eddie-ui-git

MEDIUM
maintainer Eddie.website 14 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The build downloads a changelog from an untrusted host (eddie.website) without verifying its integrity, which could allow tampering with release notes, but does not execute it or use it in a security-sensitive context.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

  • PKGBUILD:119 curl "https://eddie.website/changelog/?software=client&format=debian&hidden=yes" -o "changelog"
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The build downloads a changelog from an untrusted host (eddie.website) without verifying its integrity, which could allow tampering with release notes, but does not execute it or use it in a security-sensitive context.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Eddie.website <maintainer@eddie.website>
2# Based on work by Uncle Hunto <unclehunto äτ ÝãΗ00 Ð0τ ÇÖΜ> and Beini <bane aτ iki dot fi>
3
4
5pkgname=eddie-ui-git
6pkgver=2.27.2
7pkgrel=1
8pkgdesc='Eddie - VPN tunnel - UI'
9arch=('x86_64' 'aarch64')
10url=https://eddie.website
11license=('GPL-3.0-or-later')
12depends=(mono curl openvpn sudo polkit libnotify libayatana-appindicator)
13optdepends=('stunnel: VPN over SSL' 'openssh: VPN over SSH')
14makedepends=(git cmake patchelf 'dotnet-runtime>=10' 'dotnet-sdk>=10' mono-msbuild mono desktop-file-utils)
15provides=('eddie-ui')
16conflicts=('airvpn' 'airvpn-beta-bin' 'airvpn-git' 'eddie-ui')
17install=eddie-ui.install
18source=('git+https://github.com/AirVPN/Eddie.git')
19sha256sums=('SKIP')
20options=('!strip') # Incompatible with net10
21
22LINE="l"
23
24
25ARCH=$CARCH
26RID=linux-$CARCH
27if [ "$RID" = "linux-x86_64" ]; then
28 ARCH=x64
29 RID=linux-x64
30elif [ "$RID" = "linux-aarch64" ]; then
31 RID=linux-arm64
32fi
33
34build() {
35
36 CONFIG=Release
37
38 cd "Eddie"
39
40 # CLI
41 if true; then
42
43 chmod +x src/App.CLI.Linux/postbuild.sh
44 chmod +x src/Lib.Platform.Linux.Native/build.sh
45
46 cd "src/App.CLI.Linux/"
47
48 dotnet publish App.CLI.Linux.net10.csproj --configuration ${CONFIG} --runtime ${RID} --self-contained true -p:PublishTrimmed=true -p:EnableCompressionInSingleFile=true
49
50 cd "../../"
51 fi
52
53 # UI
54 if [ "ui" = "ui" ]; then
55 if [ "$LINE" = "u" ]; then
56 mkdir -p src/App.UI.Linux/bin
57 g++ \
58 src/App.UI.Linux/src/main.cpp \
59 src/App.UI.Linux/src/appgtk.cpp \
60 src/App.UI.Linux/src/iapplinux.cpp \
61 src/Lib.UI/src/iappposix.cpp \
62 src/Lib.UI/src/iapp.cpp \
63 -std=c++17 \
64 -o src/App.UI.Linux/bin/eddie-ui \
65 $(pkg-config --cflags --libs gtk+-3.0 ayatana-appindicator3-0.1 webkit2gtk-4.1)
66
67 strip -S --strip-unneeded src/App.UI.Linux/bin/eddie-ui
68 patchelf --set-rpath '$ORIGIN' src/App.UI.Linux/bin/eddie-ui
69 chmod a+x src/App.UI.Linux/bin/eddie-ui
70 elif [ "$LINE" = "l" ]; then
71
72 # Note: x64 in path hardcoded, correct, net4 build are CIL
73
74 export TERM=xterm # Fix Mono bug "Magic number is wrong".
75 TARGETFRAMEWORK="v4.8"; # Mono does not support TargetFrameworkVersion v4.8.1.
76 RULESETPATH="src/ruleset/norules.ruleset"
77 SOLUTIONPATH="src/App.Forms.Linux//App.Forms.Linux.sln"
78
79 # clean temporary files from net10 compilation above, otherwise throw 'Your project does not reference ".NETFramework,Version=v4.8"'
80 rm -rf "src/Lib.Core/bin"
81 rm -rf "src/Lib.Core/obj"
82 rm -rf "src/Lib.Platform.Linux/bin"
83 rm -rf "src/Lib.Platform.Linux/obj"
84
85 # msbuild is available when monodevelop is installed (reccomended)
