openvpn-nl

MEDIUM

maintainer victordejong 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard, non-official host (sentyron.com) with no public upstream source or verification, creating a supply-chain risk if the host is compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "https://openvpn.sentyron.com/repos/deb/dists/trixie/Release"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard, non-official host (sentyron.com) with no public upstream source or verification, creating a supply-chain risk if the host is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Victor de Jong <victor@victordejong.com>
    
      2# Contributor: Victor de Jong <victor@victordejong.com>
    
      3
    
      4pkgname=openvpn-nl
    
      5pkgver=2.5.11nl3
    
      6pkgrel=1
    
      7pkgdesc="An open-source fork of OpenVPN for use by the NL government up to Dep.V."
    
      8arch=('x86_64')
    
      9url="https://openvpn.sentyron.com/"
    
      10options=('!debug')
    
      11
    
      12license=('GPL-2.0-only')
    
      13depends=('systemd-libs' 'glibc' 'perl' 'bash')
    
      14makedepends=('gnupg')
    
      15source=(
    
      16	"https://openvpn.sentyron.com/repos/deb/dists/trixie/Release"
    
      17	"https://openvpn.sentyron.com/repos/deb/dists/trixie/Release.gpg"
    
      18	"https://openvpn.sentyron.com/repos/deb/dists/trixie/main/binary-amd64/Packages"
    
      19	"https://openvpn.sentyron.com/repos/deb/pool/main/o/${pkgname}/${pkgname}_${pkgver::-3}-nl3-trixie_amd64.deb"
    
      20)
    
      21sha512sums=(
    
      22	'400bd9c0bc4efd1ed6a0e481c4fcdb1e55ad43391026fa16ae3bd65a58ddf37ff191212ae8cd25f166b111fb30b66d7c3aff45f4a21438836751209b3ba7291a'
    
      23	'5c03e2e0dd0921d9f40cff6d32c0767bd29c4858479c2556cc3aea6a49ab9eaee0cd83d3b768b7967a6045e5a12861432dcbe88ff314c7a84dc56af07ba1311a'
    
      24	'5c74429aa4dbe0d8773acdc4fe960f5c166533dc6fa498223b4b4dbf1e02134f384cca060ee7937d9e23592e58489a2a8fe943cab5618842f3477576a6a87d49'
    
      25	'89f330305793933a560888b1727be756ca06cc05f662deea23ced793df76a8255808692da8dc2935b0f9c22e7545882294626d687b50fb19fc6f7a0fb562370b'
    
      26)
    
      27validpgpkeys=('A518F75374D3AF82AE11810A13DF39ED913F5D8F')
    
      28
    
      29prepare() {
    
      30	# Set colour, yellow and reset respectively
    
      31	_YEL='\033[1;33m'
    
      32	_RED='\033[0;31m'
    
      33	_NC='\033[0m'
    
      34	_GREEN="\e[92m"
    
      35	echo -e "${_YEL}Verifying Release file with GPG key...${_NC}"
    
      36	(gpg --verify Release.gpg Release && echo -e "${_GREEN}OK${_NC}") \
    
      37		|| (echo -e "${_RED}There is something wrong with the signature. Either this package is compromised or you need to import the key from https://openvpn.sentyron.com/repos/sentyron-gpg.asc${_NC}" && exit 1)
    
      38
    
      39	echo -e "${_YEL}Verifying Packages file with previously verified Release file...${_NC}"
    
      40	(sed -n 17p Release | awk '{print $1 " Packages"}' | sha256sum --check --status --strict && echo -e "${_GREEN}OK${_NC}") \
    
      41		|| (echo -e "${_RED}There is something wrong with the SHA256 hash! This package is likely compromised and should not be used!${_NC}" && exit 1)
    
      42
    
      43	echo -e "${_YEL}Verifying ${pkgname}_${pkgver::-3}-nl3-trixie_amd64.deb package with previously verified Packages file...${_NC}"
    
      44	(sed -n 12p Packages | awk -v name=${pkgname}_${pkgver::-3}-nl3-trixie_amd64.deb '{print $2 " " name}' | sha256sum --check --status --strict && echo -e "${_GREEN}OK${_NC}") \
    
      45		|| (echo -e "${_RED}There is something wrong with the SHA256 hash! This package is likely compromised and should not be used!${_NC}" && exit 1)
    
      46}
    
      47
    
      48package() {
    
      49	cd "${srcdir}"
    
      50	tar -xf data.tar.xz -C "${srcdir}"
    
      51	install -vDm755 "${srcdir}/usr/sbin/openvpn-nl" "${pkgdir}/usr/bin/openvpn-nl"
    
      52	cp -r "${srcdir}/etc" "${pkgdir}/etc"
    
      53	cp -r "${srcdir}/usr/share" "${pkgdir}/usr/share"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2