openvsp-bin

maintainer rpx · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs prebuilt Debian binaries from openvsp.org (the official OpenVSP project website) directly onto an Arch system. While openvsp.org is the legitimate upstream vendor site, the package is still distributing pre-compiled binaries rather than building from source, which is a supply-chain concern if the host is compromised. Additionally, it pulls a specific older version of libxml2 from the Arch Linux archive (archive.archlinux.org) and installs it as a system library at /usr/lib/libxml2.so.2, which could conflict with or shadow the system's libxml2. Both sources have sha256sums. The main concerns are: (1) executed prebuilt binaries from a non-Arch source, and (2) installing a pinned older libxml2 into /usr/lib which could affect other packages. However, openvsp.org is the genuine upstream project site, and archive.archlinux.org is an official Arch mirror. This is a legitimate but non-standard packaging approach that carries real supply-chain risk (prebuilt binaries, older library shadowing) without being clearly malicious — consistent with MEDIUM severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 source=("${pkgname}-${pkgver}.deb"::"https://openvsp.org/download.php?file=zips/current/linux/OpenVSP-${pkgver}-Ubuntu-24.04_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt Debian binaries from openvsp.org (the official OpenVSP project website) directly onto an Arch system. While openvsp.org is the legitimate upstream vendor site, the package is still distributing pre-compiled binaries rather than building from source, which is a supply-chain concern if the host is compromised. Additionally, it pulls a specific older version of libxml2 from the Arch Linux archive (archive.archlinux.org) and installs it as a system library at /usr/lib/libxml2.so.2, which could conflict with or shadow the system's libxml2. Both sources have sha256sums. The main concerns are: (1) executed prebuilt binaries from a non-Arch source, and (2) installing a pinned older libxml2 into /usr/lib which could affect other packages. However, openvsp.org is the genuine upstream project site, and archive.archlinux.org is an official Arch mirror. This is a legitimate but non-standard packaging approach that carries real supply-chain risk (prebuilt binaries, older library shadowing) without being clearly malicious — consistent with MEDIUM severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: rpx <rpx at clearlight dot systems>
    
      2#
    
      3# Debian-compiled binaries.
    
      4# requires libxml2.so.2 from Arch archive.
    
      5# Thanks to Enzi, Unity Engine Forum:
    
      6# https://discussions.unity.com/t/arch-libxml2-so-2-is-missing/1637394
    
      7
    
      8
    
      9pkgname=openvsp-bin
    
      10pkgdesc='A parametric aircraft geometry tool'
    
      11pkgver=3.45.3
    
      12pkgrel=1
    
      13arch=('i686' 'x86_64')
    
      14url='https://openvsp.org'
    
      15license=('NASA OPEN SOURCE AGREEMENT VERSION 1.3')
    
      16depends=(
    
      17  'cblas'
    
      18  'cminpack'
    
      19  'freeglut'
    
      20  'gcc'
    
      21  'git'
    
      22  'glew'
    
      23  'libxml2'
    
      24  'pandoc'
    
      25  'python'
    
      26  'swig')
    
      27optdepends=(
    
      28  'doxygen: generate documentation'
    
      29  'graphviz: generate documentation')
    
      30makedepends=('cmake' 'unzip')
    
      31conflicts=('openvsp')
    
      32
    
      33_name=OpenVSP-OpenVSP_${pkgver}
    
      34
    
      35
    
      36# requires libxml2.so.2 from Arch archive.
    
      37libxml2_pkgver=2.13.8
    
      38libxml2_pkgrel=1
    
      39
    
      40source=("${pkgname}-${pkgver}.deb"::"https://openvsp.org/download.php?file=zips/current/linux/OpenVSP-${pkgver}-Ubuntu-24.04_amd64.deb"
    
      41  "https://archive.archlinux.org/packages/l/libxml2/libxml2-${libxml2_pkgver}-1-x86_64.pkg.tar.zst")
    
      42sha256sums=('bddf907e18881b28a949e0d67b8043adbdd1ba98f5698473097ea8c1cbd8bf67'
    
      43  '2a1b0ab11ff213a57268d20fff183e3fd3e4ab9191aeed473de336b77bdfa6e1')
    
      44
    
      45prepare() {
    
      46  mkdir -p "${srcdir}/build"
    
      47  mkdir -p "${srcdir}/lib"
    
      48}
    
      49
    
      50build() {
    
      51  # Debian package is just an ar archive containing two tars.
    
