f5fpc

MEDIUM

maintainer zrhoffman 4 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from a non-standard host (vpn.f5networks.net) which is not a well-known or whitelisted domain, and installs a setuid binary, creating a potential supply-chain risk if the host is compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 source=('license.html::https://cdn.f5.com/product/apm/apps/eula.html')
PKGBUILD:10 source_aarch64=("linux_f5cli-${pkgver}.aarch64.deb::https://${mirror}/public/download/linux_f5cli.aarch64.deb")

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:36 chmod u+s "${srcdir}/usr/local/lib/F5Networks/SSLVPN/svpn_${suffix}"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads prebuilt .deb binaries from a non-standard host (vpn.f5networks.net) which is not a well-known or whitelisted domain, and installs a setuid binary, creating a potential supply-chain risk if the host is compromised.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Tess Hoffman <tess@zrhoffman.net>
    
      2pkgname=f5fpc
    
      3pkgver=7274.0.0.2
    
      4pkgrel=1
    
      5pkgdesc='Command-line VPN client using FastPPP to connect to F5Networks BIG-IP APM 13.0'
    
      6arch=(aarch64 x86_64)
    
      7
    
      8source=('license.html::https://cdn.f5.com/product/apm/apps/eula.html')
    
      9mirror=vpn.f5networks.net
    
      10source_aarch64=("linux_f5cli-${pkgver}.aarch64.deb::https://${mirror}/public/download/linux_f5cli.aarch64.deb")
    
      11source_x86_64=("linux_f5cli-${pkgver}.x86_64.deb::https://${mirror}/public/download/linux_f5cli.x86_64.deb")
    
      12sha256sums=('4507e09374f3e6044952f375e4a1af31505b267c4e0bb066ff159e85694a3d6e')
    
      13sha256sums_aarch64=('54d0c3095f84ab1204a34ef2c44021759619556ba3aa988b26175ad2e0e12eb0')
    
      14sha256sums_x86_64=('d565411a631e529fc6da1d4c3017b7852c904f7cdc2a4df8c0e5f69c1d6ceda6')
    
      15b2sums=('234729d2ff102638d649e46aa7da193f3a46af396cf063876cbabb71b946ef2df4731519acc48f87e2a2d51f52e45ce494e04320a3fa006fbe5fb734820f51d8')
    
      16b2sums_aarch64=('926865d579137dedc722650a8b01611d1006526dd4f0340852172ffb25dc5da3ade140378eaa12a3d8ab0ba3eafba0cde68cc8b3e91dc23452177e25078cf43f')
    
      17b2sums_x86_64=('295e5d5b22efd35491517a5a809bd0ee87e8e8e380dda06da6cd322d0da648a4560c352d4b89f23de81e16b9db058ce17c36a519a4ea1ed3a8b1af154e3c07b3')
    
      18
    
      19depends=(openssl)
    
      20makedepends=(tar)
    
      21provides=("${pkgname}" svpn)
    
      22url='https://techdocs.f5.com/en-us/edge-client-7-2-7/big-ip-access-policy-manager-edge-client-and-application-configuration-7-2-7/clients-for-linux.html#linux-client-commands'
    
      23license=('commercial')
    
      24
    
      25pkgver() {
    
      26  tar xf data.tar.zst
    
      27  cat usr/local/lib/F5Networks/SSLVPN/etc/version.txt
    
      28}
    
      29
    
      30package() {
    
      31  install -dm755 "${pkgdir}/usr/bin/"
    
      32
    
      33  rm -r "${srcdir}/usr/local/bin"
    
      34
    
      35  suffix="$CARCH"
    
      36  chmod u+s "${srcdir}/usr/local/lib/F5Networks/SSLVPN/svpn_${suffix}"
    
      37  ln -s "/usr/local/lib/F5Networks/SSLVPN/svpn_${suffix}" "${pkgdir}/usr/bin/svpn"
    
