remmina-plugin-ultraviewer-git

MEDIUM

maintainer HMTheBoy154 0 votes scanned 2026-10-27 05:48:58.893783

View on AUR

Why flagged

Downloads a prebuilt Windows installer (UltraViewer_setup_6.6.133_vi.exe) from dl2.ultraviewer.net with a SKIP'd checksum; while only a data file (8bit.dat) is extracted from it and its hash is verified post-extraction, the installer itself is an unverified executable from a non-project host that could be silently swapped, and both source checksums are skipped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "${_installer}::https://dl2.ultraviewer.net/UltraViewer_setup_6.6.133_vi.exe"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads a prebuilt Windows installer (UltraViewer_setup_6.6.133_vi.exe) from dl2.ultraviewer.net with a SKIP'd checksum; while only a data file (8bit.dat) is extracted from it and its hash is verified post-extraction, the installer itself is an unverified executable from a non-project host that could be silently swapped, and both source checksums are skipped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: hmtheboy154 <buingoc67@gmail.com>
    
      2
    
      3_pkgname=remmina-plugin-ultraviewer
    
      4pkgname="${_pkgname}-git"
    
      5pkgver=0.2.0.r15.g5a83a8b
    
      6pkgrel=1
    
      7pkgdesc="UltraViewer remote desktop protocol plugin for Remmina"
    
      8arch=('x86_64')
    
      9url="https://github.com/hmtheboy154/remmina-plugin-ultraviewer"
    
      10license=('GPL-2.0-or-later')
    
      11depends=(
    
      12    'remmina'
    
      13    'gtk3'
    
      14    'openssl'
    
      15    'zstd'
    
      16    'libjpeg-turbo'
    
      17    'libpulse'
    
      18)
    
      19makedepends=(
    
      20    'git'
    
      21    'cmake'
    
      22    'pkgconf'
    
      23    'innoextract'
    
      24)
    
      25provides=("${_pkgname}")
    
      26conflicts=("${_pkgname}")
    
      27
    
      28_installer="UltraViewer_setup_6.6.133_vi.exe"
    
      29source=(
    
      30    "${_pkgname}::git+https://github.com/hmtheboy154/remmina-plugin-ultraviewer.git#branch=main"
    
      31    "${_installer}::https://dl2.ultraviewer.net/UltraViewer_setup_6.6.133_vi.exe"
    
      32)
    
      33sha256sums=(
    
      34    'SKIP'
    
      35    'SKIP'
    
      36)
    
      37
    
      38pkgver() {
    
      39    cd "${srcdir}/${_pkgname}"
    
      40    if git describe --tags >/dev/null 2>&1; then
    
      41        git describe --long --tags --abbrev=7 | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      42    else
    
      43        printf "0.2.0.r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      44    fi
    
      45}
    
      46
    
      47prepare() {
    
      48    cd "${srcdir}/${_pkgname}"
    
      49
    
      50    # Extract official 8bit.dat dictionary from Inno Setup installer
    
      51    if [ ! -f "assets/8bit.dat" ]; then
    
      52        mkdir -p assets/inno_tmp
    
      53        if command -v innoextract >/dev/null 2>&1; then
    
      54            innoextract -e -s --output-dir assets/inno_tmp "${srcdir}/${_installer}" >/dev/null
    
      55            find assets/inno_tmp -name "8bit.dat" -exec mv -f {} assets/8bit.dat \; 2>/dev/null || true
    
      56            rm -rf assets/inno_tmp
    
      57        fi
    
      58
    
      59        # Verify cryptographic checksum
    
      60        local _expected="9aa45789d9ff9d329a623a685d57b67e33c777019de9ce1f273f21860e4bfe6b"
    
      61        local _actual
    
      62        if [ -f "assets/8bit.dat" ]; then
    
      63            _actual="$(sha256sum assets/8bit.dat | awk '{print $1}')"
    
      64            if [ "${_actual}" != "${_expected}" ]; then
    
      65                echo "[-] Error: 8bit.dat SHA-256 checksum mismatch!" >&2
    
      66                return 1
    
      67            fi
    
      68        else
    
      69            echo "[-] Error: Failed to extract assets/8bit.dat from ${_installer}." >&2
    
      70            echo "    Please verify that 'innoextract' is installed." >&2
    
      71            return 1
    
      72        fi
    
      73    fi
    
      74}
    
      75
    
      76build() {
    
      77    cd "${srcdir}/${_pkgname}"
    
      78    cmake -B build \
    
      79        -DCMAKE_BUILD_TYPE=Release \
    
      80        -DCMAKE_INSTALL_PREFIX=/usr \
    
      81        -DCMAKE_INSTALL_LIBDIR=lib
    
      82    cmake --build build
    
      83}
    
      84
    
      85check() {
    
      86    cd "${srcdir}/${_pkgname}"
    
      87    ctest --test-dir build --output-on-failure
    
      88}
    
      89
    
      90package() {
    
      91    cd "${srcdir}/${_pkgname}"
    
      92    DESTDIR="${pkgdir}" cmake --install build
    
      93}
    
      94

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 05:48:58	Medium	3
2026-10-27 05:46:44	Medium	3