openvpn-nl

maintainer victordejong · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-standard, non-official host (sentyron.com) with no public upstream source or verification, creating a supply-chain risk if the host is compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "https://openvpn.sentyron.com/repos/deb/dists/trixie/Release"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard, non-official host (sentyron.com) with no public upstream source or verification, creating a supply-chain risk if the host is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Victor de Jong <victor@victordejong.com>
    
      2# Contributor: Victor de Jong <victor@victordejong.com>
    
      3
    
      4pkgname=openvpn-nl
    
      5pkgver=2.5.11nl3
    
      6pkgrel=1
    
      7pkgdesc="An open-source fork of OpenVPN for use by the NL government up to Dep.V."
    
      8arch=('x86_64')
    
      9url="https://openvpn.sentyron.com/"
    
      10options=('!debug')
    
      11
    
      12license=('GPL-2.0-only')
    
      13depends=('systemd-libs' 'glibc' 'perl' 'bash')
    
      14makedepends=('gnupg')
    
      15source=(
    
      16	"https://openvpn.sentyron.com/repos/deb/dists/trixie/Release"
    
      17	"https://openvpn.sentyron.com/repos/deb/dists/trixie/Release.gpg"
    
      18	"https://openvpn.sentyron.com/repos/deb/dists/trixie/main/binary-amd64/Packages"
    
      19	"https://openvpn.sentyron.com/repos/deb/pool/main/o/${pkgname}/${pkgname}_${pkgver::-3}-nl3-trixie_amd64.deb"
    
      20)
    
      21sha512sums=(
    
      22	'400bd9c0bc4efd1ed6a0e481c4fcdb1e55ad43391026fa16ae3bd65a58ddf37ff191212ae8cd25f166b111fb30b66d7c3aff45f4a21438836751209b3ba7291a'
    
      23	'5c03e2e0dd0921d9f40cff6d32c0767bd29c4858479c2556cc3aea6a49ab9eaee0cd83d3b768b7967a6045e5a12861432dcbe88ff314c7a84dc56af07ba1311a'
    
      24	'5c74429aa4dbe0d8773acdc4fe960f5c166533dc6fa498223b4b4dbf1e02134f384cca060ee7937d9e23592e58489a2a8fe943cab5618842f3477576a6a87d49'
    
      25	'89f330305793933a560888b1727be756ca06cc05f662deea23ced793df76a8255808692da8dc2935b0f9c22e7545882294626d687b50fb19fc6f7a0fb562370b'
    
      26)
    
      27validpgpkeys=('A518F75374D3AF82AE11810A13DF39ED913F5D8F')
    
      28
    
      29prepare() {
    
      30	# Set colour, yellow and reset respectively
    
      31	_YEL='\033[1;33m'
    
      32	_RED='\033[0;31m'
    
      33	_NC='\033[0m'
    
      34	_GREEN="\e[92m"
    
      35	echo -e "${_YEL}Verifying Release file with GPG key...${_NC}"
    
      36	(gpg --verify Release.gpg Release && echo -e "${_GREEN}OK${_NC}") \
    
      37		|| (echo -e "${_RED}There is something wrong with the signature. Either this package is compromised or you need to import the key from https://openvpn.sentyron.com/repos/sentyron-gpg.asc${_NC}" && exit 1)
    
      38
    
      39	echo -e "${_YEL}Verifying Packages file with previously verified Release file...${_NC}"
    
      40	(sed -n 17p Release | awk '{print $1 " Packages"}' | sha256sum --check --status --strict && echo -e "${_GREEN}OK${_NC}") \
    
      41		|| (echo -e "${_RED}There is something wrong with the SHA256 hash! This package is likely compromised and should not be used!${_NC}" && exit 1)
    
      42
    
      43	echo -e "${_YEL}Verifying ${pkgname}_${pkgver::-3}-nl3-trixie_amd64.deb package with previously verified Packages file...${_NC}"
    
