coolvlviewer-experimental-bin

maintainer toastercup · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer from sldev.free.fr (the official Cool VL Viewer development site run by Henri Beauchamp, the sole developer of this viewer), executes it during the build phase to self-extract, and then installs the resulting files. While sldev.free.fr is a personal/unofficial host rather than a major distribution mirror, it is the canonical upstream source for this project — there is no other official distribution channel. The binary is checksummed with SHA1 (weak but present), providing some integrity guarantee. The core concern is that a prebuilt binary installer is executed at build time from a personal free-hosting domain, which is a genuine supply-chain risk: if the host were compromised or the download intercepted (no HTTPS), arbitrary code would execute during packaging. The lack of HTTPS is a notable additional concern. This fits the medium severity definition: an executed binary from an unofficial/personal host, not clearly malicious but a real supply-chain concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("http://sldev.free.fr/binaries/CoolVLViewer-${pkgver}-Linux-x86_64-Setup"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer from sldev.free.fr (the official Cool VL Viewer development site run by Henri Beauchamp, the sole developer of this viewer), executes it during the build phase to self-extract, and then installs the resulting files. While sldev.free.fr is a personal/unofficial host rather than a major distribution mirror, it is the canonical upstream source for this project — there is no other official distribution channel. The binary is checksummed with SHA1 (weak but present), providing some integrity guarantee. The core concern is that a prebuilt binary installer is executed at build time from a personal free-hosting domain, which is a genuine supply-chain risk: if the host were compromised or the download intercepted (no HTTPS), arbitrary code would execute during packaging. The lack of HTTPS is a notable additional concern. This fits the medium severity definition: an executed binary from an unofficial/personal host, not clearly malicious but a real supply-chain concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alex Tharp <alex at toastercup dot io>
    
      2pkgname=coolvlviewer-experimental-bin
    
      3pkgver=1.32.1.9
    
      4pkgrel=1
    
      5pkgdesc="A third-party viewer for Second Life (C) (secondlife) and OpenSim (opensimulator) grids. ('VL' stands for virtual life, formerly known as 'Cool SL Viewer', binary)"
    
      6url="http://sldev.free.fr"
    
      7license=('custom')
    
      8depends=('apr-util' 'glib2>=2.32' 'libgl' 'libidn' 'mesa' 'sdl' 'glu' 'pangox-compat' 'gconf' 'libxss' 'libxrandr' 'libxcomposite' 'libgl' 'lib32-zlib' 'libcups' 'atk' 'lib32-libsndfile' 'lib32-util-linux' 'lib32-libidn' 'libxcursor' 'libxtst')
    
      9optdepends=(
    
      10	'libpulse: for PulseAudio support'
    
      11	'alsa-lib: for ALSA support'
    
      12	'lib32-alsa-lib: for ALSA support'
    
      13	'nvidia-utils: for NVIDIA support'
    
      14	'pepper-flash: for inworld Flash support'
    
      15	'gst-plugins-good: for video support'
    
      16	'gst-plugins-bad: for video support'
    
      17	'gst-plugins-ugly: for video support'
    
      18	'lib32-freealut: for OpenAL support'
    
      19	'lib32-libidn11: for voice support'
    
      20	'wine: for SLVoice support')
    
      21arch=('x86_64')
    
      22conflicts=('coolvlviewer-bin' 'coolvlviewer-experimental' 'coolvlviewer')
    
      23install=coolvlviewer.install
    
      24source=("http://sldev.free.fr/binaries/CoolVLViewer-${pkgver}-Linux-x86_64-Setup"
    
      25        "coolvlviewer.desktop"
    
      26        "coolvlviewer.launcher")
    
      27sha1sums=('e46fa3ac6b95525c12d39f786bfeb54fb30dd6d0'
    
      28          'd5defd3d847fcfb7cdf41150ab55684dedc79275'
    
      29          '3ef1284a00a4437e4c34f809311ee0672604ef04')
    
      30
    
      31build() {
    
      32	cd $srcdir
    
      33	chmod +x CoolVLViewer-${pkgver}-Linux-x86_64-Setup
    
      34
    
      35	# Run the installer
    
      36	./CoolVLViewer-${pkgver}-Linux-x86_64-Setup --mode silent --destination $srcdir/coolvlviewer/
    
      37}
    
      38
    
      39package() {
    
      40	# Install Desktop File
    
      41	install -D -m644 $srcdir/coolvlviewer.desktop \
    
      42		$pkgdir/usr/share/applications/coolvlviewer.desktop
    
      43
    
      44	# Install Icon File
    
      45	install -D -m755 $srcdir/coolvlviewer/cvlv_icon.png \
    
      46		$pkgdir/usr/share/pixmaps/clvl_icon.png
    
      47
    
      48	# Install Launcher
    
      49	install -D -m755 $srcdir/coolvlviewer.launcher \
    
      50		$pkgdir/usr/bin/coolvlviewer
    
      51
    
      52	# Install License
    
      53	install -D -m644 $srcdir/coolvlviewer/licenses.txt \
    
      54		$pkgdir/usr/share/licenses/$pkgname/LISENSE
    
      55
    
      56	# Move Data to Destination Directory
    
      57	install -d $pkgdir/opt/
    
      58	mv coolvlviewer/ $pkgdir/opt/
    
      59
    
      60	# Change Permissions of files to root:games
    
      61	chown -R root:games $pkgdir/opt/coolvlviewer
    
      62	chmod -R g+rw $pkgdir/opt/coolvlviewer
    
      63
    
      64	# Make Binary Group-Executable
    
      65	chmod g+x $pkgdir/opt/coolvlviewer/cool_vl_viewer
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2