zoom-citrix-plugin

MEDIUM

maintainer IAmIronman 2 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt RPM from a non-whitelisted host (zoom.us, not in standard source hosts), which is an unverifiable executable artifact; while zoom.us is plausibly official, the lack of upstream verification and use of a binary from a non-standard domain raises supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://zoom.us/download/vdi/${pkgver}.${_subver}/zoomvdi-universal-plugin-centos_${pkgver}.rpm")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt RPM from a non-whitelisted host (zoom.us, not in standard source hosts), which is an unverifiable executable artifact; while zoom.us is plausibly official, the lack of upstream verification and use of a binary from a non-standard domain raises supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jagapathi Gondi <gondijagapathi at gmail dot com>
    
      2# Contributor: Raryel C. Souza <raryel.csouza at protonmail dot com>
    
      3pkgname=zoom-citrix-plugin
    
      4pkgver=7.0.11
    
      5_subver=27050
    
      6pkgrel=1
    
      7pkgdesc="Zoom VDI Citrix plugin "
    
      8arch=('x86_64')
    
      9license=('custom')
    
      10url="https://support.zoom.us/hc/en-us/articles/4415057249549-VDI-releases-and-downloads"
    
      11depends=('icaclient')
    
      12optdepends=()
    
      13replaces=('zoomcitrixplugin')
    
      14install=$pkgname.install
    
      15
    
      16source=("https://zoom.us/download/vdi/${pkgver}.${_subver}/zoomvdi-universal-plugin-centos_${pkgver}.rpm")
    
      17
    
      18sha512sums=('e70d5fc128df625af15cfc1bacd9f6e6f6f6debf1242008955c64f8ae76d4b2cc11412b5efe68c12d791e70e3bc362073cf15c20b5e4a2c2029e5d7b838a1908')
    
      19
    
      20package() {
    
      21    find $srcdir/ -mindepth 1 -maxdepth 1 -type d | xargs cp -r -t "$pkgdir"
    
      22}
    
      23
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2