      44	(sed -n 12p Packages | awk -v name=${pkgname}_${pkgver::-3}-nl3-trixie_amd64.deb '{print $2 " " name}' | sha256sum --check --status --strict && echo -e "${_GREEN}OK${_NC}") \
    
      45		|| (echo -e "${_RED}There is something wrong with the SHA256 hash! This package is likely compromised and should not be used!${_NC}" && exit 1)
    
      46}
    
      47
    
      48package() {
    
      49	cd "${srcdir}"
    
      50	tar -xf data.tar.xz -C "${srcdir}"
    
      51	install -vDm755 "${srcdir}/usr/sbin/openvpn-nl" "${pkgdir}/usr/bin/openvpn-nl"
    
      52	cp -r "${srcdir}/etc" "${pkgdir}/etc"
    
      53	cp -r "${srcdir}/usr/share" "${pkgdir}/usr/share"
    
      54}
    
      55

Changes since previous scan

--- PKGBUILD @ 2026-07-26 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,24 +1,28 @@
 # Maintainer: Victor de Jong <victor@victordejong.com>
+# Contributor: Victor de Jong <victor@victordejong.com>
+
 pkgname=openvpn-nl
-pkgver=2.5.11nl1
+pkgver=2.5.11nl3
 pkgrel=1
 pkgdesc="An open-source fork of OpenVPN for use by the NL government up to Dep.V."
 arch=('x86_64')
-url="https://openvpn.fox-it.com/"
+url="https://openvpn.sentyron.com/"
+options=('!debug')
+
 license=('GPL-2.0-only')
-depends=('systemd-libs' 'glibc' 'perl' 'sh' 'bash')
+depends=('systemd-libs' 'glibc' 'perl' 'bash')
 makedepends=('gnupg')
 source=(
-	"https://openvpn.fox-it.com/repos/deb/dists/noble/Release" 
-	"https://openvpn.fox-it.com/repos/deb/dists/noble/Release.gpg"
-	"https://openvpn.fox-it.com/repos/deb/dists/noble/main/binary-amd64/Packages"
-	"https://openvpn.fox-it.com/repos/deb/pool/main/o/${pkgname}/${pkgname}_${pkgver::-3}-nl1-noble_amd64.deb"
+	"https://openvpn.sentyron.com/repos/deb/dists/trixie/Release"
+	"https://openvpn.sentyron.com/repos/deb/dists/trixie/Release.gpg"
+	"https://openvpn.sentyron.com/repos/deb/dists/trixie/main/binary-amd64/Packages"
+	"https://openvpn.sentyron.com/repos/deb/pool/main/o/${pkgname}/${pkgname}_${pkgver::-3}-nl3-trixie_amd64.deb"
 )
 sha512sums=(
-	'0ed457e0a71f9bf96f639345e0c48b59be1ac633fa68862dc6ae8ca732144267efbeba84c7a9d403b05d51136658fb19ff4881790e570e3c6820513032625ab4'
-	'83deac5fc56fd68fcc907325bbc0ed30bbc532041f7f547220bfb07e27d921d3bbb11ecff3ff9256ba6d64cf194bd2f427d2ebe1ba7c05f1aa8f9dd2b70898ad'
-	'242c8af0fc2e13443b5e7bd3cc185184bcc916a03b162396c2fc27f423239968b02d04d67dd985f1e72c3f3b532a844ad100a1226432b329537da7088843a4ed'
-	'd321d20c2b80c8692f8a4cbe3e67706041738a5079f0fef0f191cdf574edc1ea835545c731ff8ee9e9d2e8dbcb88cb5e315afc3de40ecfa3c25b0f9c754ca764'
+	'400bd9c0bc4efd1ed6a0e481c4fcdb1e55ad43391026fa16ae3bd65a58ddf37ff191212ae8cd25f166b111fb30b66d7c3aff45f4a21438836751209b3ba7291a'
+	'5c03e2e0dd0921d9f40cff6d32c0767bd29c4858479c2556cc3aea6a49ab9eaee0cd83d3b768b7967a6045e5a12861432dcbe88ff314c7a84dc56af07ba1311a'
+	'5c74429aa4dbe0d8773acdc4fe960f5c166533dc6fa498223b4b4dbf1e02134f384cca060ee7937d9e23592e58489a2a8fe943cab5618842f3477576a6a87d49'
+	'89f330305793933a560888b1727be756ca06cc05f662deea23ced793df76a8255808692da8dc2935b0f9c22e7545882294626d687b50fb19fc6f7a0fb562370b'
 )
 validpgpkeys=('A518F75374D3AF82AE11810A13DF39ED913F5D8F')
 
