openvpn-hidemyname

maintainer dmitrysvd · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs a prebuilt x86_64 binary from hixxxx.name (a domain associated with the HideMyName VPN service, but not the canonical openvpn.net release infrastructure) directly into /usr/bin/openvpn-hmn. The binary is executed code, not data, and comes from a third-party host with no source build reproducibility. Even with a sha256sum pinning the specific artifact, the supply-chain risk is real: if hixxxx.name is compromised or the binary was tampered with before the checksum was recorded, arbitrary code runs as root during installation. There is no source compilation, no patch set applied to upstream OpenVPN sources, and no way to audit what 'obfuscation patches' were actually applied. This is a textbook medium-severity supply-chain concern: an executed binary from an unofficial/personal host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("patched-openvpn::https://hixxxx.name/files/software/obf/openvpn-2.6.12-archlinux-2024.09.01-x86_64")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads and installs a prebuilt x86_64 binary from hixxxx.name (a domain associated with the HideMyName VPN service, but not the canonical openvpn.net release infrastructure) directly into /usr/bin/openvpn-hmn. The binary is executed code, not data, and comes from a third-party host with no source build reproducibility. Even with a sha256sum pinning the specific artifact, the supply-chain risk is real: if hixxxx.name is compromised or the binary was tampered with before the checksum was recorded, arbitrary code runs as root during installation. There is no source compilation, no patch set applied to upstream OpenVPN sources, and no way to audit what 'obfuscation patches' were actually applied. This is a textbook medium-severity supply-chain concern: an executed binary from an unofficial/personal host.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=openvpn-hidemyname
    
      2pkgver=2.6.12
    
      3pkgrel=1
    
      4pkgdesc="OpenVPN with HideMyName patches for obfuscation"
    
      5arch=('x86_64')
    
      6url=https://hidemy.name/ru/vpn/router/openwrt/
    
      7license=('custom')
    
      8depends=('openvpn')
    
      9options=(!debug)
    
      10# Use the mirror url of HideMyName site
    
      11source=("patched-openvpn::https://hixxxx.name/files/software/obf/openvpn-2.6.12-archlinux-2024.09.01-x86_64")
    
      12sha256sums=('57de508943a5ca7e532cb188866e7c472483fc6d233c0397c76b1253e7b5458b')
    
      13
    
      14package() {
    
      15    install -D -m755 "${srcdir}/patched-openvpn" "${pkgdir}/usr/bin/openvpn-hmn"
    
      16}
    
      17

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2