      38  ln -s "/usr/local/lib/F5Networks/${pkgname}_${suffix}" "${pkgdir}/usr/bin/${pkgname}"
    
      39
    
      40  cp -a usr "${pkgdir}"
    
      41}
    
      42

Changes since previous scan

--- PKGBUILD @ 2026-10-31 00:07
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: Tess Hoffman <tess@zrhoffman.net>
 pkgname=f5fpc
-pkgver=7272.0.0.2
-pkgrel=3
+pkgver=7274.0.0.2
+pkgrel=1
 pkgdesc='Command-line VPN client using FastPPP to connect to F5Networks BIG-IP APM 13.0'
 arch=(aarch64 x86_64)
 
@@ -9,12 +9,12 @@
 mirror=vpn.f5networks.net
 source_aarch64=("linux_f5cli-${pkgver}.aarch64.deb::https://${mirror}/public/download/linux_f5cli.aarch64.deb")
 source_x86_64=("linux_f5cli-${pkgver}.x86_64.deb::https://${mirror}/public/download/linux_f5cli.x86_64.deb")
-sha256sums=('SKIP')
-sha256sums_aarch64=('2a8886a9816b1e81d2e3f2b1a7e11ad77aa504110793d901fa4cf1a82f4556c4')
-sha256sums_x86_64=('f9b436e892775b774a83ab7be9c0cc2009f65caf3aec21c68a28450093ceaf24')
-b2sums=('SKIP')
-b2sums_aarch64=('3845e1caae7a9140bfe8fbe03a03240a5716ed55bbf343b7d3099ba3363806a442a63c45e063588c5da8d80749937a7d2d6be41393cb511c80b3001ad6298144')
-b2sums_x86_64=('a6a5b9e0753372740c16791efe825dd4ad39a41ffc6cadc964264d16a47ceb0470c4481740270f192a697a18d513d690f2196b2bbe232f8c2909795d9e09fb1b')
+sha256sums=('4507e09374f3e6044952f375e4a1af31505b267c4e0bb066ff159e85694a3d6e')
+sha256sums_aarch64=('54d0c3095f84ab1204a34ef2c44021759619556ba3aa988b26175ad2e0e12eb0')
+sha256sums_x86_64=('d565411a631e529fc6da1d4c3017b7852c904f7cdc2a4df8c0e5f69c1d6ceda6')
+b2sums=('234729d2ff102638d649e46aa7da193f3a46af396cf063876cbabb71b946ef2df4731519acc48f87e2a2d51f52e45ce494e04320a3fa006fbe5fb734820f51d8')
+b2sums_aarch64=('926865d579137dedc722650a8b01611d1006526dd4f0340852172ffb25dc5da3ade140378eaa12a3d8ab0ba3eafba0cde68cc8b3e91dc23452177e25078cf43f')
+b2sums_x86_64=('295e5d5b22efd35491517a5a809bd0ee87e8e8e380dda06da6cd322d0da648a4560c352d4b89f23de81e16b9db058ce17c36a519a4ea1ed3a8b1af154e3c07b3')
 
 depends=(openssl)
 makedepends=(tar)

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	3
2026-10-31 03:57:49	Medium	3
2026-10-31 00:07:41	Medium	3
2026-10-30 00:29:30	Medium	3
2026-10-29 00:13:55	Medium	3
2026-10-28 00:06:54	Medium	3
2026-10-27 00:23:28	Medium	3
2026-10-26 00:12:40	Medium	3
2026-10-25 00:20:48	Medium	3
2026-10-24 00:14:55	Medium	3
2026-10-23 00:02:19	Medium	3
2026-10-22 00:13:10	Medium	3
2026-10-21 00:12:50	Medium	3
2026-10-20 00:10:31	Medium	3
2026-10-19 00:03:55	Medium	3
2026-10-18 00:06:55	Medium	3
2026-10-17 00:21:55	Medium	3
2026-10-16 23:16:14	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3