janusvr

maintainer adelaidacervera · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary tarball (janusvr_linux.tar.gz) from downloads.janusvr.com with a SKIP'd checksum, meaning no integrity verification is performed on the executed binary. Additionally, the version is fetched at parse time via a live curl call to janusvr.com/version.html, which is used to construct the source filename but doesn't actually pin the download — the URL always fetches the latest linux tarball regardless. The combination of: (1) a prebuilt executable installed to /opt and made executable, (2) no checksum verification (SKIP), and (3) a dynamic version fetch that could be manipulated via DNS or server-side changes, constitutes a genuine supply-chain risk. The host (downloads.janusvr.com) appears to be the official project host, which reduces but does not eliminate the concern. This is a real medium-severity supply-chain issue: an unofficial or compromised server could serve arbitrary code that gets installed and executed on the user's system.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:8 janusver=$(curl http://www.janusvr.com/version.html)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("janusvr${janusver}.gz::http://downloads.janusvr.com/janusvr_linux.tar.gz"
PKGBUILD:11 "https://janusvr.com/images/logos/logoonly.png"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary tarball (janusvr_linux.tar.gz) from downloads.janusvr.com with a SKIP'd checksum, meaning no integrity verification is performed on the executed binary. Additionally, the version is fetched at parse time via a live curl call to janusvr.com/version.html, which is used to construct the source filename but doesn't actually pin the download — the URL always fetches the latest linux tarball regardless. The combination of: (1) a prebuilt executable installed to /opt and made executable, (2) no checksum verification (SKIP), and (3) a dynamic version fetch that could be manipulated via DNS or server-side changes, constitutes a genuine supply-chain risk. The host (downloads.janusvr.com) appears to be the official project host, which reduces but does not eliminate the concern. This is a real medium-severity supply-chain issue: an unofficial or compromised server could serve arbitrary code that gets installed and executed on the user's system.

PKGBUILD

3 offending line(s) highlighted

      1pkgname=janusvr
    
      2pkgdesc='3D VR internet browser'
    
      3url='http://www.dgp.toronto.edu/~mccrae/projects/firebox/'
    
      4pkgver=59.8
    
      5pkgrel=1
    
      6arch=('x86_64')
    
      7license=('custom')
    
      8janusver=$(curl http://www.janusvr.com/version.html)
    
      9source=("janusvr${janusver}.gz::http://downloads.janusvr.com/janusvr_linux.tar.gz"
    
      10        "janusvr.sh"
    
      11	"https://janusvr.com/images/logos/logoonly.png"
    
      12        "janusvr.desktop")
    
      13depends=('alsa-lib' 'libxt' 'libnotify' 'mime-types' 'nss' 'gtk2' 'sqlite' 'dbus-glib' 'qt5-multimedia')
    
      14optdepends=("oculus-rift-sdk-jherico-git: For libOVR including a fix for mesa. Don't forget to Replace /opt/janusvr/libOVRRT64_0.so.5.0.1")
    
      15makedepends=("imagemagick") #only for converting the icon
    
      16
    
      17pkgver() {
    
      18  echo "$janusver"
    
      19}
    
      20
    
      21package() {
    
      22  install -d "$pkgdir/opt"
    
      23  install -d "$pkgdir/usr/share/icons/"
    
      24  install -d "$pkgdir/usr/share/applications"
    
      25
    
      26  cp -ra JanusVRBin/ "$pkgdir/opt/janusvr"
    
      27#  chmod a+x "$pkgdir/opt/janusvr"/*.sh
    
      28  chmod a+x "$pkgdir/opt/janusvr/janusvr"
    
      29  chmod -R a+rX "$pkgdir/opt/janusvr"
    
      30  
    
      31  install -d "$pkgdir/usr/bin"
    
      32  install -m755 "$srcdir/janusvr.sh" "$pkgdir/usr/bin/janusvr"
    
      33
    
      34  # segfaults for me with mesa with OpenCL. WAT
    
      35  MAGICK_OCL_DEVICE=OFF convert "$srcdir/logoonly.png" -resize 128x128 "$pkgdir/usr/share/icons/janusvr.png" # screw the aspect ratio
    
      36
    
      37  install "${srcdir}/janusvr.desktop" "${pkgdir}/usr/share/applications/janusvr.desktop"
    
      38
    
      39  # CAUTION: Everyone in the group "games" can replace the whole thing e.g. with malware
    
      40  # But for now there doesn't seem to be a better way, because it needs write accessess error_log.txt in its base directory, also temporary files are created there....
    
      41  chown -R root:games "${pkgdir}"/opt/janusvr
    
      42  chmod -R g+w "${pkgdir}"/opt/janusvr
    
      43
    
      44  rm -f "$pkgdir"/opt/janusvr/libstdc++.so.6
    
      45
    
      46  #mv "$pkgdir/opt/janusvr/libOVRRT64_0.so.5.0.1" "$pkgdir/opt/janusvr/libOVRRT64_0.so.5.0.1.bak"
    
      47  #install -m755 "$srcdir/libovr.so" "$pkgdir/opt/janusvr/libOVRRT64_0.so.5.0.1"
    
      48}
    
      49
    
      50md5sums=('SKIP'
    
      51         'c05bb2fbfce12c89db560ed8b8bb036a'
    
      52	 'c2dd07b34a1f0f25ff619c12dd12ee9b'
    
      53         'a8a2ce8e4dfa4e4e87a6af811b5627a4')
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3