perimeter81

maintainer ttrmw · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from static.perimeter81.com, which is the official vendor CDN for Perimeter81 (a legitimate commercial VPN/network security product). The domain is the vendor's own distribution host, not a random personal server. However, the package installs prebuilt closed-source binaries directly into the system (opt/ and usr/ from the .deb), including what is likely a privileged network agent with a systemd service. There is a sha256sum check, which provides integrity verification against the specific downloaded artifact, but no GPG signature verification. The concern is not that this is malicious, but that it installs an opaque prebuilt binary from a commercial vendor's CDN — if that CDN were compromised or the vendor pushed a malicious update, the sha256sum would change and the build would fail, providing some protection. This is a standard pattern for AUR packages wrapping proprietary vendor software (similar to zoom, slack, discord, etc.) and the risk profile is equivalent to those packages. The MEDIUM rating from the cheaper model is technically defensible but this is a well-known pattern for proprietary software packaging in the AUR. Maintaining MEDIUM due to the prebuilt binary execution concern, though confidence is moderate since this is a legitimate vendor distribution pattern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "https://static.perimeter81.com/agents/linux/Perimeter81_${pkgver}.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from static.perimeter81.com, which is the official vendor CDN for Perimeter81 (a legitimate commercial VPN/network security product). The domain is the vendor's own distribution host, not a random personal server. However, the package installs prebuilt closed-source binaries directly into the system (opt/ and usr/ from the .deb), including what is likely a privileged network agent with a systemd service. There is a sha256sum check, which provides integrity verification against the specific downloaded artifact, but no GPG signature verification. The concern is not that this is malicious, but that it installs an opaque prebuilt binary from a commercial vendor's CDN — if that CDN were compromised or the vendor pushed a malicious update, the sha256sum would change and the build would fail, providing some protection. This is a standard pattern for AUR packages wrapping proprietary vendor software (similar to zoom, slack, discord, etc.) and the risk profile is equivalent to those packages. The MEDIUM rating from the cheaper model is technically defensible but this is a well-known pattern for proprietary software packaging in the AUR. Maintaining MEDIUM due to the prebuilt binary execution concern, though confidence is moderate since this is a legitimate vendor distribution pattern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Stefan Gruenberger <stefan.gruenberger at gmail dot com>
    
      2# Contributor: Thomas Millward Wright <tmillwardwright@gmail.com>
    
      3pkgname=perimeter81
    
      4pkgver=10.1.0.53
    
      5pkgrel=1
    
      6pkgdesc='Perimeter81 agent application'
    
      7arch=('x86_64')
    
      8url='https://support.perimeter81.com/docs/downloading-the-agent'
    
      9license=('custom:LICENSE')
    
      10depends=('systemd' 'netcat')
    
      11options=(!strip)
    
      12source=(
    
      13  "https://static.perimeter81.com/agents/linux/Perimeter81_${pkgver}.deb"
    
      14  'perimeter81helper.service'
    
      15  'LICENSE'
    
      16)
    
      17sha256sums=('db2bf8ebe0f2ffb31bc8af42b8d1b8cdb79a8d530dee110f592f9dfa271c3210'
    
      18  '3a081715b806d54b09d65f17c0f38c0ce40d99b9157555f6c63245afcc702baf'
    
      19  'c505b227d3f2222305800c16805f29b8da3bf841bf71df36674a695528bd0731')
    
      20
    
      21prepare() {
    
      22  bsdtar -xf data.tar.xz
    
      23}
    
      24
    
      25pkgver() {
    
      26  bsdtar -Oxf control.tar.gz control | awk '/Version:/{gsub(/\-/, ".", $2); print $2}'
    
      27}
    
      28
    
      29package() {
    
      30  cp -r opt usr $pkgdir/
    
      31  install -Dm644 $srcdir/perimeter81helper.service $pkgdir/usr/lib/systemd/system/perimeter81helper.service
    
      32  install -Dm644 $srcdir/LICENSE $pkgdir/usr/share/licenses/$pkgname/LICENSE
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2