@@ -27,19 +31,25 @@
 	_YEL='\033[1;33m'
 	_RED='\033[0;31m'
 	_NC='\033[0m'
+	_GREEN="\e[92m"
 	echo -e "${_YEL}Verifying Release file with GPG key...${_NC}"
-	gpg --verify Release.gpg Release || (echo -e "${_RED}There is something wrong with the signature! Either this package is compromised or you need to import the key from https://openvpn.fox-it.com/repos/fox-crypto-gpg.asc${_NC}" && exit 1)
+	(gpg --verify Release.gpg Release && echo -e "${_GREEN}OK${_NC}") \
+		|| (echo -e "${_RED}There is something wrong with the signature. Either this package is compromised or you need to import the key from https://openvpn.sentyron.com/repos/sentyron-gpg.asc${_NC}" && exit 1)
+
 	echo -e "${_YEL}Verifying Packages file with previously verified Release file...${_NC}"
-	(sed -n 17p Release | awk '{print $1 " Packages"}' | sha256sum --check --status --strict && echo "OK") || (echo -e "${_RED}There is something wrong with the SHA256 hash! This package is likely compromised and should not be used!${_NC}" && exit 1)
-	echo -e "${_YEL}Verifying ${pkgname}_${pkgver::-3}-nl1-noble_amd64.deb package with previously verified Packages file...${_NC}"
-	(sed -n 12p Packages | awk -v name=${pkgname}_${pkgver::-3}-nl1-noble_amd64.deb '{print $2 " " name}' | sha256sum --check --status --strict && echo "OK") || (echo -e "${_RED}There is something wrong with the SHA256 hash! This package is likely compromised and should not be used!${_NC}" && exit 1)
+	(sed -n 17p Release | awk '{print $1 " Packages"}' | sha256sum --check --status --strict && echo -e "${_GREEN}OK${_NC}") \
+		|| (echo -e "${_RED}There is something wrong with the SHA256 hash! This package is likely compromised and should not be used!${_NC}" && exit 1)
+
+	echo -e "${_YEL}Verifying ${pkgname}_${pkgver::-3}-nl3-trixie_amd64.deb package with previously verified Packages file...${_NC}"
+	(sed -n 12p Packages | awk -v name=${pkgname}_${pkgver::-3}-nl3-trixie_amd64.deb '{print $2 " " name}' | sha256sum --check --status --strict && echo -e "${_GREEN}OK${_NC}") \
+		|| (echo -e "${_RED}There is something wrong with the SHA256 hash! This package is likely compromised and should not be used!${_NC}" && exit 1)
 }
 
 package() {
 	cd "${srcdir}"
-	tar -xf data.tar.zst -C "${srcdir}"
-	install -vDm755 ${srcdir}/usr/sbin/openvpn-nl ${pkgdir}/usr/bin/openvpn-nl
-	cp -r ${srcdir}/etc ${pkgdir}/etc
-	cp -r ${srcdir}/usr/share ${pkgdir}/usr/share
+	tar -xf data.tar.xz -C "${srcdir}"
+	install -vDm755 "${srcdir}/usr/sbin/openvpn-nl" "${pkgdir}/usr/bin/openvpn-nl"
+	cp -r "${srcdir}/etc" "${pkgdir}/etc"
+	cp -r "${srcdir}/usr/share" "${pkgdir}/usr/share"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 21:33:42	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2