zoom-citrix-plugin

MEDIUM

maintainer IAmIronman 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt RPM from a non-whitelisted host (zoom.us, not in standard source hosts), which is an unverifiable executable artifact; while zoom.us is plausibly official, the lack of upstream verification and use of a binary from a non-standard domain raises supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://zoom.us/download/vdi/${pkgver}.${_subver}/zoomvdi-universal-plugin-centos_${pkgver}.rpm")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt RPM from a non-whitelisted host (zoom.us, not in standard source hosts), which is an unverifiable executable artifact; while zoom.us is plausibly official, the lack of upstream verification and use of a binary from a non-standard domain raises supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jagapathi Gondi <gondijagapathi at gmail dot com>
    
      2# Contributor: Raryel C. Souza <raryel.csouza at protonmail dot com>
    
      3pkgname=zoom-citrix-plugin
    
      4pkgver=7.0.11
    
      5_subver=27050
    
      6pkgrel=1
    
      7pkgdesc="Zoom VDI Citrix plugin "
    
      8arch=('x86_64')
    
      9license=('custom')
    
      10url="https://support.zoom.us/hc/en-us/articles/4415057249549-VDI-releases-and-downloads"
    
      11depends=('icaclient')
    
      12optdepends=()
    
      13replaces=('zoomcitrixplugin')
    
      14install=$pkgname.install
    
      15
    
      16source=("https://zoom.us/download/vdi/${pkgver}.${_subver}/zoomvdi-universal-plugin-centos_${pkgver}.rpm")
    
      17
    
      18sha512sums=('e70d5fc128df625af15cfc1bacd9f6e6f6f6debf1242008955c64f8ae76d4b2cc11412b5efe68c12d791e70e3bc362073cf15c20b5e4a2c2029e5d7b838a1908')
    
      19
    
      20package() {
    
      21    find $srcdir/ -mindepth 1 -maxdepth 1 -type d | xargs cp -r -t "$pkgdir"
    
      22}
    
      23
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2