defguard-client-nightly

MEDIUM

maintainer teon 0 votes scanned 2026-08-28 15:38:44.104675

View on AUR

Why flagged

Downloads and installs a prebuilt binary .deb from nightly.defguard.net (the project's own nightly infrastructure), which is plausibly official but is a non-standard host serving pre-compiled executables that are not reproducible from source; the checksum is pinned so swapping is harder, but the nightly host is less trustworthy than a stable release channel and the binary is executed directly without compilation.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source_x86_64=("$_deb::https://nightly.defguard.net/defguard-client/release-2.1/defguard-client-${CARCH}-5aba651.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and installs a prebuilt binary .deb from nightly.defguard.net (the project's own nightly infrastructure), which is plausibly official but is a non-standard host serving pre-compiled executables that are not reproducible from source; the checksum is pinned so swapping is harder, but the nightly host is less trustworthy than a stable release channel and the binary is executed directly without compilation.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Defguard <community@defguard.net>
    
      2#
    
      3# Generated by defguard-aur 1.0.0 -- do not edit by hand, regenerate instead.
    
      4# Nightly branch : release-2.1 (upstream version 2.1.0)
    
      5# Commit         : 5aba651
    
      6# Uploaded (UTC) : 2026-08-28 06:52
    
      7# Repackages the nightly Debian build; no compilation happens here.
    
      8
    
      9pkgname=defguard-client-nightly
    
      10pkgver=2.1.0+release_2.1.5aba651
    
      11pkgrel=1
    
      12pkgdesc="Defguard VPN Multi-Factor Authentication Desktop Client (nightly release-2.1 5aba651)"
    
      13arch=('x86_64')
    
      14url="https://github.com/DefGuard/client"
    
      15license=('custom')
    
      16depends=('desktop-file-utils' 'gtk3' 'hicolor-icon-theme' 'libayatana-appindicator' 'libsoup3' 'pango' 'webkit2gtk-4.1' 'systemd-resolvconf')
    
      17makedepends=('libarchive')
    
      18options=('!strip' '!debug')
    
      19install=defguard-client-nightly.install
    
      20provides=('defguard-client')
    
      21conflicts=('defguard-client')
    
      22
    
      23_branch=release-2.1
    
      24_commit=5aba651
    
      25_deb="$pkgname-$pkgver-$CARCH.deb"
    
      26source_x86_64=("$_deb::https://nightly.defguard.net/defguard-client/release-2.1/defguard-client-${CARCH}-5aba651.deb")
    
      27noextract=("$_deb")
    
      28sha256sums_x86_64=('e691d71458affd494be359cdf8bb9b6dedf65fe2f156a57de94c77321005bdff')
    
      29
    
      30package() {
    
      31    echo "  -> Unpacking the nightly Debian package payload..."
    
      32    # Pull data.tar.* out of the .deb (an ar archive) straight into $pkgdir.
    
      33    bsdtar -xOf "$srcdir/$_deb" 'data.tar*' | bsdtar -xpf - -C "$pkgdir"
    
      34
    
      35    # /usr/sbin is a symlink to /usr/bin on Arch, so no package may ship that directory.
    
      36    if [[ -f "$pkgdir/usr/sbin/defguard-service" ]]; then
    
      37        mv "$pkgdir/usr/sbin/defguard-service" "$pkgdir/usr/bin/"
    
      38        rmdir "$pkgdir/usr/sbin"
    
      39    fi
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-28 15:38:44	Medium	3
2026-08-28 15:35:42	Medium	3