zoom-citrix-plugin

maintainer IAmIronman · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt RPM from a non-whitelisted host (zoom.us, not in standard source hosts), which is an unverifiable executable artifact; while zoom.us is plausibly official, the lack of upstream verification and use of a binary from a non-standard domain raises supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://zoom.us/download/vdi/${pkgver}.${_subver}/zoomvdi-universal-plugin-centos_${pkgver}.rpm")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt RPM from a non-whitelisted host (zoom.us, not in standard source hosts), which is an unverifiable executable artifact; while zoom.us is plausibly official, the lack of upstream verification and use of a binary from a non-standard domain raises supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jagapathi Gondi <gondijagapathi at gmail dot com>
    
      2# Contributor: Raryel C. Souza <raryel.csouza at protonmail dot com>
    
      3pkgname=zoom-citrix-plugin
    
      4pkgver=7.0.11
    
      5_subver=27050
    
      6pkgrel=1
    
      7pkgdesc="Zoom VDI Citrix plugin "
    
      8arch=('x86_64')
    
      9license=('custom')
    
      10url="https://support.zoom.us/hc/en-us/articles/4415057249549-VDI-releases-and-downloads"
    
      11depends=('icaclient')
    
      12optdepends=()
    
      13replaces=('zoomcitrixplugin')
    
      14install=$pkgname.install
    
      15
    
      16source=("https://zoom.us/download/vdi/${pkgver}.${_subver}/zoomvdi-universal-plugin-centos_${pkgver}.rpm")
    
      17
    
      18sha512sums=('e70d5fc128df625af15cfc1bacd9f6e6f6f6debf1242008955c64f8ae76d4b2cc11412b5efe68c12d791e70e3bc362073cf15c20b5e4a2c2029e5d7b838a1908')
    
      19
    
      20package() {
    
      21    find $srcdir/ -mindepth 1 -maxdepth 1 -type d | xargs cp -r -t "$pkgdir"
    
      22}
    
      23
    
      24

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:03
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,8 +1,8 @@
 # Maintainer: Jagapathi Gondi <gondijagapathi at gmail dot com>
 # Contributor: Raryel C. Souza <raryel.csouza at protonmail dot com>
 pkgname=zoom-citrix-plugin
-pkgver=6.6.14
-_subver=26970
+pkgver=7.0.11
+_subver=27050
 pkgrel=1
 pkgdesc="Zoom VDI Citrix plugin "
 arch=('x86_64')
@@ -15,7 +15,7 @@
 
 source=("https://zoom.us/download/vdi/${pkgver}.${_subver}/zoomvdi-universal-plugin-centos_${pkgver}.rpm")
 
-sha512sums=('9bf53499b6624f0c31436b3864b479ca4363f72cc3ad40944aa0f33c335259a5cde43e4d7cc7a92512f936fcdd048ecb5b77adaf142637eda35a25b39456e291')
+sha512sums=('e70d5fc128df625af15cfc1bacd9f6e6f6f6debf1242008955c64f8ae76d4b2cc11412b5efe68c12d791e70e3bc362073cf15c20b5e4a2c2029e5d7b838a1908')
 
 package() {
     find $srcdir/ -mindepth 1 -maxdepth 1 -type d | xargs cp -r -t "$pkgdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 03:31:41	MEDIUM	2
2026-06-20 16:03:41	CLEAN	2
2026-06-20 00:50:07	MEDIUM	2
2026-06-20 00:18:46	MEDIUM	2
2026-06-19 23:51:18	MEDIUM	2
2026-06-19 19:07:35	MEDIUM	2
2026-06-19 18:54:17	MEDIUM	2
2026-06-18 16:11:54	MEDIUM	1