amazon-workspaces-bin

maintainer janek · 20 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb and control info from Amazon's official cloudfront.net domain, verifies the deb's checksum against the official Packages file, and extracts it; this is normal for binary packages from official vendors, and the host, while not whitelisted, is plausibly Amazon's own infrastructure.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb and control info from Amazon's official cloudfront.net domain, verifies the deb's checksum against the official Packages file, and extracts it; this is normal for binary packages from official vendors, and the host, while not whitelisted, is plausibly Amazon's own infrastructure.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "$pkgname-$pkgver.deb::https://d3nt0h4h6pmmc4.cloudfront.net/new_workspacesclient_${_aptdist}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Janek Thomaschewski <janek@thomaschewski.dev>
    
      2# Contributor: Steve Engledow <steve@engledow.me>
    
      3
    
      4pkgname=amazon-workspaces-bin
    
      5pkgver=2025.0.5219
    
      6pkgrel=1
    
      7_aptdist=focal
    
      8pkgdesc='Amazon Workspace Client'
    
      9arch=('x86_64')
    
      10url="https://clients.amazonworkspaces.com/"
    
      11license=('non-free')
    
      12depends=(
    
      13    'gtk3'
    
      14    'webkit2gtk'
    
      15    'icu'
    
      16    'libsoup'
    
      17    'graphicsmagick'
    
      18    'hiredis0.14'
    
      19    'openssl-1.1'
    
      20    'libva'
    
      21    'libvdpau'
    
      22    'glib2'
    
      23)
    
      24options=('staticlibs')
    
      25makedepends=(
    
      26  'binutils'
    
      27  'tar'
    
      28)
    
      29source=(
    
      30    "$pkgname-$pkgver.deb::https://d3nt0h4h6pmmc4.cloudfront.net/new_workspacesclient_${_aptdist}_amd64.deb"
    
      31    "$pkgname-$pkgver.info::https://d3nt0h4h6pmmc4.cloudfront.net/ubuntu/dists/${_aptdist}/main/binary-amd64/Packages"
    
      32    lsb_release
    
      33    workspacesclient-wrapper
    
      34)
    
      35
    
      36sha256sums=('181c4a10a9a745b67769c063c0c67355db9f71d63aab14ab46699e68898d32ec'
    
      37            'dcecbe5b5286c898fdac801768a55679e70058f9647ad25e38d14805ab1694ad'
    
      38            'fb7640c4d5dbb507d6443462eabf1384dd65f069b33a9abc4a599d41ac6d0fb6'
    
      39            '27c7e51d9434e4cf85d898179ab1b0477b9c695e3461a7403da4e2c37857474f')
    
      40
    
      41prepare() {
    
      42    # Verify the checksum
    
      43    echo "$(grep SHA256 "$pkgname-$pkgver.info" | cut -d" " -f2) $pkgname-$pkgver.deb" >sum
    
      44    sha256sum -c sum
    
      45
    
      46    ar x "$pkgname-$pkgver.deb"
    
      47    tar axvf data.tar.xz
    
      48    tar axvf control.tar.xz
    
      49
    
      50    # Put "fake" lsb_release into PATH to report Ubuntu 20.x
    
      51    mkdir -p ${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/helper-bin
    
      52    install -m 0755 ${srcdir}/lsb_release ${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/helper-bin/
    
      53
    
      54    install -m 0755 ${srcdir}/workspacesclient-wrapper ${srcdir}/usr/bin/
    
      55
    
      56    sed -i -e 's/Exec=workspacesclient/Exec=workspacesclient-wrapper/' ${srcdir}/usr/share/applications/com.amazon.workspacesclient.desktop
    
      57
    
      58    # Remove a couple of vendored-in libraries, so the system ones are used
    
      59    # The vendored-in version has libselinux.so.1 linked, which doesn't exist natively on Arch
    
      60    rm ${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/dcv/libgio-2.0.so.0
    
      61    rm ${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/dcv/libglib-2.0.so.0
    
      62    rm ${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/dcv/libgobject-2.0.so.0
    
      63
    
      64    # The below preparation steps are adapted from the .deb
    
      65    export LD_LIBRARY_PATH=${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/dcv:$LD_LIBRARY_PATH
    
      66    export PATH=${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/dcv:$PATH
    
      67    gdk-pixbuf-query-loaders ${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/dcv/gdk-pixbuf-2.0/2.10.0/loaders/*.so | \
    
      68        sed "s|^\"${srcdir}|\"|" > ${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/dcv/gdk-pixbuf-2.0/2.10.0/loaders.cache
    
      69    gtk-query-immodules-3.0 ${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/dcv/gtk-3.0/3.0.0/immodules/*.so | \
    
      70        sed "s|^\"${srcdir}|\"|" > ${srcdir}/usr/lib/${arch}-linux-gnu/workspacesclient/dcv/gtk-3.0/3.0.0/immodules.cache
    
      71}
    
      72
    
      73pkgver() {
    
      74    grep Version control | cut -d" " -f2
    
      75}
    
      76
    
      77package() {
    
      78  mkdir -p $pkgdir/usr
    
      79
    
      80  cp -a $srcdir/usr/* $pkgdir/usr/
    
      81}
    
      82

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2