2025-07-14, 04:19 PM
(This post was last modified: 2025-07-14, 04:32 PM by obelous. Edited 3 times in total.)
(2025-07-14, 07:32 AM)Venson Wrote: You should only ever and absolutly ever add those package sources you absolutly trust. If one of those sources have malicious intend, they could potentially inject any code to run on your server by faking a plugin and you are also exposing the existance and ip of your instance to anyone in that list also making you a potential target.
Good point about the malicious code, Ill go through the sources and remove some potentially outdated or untrustworthy sources, most of them are from the awesome-jellyfin repository which is already community vetted, you can also review each source yourself here. However you seem to be misinformed about the IP thing, my project collects and downloads many manifest.json files and combines them into a single file, this file is then directly served by github, your jellyfin instance does not connect to each individual upstream source that is the job of the update script which is executed by github actions on github's servers.
(2025-07-13, 06:43 PM)Goby Wrote: Looks promising, but I encountered three error messages on my test server. Also, there’s no description shown for any plugin.
"Une erreur s'est produite lors de la récupération des détails du plugin depuis le dépôt."
Une erreur s'est produite lors de la récupération des détails du plugin depuis le dépôt.
Une erreur s'est produite lors de la récupération de la liste des extensions installées.
Weird, Could you try accessing this URL in a browser preferably on the same network as your Jellyfin server:
https://raw.githubusercontent.com/0belou...ifest.json