anydesk-legacy-bin

maintainer microck · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from web.archive.org rather than the official AnyDesk download server (download.anydesk.com). While the Wayback Machine URL embeds the original source URL and a sha512 checksum is provided, the actual delivery host is a third-party archive service. The checksum mitigates substitution risk significantly, but web.archive.org is not the canonical vendor host and the archived copy cannot be independently verified as unmodified. The package also installs a proprietary closed-source remote-access binary directly, which is an inherently higher-risk operation. The pkgdesc explicitly notes 'without commercial use nags or timeouts', which hints at intentionally using an older version to circumvent license enforcement, but this is a grey area (using an older free version rather than cracking). Overall this is a genuine medium: a prebuilt executed binary from a non-official host, partially mitigated by a checksum.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("anydesk-${pkgver}.deb::https://web.archive.org/web/20230419070452if_/https://download.anydesk.com/linux/deb/anydesk_6.0.1-1_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from web.archive.org rather than the official AnyDesk download server (download.anydesk.com). While the Wayback Machine URL embeds the original source URL and a sha512 checksum is provided, the actual delivery host is a third-party archive service. The checksum mitigates substitution risk significantly, but web.archive.org is not the canonical vendor host and the archived copy cannot be independently verified as unmodified. The package also installs a proprietary closed-source remote-access binary directly, which is an inherently higher-risk operation. The pkgdesc explicitly notes 'without commercial use nags or timeouts', which hints at intentionally using an older version to circumvent license enforcement, but this is a grey area (using an older free version rather than cracking). Overall this is a genuine medium: a prebuilt executed binary from a non-official host, partially mitigated by a checksum.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Microck <contact@micr.dev>
    
      2# Project Page: https://github.com/Microck/anydesk-legacy-bin
    
      3
    
      4pkgname=anydesk-legacy-bin
    
      5pkgver=6.0.1
    
      6pkgrel=2
    
      7pkgdesc="Legacy AnyDesk 6.0.1. Stable version without commercial use nags or timeouts."
    
      8arch=('x86_64')
    
      9url="https://www.anydesk.com"
    
      10license=('custom')
    
      11
    
      12depends=('gtk2' 'gtkglext' 'glu' 'cairo' 'fontconfig' 'freetype2' 
    
      13         'gdk-pixbuf2' 'glib2' 'libglvnd' 'libice' 'libsm' 
    
      14         'libx11' 'libxtst' 'pango' 'pangox-compat' 'lsb-release' 'polkit')
    
      15
    
      16optdepends=('xdg-utils: for desktop integration'
    
      17            'gtk-engine-murrine: fixes GTK theme warnings and improves look')
    
      18
    
      19conflicts=('anydesk' 'anydesk-bin')
    
      20provides=('anydesk')
    
      21
    
      22options=('!strip' '!emptydirs')
    
      23install=${pkgname}.install
    
      24
    
      25source=("anydesk-${pkgver}.deb::https://web.archive.org/web/20230419070452if_/https://download.anydesk.com/linux/deb/anydesk_6.0.1-1_amd64.deb")
    
      26sha512sums=('9ff2d5fe2d87e06f2860fc1759af3b1b10749feb3a97023905a314047e42e805028619f81a4d541cd3fd0ffab8bec71965e191a3d295d745f7738b150c53fc69')
    
      27
    
      28package(){
    
      29    tar -x -f data.tar.* -C "${pkgdir}"
    
      30
    
      31    _copyright_file=$(find "${pkgdir}" -name "copyright" -print -quit)
    
      32    
    
      33    if [ -n "$_copyright_file" ]; then
    
      34        install -Dm644 "$_copyright_file" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      35    else
    
      36        msg "Warning: No copyright file found. Skipping license installation."
    
      37    fi
    
      38    
    
      39    if [ -f "${pkgdir}/usr/bin/anydesk" ]; then
    
      40        chmod 755 "${pkgdir}/usr/bin/anydesk"
    
      41    fi
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2