86 # xbuild is available when mono-complete is installed (deprecated)
87 msbuild /verbosity:minimal /p:Configuration=${CONFIG} /p:Platform=x64 /p:TargetFrameworkVersion=${TARGETFRAMEWORK} /t:Rebuild "${SOLUTIONPATH}" /p:DefineConstants="EDDIEMONO4LINUX"
88
89 # msbuild/Mono under Linux don't honor the postbuild event, called manually
90 "src/App.Forms.Linux/postbuild.sh" "src/App.Forms.Linux/bin/x64/${CONFIG}/" ${ARCH} ${CONFIG}
91
92 # mkbundle
93 if [ $ARCH = "x64" ]; then
94 MKBUNDLECROSSTARGET="mono-6.8.0-debian-10-x64"
95 elif [ $ARCH = "aarch64" ]; then
96 MKBUNDLECROSSTARGET="mono-6.6.0-debian-10-arm64"
97 else
98 MKBUNDLECROSSTARGET="mono-6.8.0-debian-10-${ARCH}"
99 fi
100
101 # Issue here, check with 'mkbundle --list-targets'
102 #mkdir -p /home/pi/.mono/targets/${MKBUNDLECROSSTARGET}/lib/mono # Not sure if need
103 if [[ ! -d ${HOME}/.mono/targets/${MKBUNDLECROSSTARGET} ]]; then
104 echo Download mkbundle target. If break here, check with 'mkbundle --list-targets' and fix build.sh MKBUNDLECROSSTARGET
105 mkbundle --fetch-target ${MKBUNDLECROSSTARGET}
106 fi
107
108 # Update config
109 cp ${HOME}/.mono/targets/${MKBUNDLECROSSTARGET}/etc/mono/config src/App.Forms.Linux/bin/x64/Release/mkbundle.config
110 sed -i 's/\$mono_libdir\///g' src/App.Forms.Linux/bin/x64/Release/mkbundle.config
111
112 cd src/App.Forms.Linux/bin/x64/Release/
113 mkbundle App.Forms.Linux.exe -o eddie-ui --cross ${MKBUNDLECROSSTARGET} --i18n all --config mkbundle.config --library ../../../../../repository/linux_portable/mkbundle/${ARCH}/libMonoPosixHelper.so --library ../../../../../repository/linux_portable/mkbundle/${ARCH}/libgdiplus.so.0 --library /usr/lib/libmono-native.so
114 cd ../../../../..
115 fi
116 fi
117
118 # Generate changelog
119 curl "https://eddie.website/changelog/?software=client&format=debian&hidden=yes" -o "changelog"
120 gzip -n -9 -f "changelog"
121
122 if [ "ui" = "cli" ]; then
123 # Generate man
124 "src/App.CLI.Linux/bin/Release/net10.0/${RID}/publish/eddie-cli" --path.resources="../../../../../../resources" --help --help.format=man >"eddie-cli.8"
125 gzip -n -9 -f "eddie-cli.8"
126 fi
127
128}
129
130package() {
131 cd "Eddie"
132
133 install -Dm755 "repository/linux_arch/bundle/eddie-ui/usr/bin/eddie-ui" "$pkgdir/usr/bin/eddie-ui"
134
135 install -Dm644 "resources/eddie-vpn.txt" "$pkgdir/usr/share/eddie-ui/eddie-vpn.txt"
136 install -Dm644 "resources/manifest.json" "$pkgdir/usr/share/eddie-ui/manifest.json"
137 install -Dm644 "resources/libraries.txt" "$pkgdir/usr/share/eddie-ui/libraries.txt"
138 install -Dm644 "resources/gpl3.txt" "$pkgdir/usr/share/eddie-ui/gpl3.txt"
139 install -Dm644 "resources/cacert.pem" "$pkgdir/usr/share/eddie-ui/cacert.pem"
140 install -Dm644 "resources/iso-3166.json" "$pkgdir/usr/share/eddie-ui/iso-3166.json"
141
142 install -Dm644 "resources/locales/inv.json" "$pkgdir/usr/share/eddie-ui/locales/inv.json"
143
144 install -Dm644 "resources/icons/appindicator.png" "$pkgdir/usr/share/eddie-ui/icons/appindicator.png"
145 install -Dm644 "resources/icons/appindicator-gray.png" "$pkgdir/usr/share/eddie-ui/icons/appindicator-gray.png"
146 install -Dm644 "resources/icons/notifyicon.ico" "$pkgdir/usr/share/eddie-ui/icons/notifyicon.ico"
147 install -Dm644 "resources/icons/notifyicon-gray.ico" "$pkgdir/usr/share/eddie-ui/icons/notifyicon-gray.ico"
148 install -Dm644 "resources/icons/icon.png" "$pkgdir/usr/share/eddie-ui/icons/icon.png"
149 install -Dm644 "resources/icons/icon-gray.png" "$pkgdir/usr/share/eddie-ui/icons/icon-gray.png"
150
