forcepoint-client-bin

maintainer timrosu · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and executes two prebuilt binaries: (1) the Forcepoint VPN client itself from 'it.um.si' (University of Maribor IT department), which is an institutional mirror rather than the official Forcepoint download portal, and (2) a libevent-openssl .deb from a Slovenian Debian mirror (ftp.si.debian.org), which is an official Debian mirror and low-risk. The main concern is the Forcepoint binary sourced from a third-party institutional host rather than directly from forcepoint.com — if that host were compromised, a malicious binary could be delivered. However, sha256sums are present for all sources, which mitigates (but does not eliminate) the supply-chain risk since the hashes themselves could be wrong if the maintainer fetched from a compromised source. The libevent library from a Debian mirror is standard practice for compatibility shims. The 'forcepoint-client-fix' wrapper script is included in the source array with a checksum. There is also a minor concern that prepare() installs a config file directly into the user's $HOME during the build phase, which is non-standard packaging practice. Overall this is a genuine medium: a prebuilt proprietary binary from an unofficial/institutional host with checksums present.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${_pkgname}-${pkgver}.zip::https://it.um.si/Documents/VPNClientLinux252.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and executes two prebuilt binaries: (1) the Forcepoint VPN client itself from 'it.um.si' (University of Maribor IT department), which is an institutional mirror rather than the official Forcepoint download portal, and (2) a libevent-openssl .deb from a Slovenian Debian mirror (ftp.si.debian.org), which is an official Debian mirror and low-risk. The main concern is the Forcepoint binary sourced from a third-party institutional host rather than directly from forcepoint.com — if that host were compromised, a malicious binary could be delivered. However, sha256sums are present for all sources, which mitigates (but does not eliminate) the supply-chain risk since the hashes themselves could be wrong if the maintainer fetched from a compromised source. The libevent library from a Debian mirror is standard practice for compatibility shims. The 'forcepoint-client-fix' wrapper script is included in the source array with a checksum. There is also a minor concern that prepare() installs a config file directly into the user's $HOME during the build phase, which is non-standard packaging practice. Overall this is a genuine medium: a prebuilt proprietary binary from an unofficial/institutional host with checksums present.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Tim Rosulnik <tim.rosulnik@gmail.com>
    
      2
    
      3_pkgname="forcepoint-client"
    
      4pkgname="${_pkgname}-bin"
    
      5pkgver=2.5.2
    
      6pkgrel=2
    
      7pkgdesc="SSL VPN client for Forcepoint NGFW"
    
      8arch=('x86_64')
    
      9url="https://www.forcepoint.com"
    
      10license=('proprietary')
    
      11depends=('libevent' 'libnl' 'openssl-1.1' 'libsecret')
    
      12provides=("${pkgname}")
    
      13conflicts=("${_pkgname}")
    
      14source=("${_pkgname}-${pkgver}.zip::https://it.um.si/Documents/VPNClientLinux252.zip"
    
      15	"libevent-openssl.deb::http://ftp.si.debian.org/debian/pool/main/libe/libevent/libevent-openssl-2.1-7_2.1.12-stable-1_amd64.deb"
    
      16	"forcepoint-client-fix"
    
      17	"fp.conf")
    
      18sha256sums=('9f32441189c3c27488de12f52bab66af084f0d861c4978d361d8ce391a86a133'
    
      19	'26abb086df10d311ff355341e5297d220c21f1bab8659982f06bc06281e4c017'
    
      20	'1260bf77168abb3c235bfd0a584b0431393ffafe7028872633b25b9d8f84518b'
    
      21	'f948bc232fc632982e22d592aab1f4f926fcbb431a8499cd23869ff100dbf139')
    
      22noextract=("libevent-openssl.deb")
    
      23_libtool="!libtool"
    
      24_debug="!debug"
    
      25
    
      26prepare() {
    
      27	# create dirs
    
      28	mkdir -p ext deb/fpc deb/essl "${srcdir}/${pkgname}-${pkgver}"
    
      29
    
      30	# extract forcepoint client
    
      31	bsdtar -xf "ForcepointVPNClientLinux252.zip" -C ext
    
      32	bsdtar -xf "ext/forcepoint-client_${pkgver}+bullseye_amd64.deb" -C deb/fpc
    
      33	bsdtar -xf "deb/fpc/data.tar.gz" -C "${srcdir}/${pkgname}-${pkgver}"
    
      34
    
      35	# extract required old libevent-openssl library
    
      36	bsdtar -xf "libevent-openssl.deb" -C deb/essl
    
      37	bsdtar -xf "deb/essl/data.tar.xz" -C "${srcdir}/${pkgname}-${pkgver}"
    
      38	mv "${srcdir}/${pkgname}-${pkgver}/usr/lib/x86_64-linux-gnu" "${srcdir}/${pkgname}-${pkgver}/usr/lib/${_pkgname}"
    
      39
    
      40	# copy script to bin dir
    
      41	cp "forcepoint-client-fix" "${srcdir}/${pkgname}-${pkgver}/usr/sbin/${_pkgname}-fix"
    
      42
    
      43	# check and install config
    
      44	CONF_DIR="${XDG_CONFIG_HOME:=$HOME/.config}/forcepoint"
    
      45	if [[ -f "$CONF_DIR/fp.conf" ]]; then
    
      46		msg "Using custom fp.conf"
    
      47	else
    
      48		install -d "$CONF_DIR"
    
      49		install -m700 "${srcdir}/fp.conf" "$CONF_DIR"
    
      50	fi
    
      51}
    
      52
    
      53package() {
    
      54	cd "${srcdir}/${pkgname}-${pkgver}"
    
      55
    
      56	# create dirs
    
      57	install -d ${pkgdir}/usr/bin
    
      58	install -d ${pkgdir}/usr/share/man/man1
    
      59	install -d ${pkgdir}/usr/share/doc/${_pkgname}
    
      60	install -d ${pkgdir}/usr/lib/${_pkgname}
    
      61
    
      62	# install forcepoint-client
    
      63	install -m755 usr/sbin/forcepoint-client ${pkgdir}/usr/bin/_forcepoint-client
    
      64	install -m744 usr/man/man1/forcepoint-client.1 ${pkgdir}/usr/share/man/man1
    
      65	install -m744 usr/share/doc/forcepoint-client/copyright ${pkgdir}/usr/share/doc/${_pkgname}
    
      66
    
      67	# install libevent-openssl library
    
      68	install -m744 usr/lib/${_pkgname}/libevent_openssl-2.1.so.7* ${pkgdir}/usr/lib/${_pkgname}
    
      69	install -m744 usr/share/doc/libevent-openssl-2.1-7/* ${pkgdir}/usr/lib/${_pkgname}
    
      70
    
      71	# install script
    
      72	install -m755 usr/sbin/forcepoint-client-fix ${pkgdir}/usr/bin/forcepoint-client
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2