkgdir/usr/lib/$_pkgname"
    
      111
    
      112}
    
      113

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,7 +8,7 @@
 _pkgver_arm=3.26.10.401
 _x86_md5=72e0e0023e1d1e6d4123fba28821aea1
 _arm_md5=c06d6bc4a3370dbfb2f43bbc6ff8969e
-pkgrel=3
+pkgrel=5
 pkgdesc="Tencent Video Conferencing, tencent meeting 腾讯会议"
 arch=('x86_64' 'aarch64')
 license=('unknown')
@@ -33,8 +33,8 @@
     'bubblewrap: Fix abnormal text color in dark mode and prevent messing files.'
 )
 makedepends=('patchelf')
-sha512sums=('54488013a8a73c2d2e488a773794f34938dbd0e4eb94e613ff866c6fc2a21321d7d90a3a6462799d6f2375985acb53c4d327d468d086100c5f9aa62934604d1e'
-    'f98e9ae5842c05a19ad4f883c8f9d88ef3b64e04b034e7fd8b23ddca81510f0bd38688ad7c63ddf8badaa727a7b599ceede87419e9694c06d7a4b06138b94c15')
+sha512sums=('5d70007528b4b4dfbedecf09d76bc1859e1b34479f6239fd378bc5a12711ff5b22919f312e66aac758799b709a64bd2964c4a53be25829738aa6d1195d871f5a'
+            'f98e9ae5842c05a19ad4f883c8f9d88ef3b64e04b034e7fd8b23ddca81510f0bd38688ad7c63ddf8badaa727a7b599ceede87419e9694c06d7a4b06138b94c15')
 sha512sums_x86_64=('acaa1eba8eccd3a5bd4cb57dc0fadce5c33950857677783944ac2bfbefbed927ca3b4b7d9d0c9e864dcdc3b9f9f8a359c456e9b63b38ac0fa9436fc336aa9ea7')
 sha512sums_aarch64=('6fb54c4972b6ebaf8e1ce576b4ea075ec1b1cd5d02702feef5382712a8bafc2ff85cbd6ab43c90e6e6c55627da77ecc1c8c58f4154e0a160247387f5b2972abc')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 15:12:02	MEDIUM	2
2026-07-29 00:25:53	LOW	2
2026-07-28 17:39:33	MEDIUM	1
2026-07-28 15:39:03	MEDIUM	1
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2