151 if [ "$LINE" = "u" ]; then
152 mkdir -p "$pkgdir/usr/share/eddie-ui/webui"
153 cp -a "resources/webui/." "$pkgdir/usr/share/eddie-ui/webui/"
154 fi
155
156 install -Dm644 "resources/providers/OpenVPN.json" "$pkgdir/usr/share/eddie-ui/providers/OpenVPN.json"
157 install -Dm644 "resources/providers/WireGuard.json" "$pkgdir/usr/share/eddie-ui/providers/WireGuard.json"
158 install -Dm644 "resources/providers/AirVPN.json" "$pkgdir/usr/share/eddie-ui/providers/AirVPN.json"
159
160 install -Dm644 "repository/linux_arch/bundle/eddie-ui/usr/share/doc/eddie-ui/copyright" "$pkgdir/usr/share/doc/eddie-ui/copyright"
161 install -Dm644 "repository/linux_arch/bundle/eddie-ui/usr/share/polkit-1/actions/org.airvpn.eddie.ui.elevated.policy" "$pkgdir/usr/share/polkit-1/actions/org.airvpn.eddie.ui.elevated.policy"
162
163 install -Dm644 "changelog.gz" "$pkgdir/usr/share/doc/eddie-ui/changelog.gz"
164
165 install -Dm755 "src/App.CLI.Linux/bin/Release/net10.0/${RID}/libLib.Platform.Linux.Native.so" "$pkgdir/usr/lib/eddie-ui/libLib.Platform.Linux.Native.so"
166 install -Dm755 "src/App.CLI.Linux/bin/Release/net10.0/${RID}/eddie-cli-elevated" "$pkgdir/usr/lib/eddie-ui/eddie-cli-elevated"
167 install -Dm755 "src/App.CLI.Linux/bin/Release/net10.0/${RID}/eddie-cli-elevated-service" "$pkgdir/usr/lib/eddie-ui/eddie-cli-elevated-service"
168 install -Dm755 "src/App.CLI.Linux/bin/Release/net10.0/${RID}/publish/eddie-cli" "$pkgdir/usr/lib/eddie-ui/eddie-cli"
169
170 if [ "ui" = "cli" ]; then
171 install -Dm644 "eddie-cli.8.gz" "$pkgdir/usr/share/man/man8/eddie-cli.8.gz"
172 elif [ "ui" = "ui" ]; then
173 if [ "$LINE" = "u" ]; then
174 install -Dm755 "src/App.UI.Linux/bin/eddie-ui" "$pkgdir/usr/lib/eddie-ui/eddie-ui"
175 elif [ "$LINE" = "l" ]; then
176 install -Dm755 "src/App.Forms.Linux.Tray/bin/eddie-tray" "$pkgdir/usr/lib/eddie-ui/eddie-tray"
177 install -Dm755 "src/App.Forms.Linux/bin/x64/Release/eddie-ui" "$pkgdir/usr/lib/eddie-ui/eddie-ui"
178 fi
179
180 install -Dm644 "repository/linux_arch/bundle/eddie-ui/usr/share/pixmaps/eddie-ui.png" "$pkgdir/usr/share/pixmaps/eddie-ui.png"
181 fi
182
183
184 # Unknown if this is need today, 2023-12-12
185 if [ "ui" = "ui" ]; then
186 ## Fix .desktop file for KDE
187 _desktop_session=$(printf "%s" "$DESKTOP_SESSION" | awk -F "/" '{print $NF}')
188 if [ "$_desktop_session" = "plasma" ]; then
189 msg2 "Installing desktop file for KDE..."
190 desktop-file-install -m 644 --set-comment="OpenVPN UI" \
191 --dir="$pkgdir/usr/share/applications/" \
192 --set-icon="/usr/share/pixmaps/eddie-ui.png" \
193 "repository/linux_arch/bundle/eddie-ui/usr/share/applications/eddie-ui.desktop"
194 else
195 msg2 "Installing desktop file..."
196 desktop-file-install -m 644 --set-comment="OpenVPN UI" \
197 --dir="$pkgdir/usr/share/applications/" \
198 "repository/linux_arch/bundle/eddie-ui/usr/share/applications/eddie-ui.desktop"
199 fi
200 fi
201}
202
203

Changes since previous scan

--- PKGBUILD @ 2026-09-14 00:27
+++ PKGBUILD @ 2026-09-17 00:27
@@ -3,7 +3,7 @@
pkgname=eddie-ui-git
-pkgver=2.27.1
+pkgver=2.27.2
pkgrel=1
pkgdesc='Eddie - VPN tunnel - UI'
arch=('x86_64' 'aarch64')

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Medium 2
2026-09-16 00:03:17 Medium 2
2026-09-15 00:25:31 Medium 2
2026-09-14 15:17:35 Medium 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 13:53:13 Medium 1
2026-09-03 00:15:47 Medium 2
2026-09-02 00:02:31 Medium 2
2026-09-01 00:11:19 Medium 2
2026-08-31 00:19:57 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion