f5fpc

maintainer zrhoffman · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a non-whitelisted host (f5networks.net) with a SKIP'd checksum for the license file, and sets the SUID bit on the installed binary, creating a potential supply-chain risk if the binary were tampered with.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 source=('license.html::https://cdn.f5.com/product/apm/apps/eula.html')
PKGBUILD:10 source_aarch64=("linux_f5cli-${pkgver}.aarch64.deb::https://${mirror}/public/download/linux_f5cli.aarch64.deb")

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:36 chmod u+s "${srcdir}/usr/local/lib/F5Networks/SSLVPN/svpn_${suffix}"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt binary from a non-whitelisted host (f5networks.net) with a SKIP'd checksum for the license file, and sets the SUID bit on the installed binary, creating a potential supply-chain risk if the binary were tampered with.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Zach Hoffman <zach@zrhoffman.net>
    
      2pkgname=f5fpc
    
      3pkgver=7271.0.0.4
    
      4pkgrel=3
    
      5pkgdesc='Command-line VPN client using FastPPP to connect to F5Networks BIG-IP APM 13.0'
    
      6arch=(aarch64 x86_64)
    
      7
    
      8source=('license.html::https://cdn.f5.com/product/apm/apps/eula.html')
    
      9mirror=vpn.f5networks.net
    
      10source_aarch64=("linux_f5cli-${pkgver}.aarch64.deb::https://${mirror}/public/download/linux_f5cli.aarch64.deb")
    
      11source_x86_64=("linux_f5cli-${pkgver}.x86_64.deb::https://${mirror}/public/download/linux_f5cli.x86_64.deb")
    
      12sha256sums=('4507e09374f3e6044952f375e4a1af31505b267c4e0bb066ff159e85694a3d6e')
    
      13sha256sums_aarch64=('92cb4ed4b923e1878a887091a97fcde170477549c6765753fa0b484687465299')
    
      14sha256sums_x86_64=('e6b33c2c2d36a0b79271c634f83188bcf9762d749887f2f6d304e466312a18cf')
    
      15b2sums=('234729d2ff102638d649e46aa7da193f3a46af396cf063876cbabb71b946ef2df4731519acc48f87e2a2d51f52e45ce494e04320a3fa006fbe5fb734820f51d8')
    
      16b2sums_aarch64=('6397d561d68c1583b6190813ce4db4463070194d2ba72f211034647442418da936eb96bf60617904706e1d6990c6c9c32ef060627fa55bcc2f3ab2c9d81fff16')
    
      17b2sums_x86_64=('159952b9de520a98a9ff6d4a4f855809e4ec2016c5f2918a5d19871a8574b2434aa4499ed991fc80268c27caf55ac0866d463ddce2fbbeb4de28e0026a986d9d')
    
      18
    
      19depends=(openssl)
    
      20makedepends=(tar)
    
      21provides=("${pkgname}" svpn)
    
      22url='https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-client-configuration-11-4-0/4.html'
    
      23license=('commercial')
    
      24
    
      25pkgver() {
    
      26  tar xf data.tar.zst
    
      27  cat usr/local/lib/F5Networks/SSLVPN/etc/version.txt
    
      28}
    
      29
    
      30package() {
    
      31  install -dm755 "${pkgdir}/usr/bin/"
    
      32
    
      33  rm -r "${srcdir}/usr/local/bin"
    
      34
    
      35  suffix="$CARCH"
    
      36  chmod u+s "${srcdir}/usr/local/lib/F5Networks/SSLVPN/svpn_${suffix}"
    
      37  ln -s "/usr/local/lib/F5Networks/SSLVPN/svpn_${suffix}" "${pkgdir}/usr/bin/svpn"
    
      38  ln -s "/usr/local/lib/F5Networks/${pkgname}_${suffix}" "${pkgdir}/usr/bin/${pkgname}"
    
      39
    
      40  cp -a usr "${pkgdir}"
    
      41}
    
      42

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,22 +1,19 @@
 # Maintainer: Zach Hoffman <zach@zrhoffman.net>
 pkgname=f5fpc
 pkgver=7271.0.0.4
-pkgrel=1
+pkgrel=3
 pkgdesc='Command-line VPN client using FastPPP to connect to F5Networks BIG-IP APM 13.0'
-arch=(aarch64 armv7h x86_64)
+arch=(aarch64 x86_64)
 
 source=('license.html::https://cdn.f5.com/product/apm/apps/eula.html')
-mirror=vpn-mgmt.it.mtu.edu
+mirror=vpn.f5networks.net
 source_aarch64=("linux_f5cli-${pkgver}.aarch64.deb::https://${mirror}/public/download/linux_f5cli.aarch64.deb")
-source_armv7h=("linux_f5cli-${pkgver}.armv7h.deb::https://${mirror}/public/download/linux_f5cli.armhf.deb")
 source_x86_64=("linux_f5cli-${pkgver}.x86_64.deb::https://${mirror}/public/download/linux_f5cli.x86_64.deb")
 sha256sums=('4507e09374f3e6044952f375e4a1af31505b267c4e0bb066ff159e85694a3d6e')
 sha256sums_aarch64=('92cb4ed4b923e1878a887091a97fcde170477549c6765753fa0b484687465299')
-sha256sums_armv7h=('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')
 sha256sums_x86_64=('e6b33c2c2d36a0b79271c634f83188bcf9762d749887f2f6d304e466312a18cf')
 b2sums=('234729d2ff102638d649e46aa7da193f3a46af396cf063876cbabb71b946ef2df4731519acc48f87e2a2d51f52e45ce494e04320a3fa006fbe5fb734820f51d8')
 b2sums_aarch64=('6397d561d68c1583b6190813ce4db4463070194d2ba72f211034647442418da936eb96bf60617904706e1d6990c6c9c32ef060627fa55bcc2f3ab2c9d81fff16')
-b2sums_armv7h=('786a02f742015903c6c6fd852552d272912f4740e15847618a86e217f71f5419d25e1031afee585313896444934eb04b903a685b1448b755d56f701afe9be2ce')
 b2sums_x86_64=('159952b9de520a98a9ff6d4a4f855809e4ec2016c5f2918a5d19871a8574b2434aa4499ed991fc80268c27caf55ac0866d463ddce2fbbeb4de28e0026a986d9d')
 
 depends=(openssl)
@@ -35,12 +32,7 @@
 
   rm -r "${srcdir}/usr/local/bin"
 
-  if [[ "$CARCH" == armv7h ]]; then
-    suffix=armhf
-  else
-    suffix="$CARCH"
-  fi
-
+  suffix="$CARCH"
   chmod u+s "${srcdir}/usr/local/lib/F5Networks/SSLVPN/svpn_${suffix}"
   ln -s "/usr/local/lib/F5Networks/SSLVPN/svpn_${suffix}" "${pkgdir}/usr/bin/svpn"
   ln -s "/usr/local/lib/F5Networks/${pkgname}_${suffix}" "${pkgdir}/usr/bin/${pkgname}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 19:21:42	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 19:17:41	MEDIUM	3
2026-07-21 17:17:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3