kelvpn

maintainer hyttmi · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt binary .deb packages from pub.kelvpn.com, which is the official distribution host for KelVPN (a commercial VPN product). The binaries are not built from source — they are extracted and installed directly. The host appears to be the vendor's own distribution server rather than a random personal host, which reduces (but does not eliminate) supply-chain risk. The sha256 checksums provide integrity verification against tampering in transit, but there is no GPG signature verification. The core concern is that prebuilt closed-source VPN binaries with network-level access are being installed, and trust is entirely placed in the vendor's distribution infrastructure. This is a legitimate medium-risk pattern: executed proprietary binaries from a vendor-controlled but non-auditable host, with no source build and no cryptographic signature beyond checksums. Not clearly malicious, but a real supply-chain concern for a VPN client that handles sensitive network traffic.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source_x86_64=(https://pub.kelvpn.com/linux/master/KelVPN-7.7-90-amd64.deb)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): This PKGBUILD downloads prebuilt binary .deb packages from pub.kelvpn.com, which is the official distribution host for KelVPN (a commercial VPN product). The binaries are not built from source — they are extracted and installed directly. The host appears to be the vendor's own distribution server rather than a random personal host, which reduces (but does not eliminate) supply-chain risk. The sha256 checksums provide integrity verification against tampering in transit, but there is no GPG signature verification. The core concern is that prebuilt closed-source VPN binaries with network-level access are being installed, and trust is entirely placed in the vendor's distribution infrastructure. This is a legitimate medium-risk pattern: executed proprietary binaries from a vendor-controlled but non-auditable host, with no source build and no cryptographic signature beyond checksums. Not clearly malicious, but a real supply-chain concern for a VPN client that handles sensitive network traffic.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mika Hyttinen <mika dot hyttinen+arch ät gmail dot com>
    
      2pkgname=kelvpn
    
      3pkgver=7.7.90
    
      4pkgrel=1
    
      5pkgdesc="Decentralized quantum-secure VPN service. It provides the highest level of protection for your network connection, including quantum threat protection."
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://kelvpn.com/"
    
      8license=('LicenseRef-custom')
    
      9provides=("kelvpn")
    
      10source_x86_64=(https://pub.kelvpn.com/linux/master/KelVPN-7.7-90-amd64.deb)
    
      11source_aarch64=(https://pub.kelvpn.com/linux/master/KelVPN-7.7-90-arm64.deb)
    
      12sha256sums_x86_64=('72bf88df644f97d3fdbc97f220ca5244c2e0b401271016469d86fb49d2dacbc9')
    
      13sha256sums_aarch64=('182016ef36d2dfc4ea912178c0b8dfd5a4d440a7421a04254ce0b3c6112666b9')
    
      14install=$pkgname.install
    
      15options=(!debug)
    
      16depends=(fontconfig freetype2 libgl libpng libx11 libxcb libxrandr networkmanager xcb-util-image xcb-util-keysyms xcb-util-renderutil xcb-util-wm zlib net-tools)
    
      17
    
      18package() {
    
      19	bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      20	mkdir -p "$pkgdir"/usr/bin
    
      21	chmod -R 755 "$pkgdir/opt/$pkgname/bin"
    
      22	ln -sf "$pkgdir/opt/$pkgname/bin/KelVPN" "$pkgdir/usr/bin/$pkgname"
    
      23	install -Dm 644 "$pkgdir/opt/$pkgname/share/KelVPN.desktop" -t "$pkgdir/usr/share/applications/"
    
      24	install -Dm 644 "$pkgdir/opt/$pkgname/share/KelVPNService.service" -t "$pkgdir/usr/lib/systemd/system/"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2