      52  ar x ${pkgname}-${pkgver}.deb
    
      53  # Delete the remainder
    
      54  rm debian-binary control.tar.gz ${pkgname}-${pkgver}.deb
    
      55  # Put the package into form standard for compilation from source
    
      56  mv data.tar.gz "${srcdir}/build/OpenVSP-${pkgver}-Linux.tar.gz"
    
      57
    
      58  bsdtar -xf "${srcdir}/libxml2-${libxml2_pkgver}-1-x86_64.pkg.tar.zst" -C "${srcdir}" $"usr/lib/libxml2.so.${libxml2_pkgver}"
    
      59}
    
      60
    
      61package() {
    
      62  cd ${srcdir}/build
    
      63  tar xvf "OpenVSP-${pkgver}-Linux.tar.gz"
    
      64  mv ./opt/OpenVSP "./OpenVSP-${pkgver}-Linux" && rmdir opt
    
      65  cd "./OpenVSP-${pkgver}-Linux" 
    
      66
    
      67  mkdir -p ${pkgdir}/usr/share/${pkgname}
    
      68
    
      69  # binaries
    
      70#  cp vsp vspaero vspscript vsploads vspaero_adjoint vspaero_complex vspaero_opt vspviewer \
    
      71#    ${pkgdir}/usr/share/${pkgname}
    
      72  cp vsp vspaero vspscript vsploads vspaero_opt vspviewer \
    
      73    ${pkgdir}/usr/share/${pkgname}
    
      74  
    
      75  # misc
    
      76  cp README.md ${pkgdir}/usr/share/${pkgname}
    
      77  cp LICENSE ${pkgdir}/usr/share/${pkgname}
    
      78  cp vspIcon.png ${pkgdir}/usr/share/${pkgname}
    
      79  cp -r airfoil ${pkgdir}/usr/share/${pkgname}
    
      80  cp -r CustomScripts ${pkgdir}/usr/share/${pkgname}
    
      81  cp -r help ${pkgdir}/usr/share/${pkgname}
    
      82  cp -r matlab ${pkgdir}/usr/share/${pkgname}
    
      83  test -d python && cp -r python ${pkgdir}/usr/share/${pkgname}
    
      84  cp -r scripts ${pkgdir}/usr/share/${pkgname}
    
      85  cp -r textures ${pkgdir}/usr/share/${pkgname}
    
      86  cp -r vspaero_ex ${pkgdir}/usr/share/${pkgname}
    
      87
    
      88  # binary symlinks, relative
    
      89  mkdir -p ${pkgdir}/usr/bin
    
      90  cd ${pkgdir}/usr/share/${pkgname}
    
      91#  ln -sr vsp vspaero vspscript vsploads vspaero_adjoint vspaero_complex vspaero_opt vspviewer \
    
      92#    ${pkgdir}/usr/bin/
    
      93  ln -sr vsp vspaero vspscript vsploads vspaero_opt vspviewer \
    
      94    ${pkgdir}/usr/bin/
    
      95
    
      96
    
      97  # libraries missing in Arch
    
      98  mkdir -p ${pkgdir}/usr/lib
    
      99  # libxml2.so.2
    
      100  install -m 755 "${srcdir}/usr/lib/libxml2.so.${libxml2_pkgver}" "$pkgdir/usr/lib/libxml2.so.${libxml2_pkgver}"
    
      101  ln -sf $"libxml2.so.${libxml2_pkgver}" "$pkgdir/usr/lib/libxml2.so.2"
    
      102}
    
      103

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2