airvpn-suite-bin

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs prebuilt binaries (bluetit, goldcrest, hummingbird) downloaded from eddie.website, which is AirVPN's own distribution host (Eddie is AirVPN's official client software project). However, the sha512sums line fetches the checksum at build time via a backtick-executed curl command rather than hardcoding it in the PKGBUILD. This means: (1) the integrity check is not reproducible or auditable from the PKGBUILD alone, (2) a compromised or MITM'd eddie.website could serve both a malicious binary and a matching checksum simultaneously, defeating the purpose of the hash check entirely. The source is a legitimate vendor host (AirVPN/Eddie project), so this is not a clearly malicious pattern, but the dynamic checksum fetch is a genuine supply-chain concern for executed binaries — the hash provides no real protection. This fits the medium category: prebuilt binaries from a vendor-adjacent host with a non-verifiable integrity mechanism.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:16 sha512sums=(`curl -sLo - "https://eddie.website/repository/$_pkgname/$pkgver/$_pkgname-$arch-$pkgver.tar.gz.sha512"|cut -f1 -d " "`)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://eddie.website/repository/$_pkgname/$pkgver/$_pkgname-$arch-$pkgver.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD installs prebuilt binaries (bluetit, goldcrest, hummingbird) downloaded from eddie.website, which is AirVPN's own distribution host (Eddie is AirVPN's official client software project). However, the sha512sums line fetches the checksum at build time via a backtick-executed curl command rather than hardcoding it in the PKGBUILD. This means: (1) the integrity check is not reproducible or auditable from the PKGBUILD alone, (2) a compromised or MITM'd eddie.website could serve both a malicious binary and a matching checksum simultaneously, defeating the purpose of the hash check entirely. The source is a legitimate vendor host (AirVPN/Eddie project), so this is not a clearly malicious pattern, but the dynamic checksum fetch is a genuine supply-chain concern for executed binaries — the hash provides no real protection. This fits the medium category: prebuilt binaries from a vendor-adjacent host with a non-verifiable integrity mechanism.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: rvid <contact at rvid dot eu>
    
      2# Maintainer: OpenSorcerer <alex at opensourcery dot eu>
    
      3pkgname=airvpn-suite-bin
    
      4_pkgname=AirVPN-Suite
    
      5pkgver=2.0.0
    
      6pkgrel=1
    
      7pkgdesc="AirVPN client software collection including Bluetit, Goldcrest and Hummingbird – prebuilt stable"
    
      8arch=('x86_64' 'armv7l' 'aarch64')
    
      9url="https://airvpn.org/linux/suite"
    
      10license=('GPL3')
    
      11provides=('hummingbird' 'hummingbird-bin' 'airvpn-suite' 'airvpn-suite-beta-bin')
    
      12conflicts=('hummingbird' 'hummingbird-bin' 'airvpn-suite' 'airvpn-suite-beta-bin')
    
      13depends=('glibc' 'gcc-libs' 'dbus' 'openssl' 'libxml2')
    
      14makedepends=('curl')
    
      15source=("https://eddie.website/repository/$_pkgname/$pkgver/$_pkgname-$arch-$pkgver.tar.gz")
    
      16sha512sums=(`curl -sLo - "https://eddie.website/repository/$_pkgname/$pkgver/$_pkgname-$arch-$pkgver.tar.gz.sha512"|cut -f1 -d " "`)
    
      17install="$pkgname.install"
    
      18changelog="Changelog-Suite.txt"
    
      19
    
      20package() {
    
      21    cd $srcdir/$_pkgname
    
      22
    
      23    # place binaries
    
      24    install -Dm755 bin/bluetit "$pkgdir/usr/bin/bluetit"
    
      25    install -Dm755 bin/goldcrest "$pkgdir/usr/bin/goldcrest"
    
      26    install -Dm755 bin/hummingbird "$pkgdir/usr/bin/hummingbird"
    
      27
    
      28    # place documentation
    
      29    install -Dm755 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      30
    
      31    # place license
    
      32    install -Dm755 LICENSE.md "$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
    
      33
    
      34    # place configuration
    
      35    install -Dm600 -t "$pkgdir/etc/airvpn/" etc/airvpn/*
    
      36
    
      37    # place D-Bus config
    
      38    install -Dm644 -t "$pkgdir/etc/dbus-1/system.d/" etc/dbus-1/system.d/*
    
      39
    
      40    # place Systemd service
    
      41    install -Dm644 etc/systemd/system/bluetit.service "$pkgdir/usr/lib/systemd/system/bluetit.service"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3