dcvviewer-bin

maintainer bence.hornak · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary Debian package (.deb) from a CloudFront CDN URL (d1uj6qtbmh3dt5.cloudfront.net) and installs its contents directly. The CloudFront distribution belongs to AWS/NICE (Amazon acquired NICE Software, and NICE DCV is an official Amazon product distributed via their CDN), making this a legitimate vendor distribution channel rather than a personal or unofficial host. The sha256sum is pinned, which mitigates tampering risk. However, the package still installs prebuilt proprietary binaries from a CDN that is not a well-known, easily verifiable official package repository (like dl.google.com or packages.microsoft.com), and the binary is executed on the user's system. This is a standard pattern for proprietary software AUR packages (similar to zoom, slack-desktop, etc.) and the risk is comparable to those. The cheaper model's concern about CloudFront being 'swappable' is partially valid in theory but mitigated by the pinned checksum. Overall this is a legitimate medium-risk pattern for proprietary binary packaging, not a false positive, but also not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "https://d1uj6qtbmh3dt5.cloudfront.net/${_majver}/Clients/nice-dcv-viewer_${pkgver}-1_amd64.ubuntu2404.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary Debian package (.deb) from a CloudFront CDN URL (d1uj6qtbmh3dt5.cloudfront.net) and installs its contents directly. The CloudFront distribution belongs to AWS/NICE (Amazon acquired NICE Software, and NICE DCV is an official Amazon product distributed via their CDN), making this a legitimate vendor distribution channel rather than a personal or unofficial host. The sha256sum is pinned, which mitigates tampering risk. However, the package still installs prebuilt proprietary binaries from a CDN that is not a well-known, easily verifiable official package repository (like dl.google.com or packages.microsoft.com), and the binary is executed on the user's system. This is a standard pattern for proprietary software AUR packages (similar to zoom, slack-desktop, etc.) and the risk is comparable to those. The cheaper model's concern about CloudFront being 'swappable' is partially valid in theory but mitigated by the pinned checksum. Overall this is a legitimate medium-risk pattern for proprietary binary packaging, not a false positive, but also not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Bence Hornák <bence.hornak@gmail.com>
    
      2# Maintainer: xaque <xaque at 🦆 dot com>
    
      3
    
      4pkgname=dcvviewer-bin
    
      5_pkgname=dcvviewer
    
      6_majver=2024.0
    
      7_minver=8004
    
      8pkgver=${_majver}.${_minver}
    
      9pkgrel=1
    
      10pkgdesc="NICE DCV client for Linux. DCV is a desktop remotization server, with support for native as well as web-based clients."
    
      11arch=('x86_64')
    
      12url="https://www.nice-software.com/products/dcv"
    
      13license=('custom: commercial')
    
      14depends=('cairo' 'ffmpeg' 'gdk-pixbuf2' 'glib2' 'gst-plugins-base' 'gst-plugins-base-libs' 'gst-plugins-good' 'gstreamer' 'gtk4' 'harfbuzz-icu' 'json-glib' 'krb5' 'libfido2' 'libjpeg6-turbo' 'libjpeg-turbo' 'libsasl' 'libsoup3' 'libx11' 'lmdb' 'lz4' 'nss' 'pcsclite' 'protobuf-c' 'sqlite' 'wayland'
    
      15)
    
      16source=(
    
      17  "https://d1uj6qtbmh3dt5.cloudfront.net/${_majver}/Clients/nice-dcv-viewer_${pkgver}-1_amd64.ubuntu2404.deb"
    
      18)
    
      19sha256sums=('c8255bc21d42decab9b12bfd2443021bd27734e8a975916eb66ac0dc99fb7e9b')
    
      20install="${_pkgname}.install"
    
      21package(){
    
      22
    
      23  # Extract package data, move files to comply with Arch package guidelines
    
      24  # (https://wiki.archlinux.org/index.php/Arch_package_guidelines#Directories)
    
      25  tar -xf data.tar.zst -C "${pkgdir}" \
    
      26    --transform 's,^./usr/lib/x86_64-linux-gnu,./usr/lib,' \
    
      27    --transform 's,^./usr/share/dcvviewer/license/EULA.txt,./usr/share/licenses/dcvviewer/EULA,' \
    
      28    --transform 's,^./usr/share/dcvviewer\(/license\)\?$,.,' \
    
      29    --transform 's,^./usr/share/dcvviewer/third-party-licenses.txt,./usr/share/licenses/dcvviewer/LICENSE,' \
    
      30    --transform 's,^./usr/share/doc/nice-dcv-viewer/copyright,./usr/share/licenses/dcvviewer/COPYRIGHT,' \
    
      31    --transform 's,^./usr/share/doc\(/nice-dcv-viewer\)\?$,.,' \
    
      32    --exclude './usr/share/doc/nice-dcv-viewer/changelog.Debian.gz'
    
      33
    
      34  # Update paths in launcher script
    
      35  sed -i 's|libexecdir=${basedir}/lib/x86_64-linux-gnu|libexecdir=${basedir}/lib|' "${pkgdir}/usr/bin/dcvviewer"
    
      36  sed -i 's|libdir=${basedir}/lib/x86_64-linux-gnu|libdir=${basedir}/lib|' "${pkgdir}/usr/bin/dcvviewer"
    
      37
    
      38  # Fix for Wayland, force use of XWayland
    
      39  # sed -i '2 i export GDK_BACKEND=x11' "${pkgdir}/usr/bin/dcvviewer"
    
      40
    
      41  # Remove libraries replaced by system ones
    
      42  
    
      43  pushd "${pkgdir}/usr/lib/${_pkgname}"
    
      44  
    
      45  ## Most runtime ##
    
      46  #rm libglib-2.0.so.0 libgmodule-2.0.so.0 libgobject-2.0.so.0 libgthread-2.0.so.0 libgio-2.0.so.0
    
      47  #rm libffi.so.* libjson-glib-1.0.so.0
    
      48  ##              ##
    
      49  
    
      50  ## Most  native ##
    
      51  mkdir keep
    
      52  mv libavcodec.so.* libavutil.so.* libdcv.so libsoup* keep
    
      53  rm *.so*
    
      54  rm gtk4-update-icon-cache glib-compile-schemas glib-compile-resources gdk-pixbuf-query-loaders
    
      55  rm -rf gtk-4.0 gstreamer-1.0
    
      56  mv keep/* .
    
      57  rmdir keep
    
      58  sed -i '/export GST_PLUGIN_SCANNER/d' "${pkgdir}/usr/bin/dcvviewer"
    
      59  sed -i '/export GST_PLUGIN_SYSTEM_PATH/d' "${pkgdir}/usr/bin/dcvviewer"
    
      60  sed -i '/export GTK_PATH/d' "${pkgdir}/usr/bin/dcvviewer"
    
      61  sed -i '/export PANGO_LIBDIR/d' "${pkgdir}/usr/bin/dcvviewer"
    
      62  #pushd sasl2
    
      63  #rm libanonymous.so libdigestmd5.so libplain.so libscram.so libcrammd5.so libsasldb.so    # libsasl
    
      64  #rm libgssapiv2.so libgs2.so    # cyrus-sasl-gssapi
    
      65  #rm libotp.so    # ?
    
      66  #popd
    
      67 ##              ##
    
      68   
    
      69  popd
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2