thinlinc-server

MEDIUM

maintainer aeneby 4 votes scanned 2026-09-22 00:15:14.502938

View on AUR

Why flagged

The package downloads a prebuilt binary archive from the vendor's official domain but lacks a verifiable upstream source for the RPMs; installing a setuid binary from unverifiable prebuilt packages constitutes a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("https://www.cendio.com/downloads/server/tl-${pkgver}-server.zip")

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:52 chmod u+s "$pkgdir"/opt/thinlinc/libexec/tl-mount-personal

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary archive from the vendor's official domain but lacks a verifiable upstream source for the RPMs; installing a setuid binary from unverifiable prebuilt packages constitutes a supply-chain risk.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: aeneby <aaron (at) sowry (dot) nz>
    
      2# Contributor: Phhere <p.rehs (at) gmx (dot) net>
    
      3# Contributor: Cebtenzzre <cebtenzzre (at) gmail (dot) com>
    
      4
    
      5pkgname=thinlinc-server
    
      6pkgver=4.20.1
    
      7pkgrel=1
    
      8pkgdesc="Cendio ThinLinc Linux remote desktop server"
    
      9arch=('x86_64')
    
      10url="https://cendio.com"
    
      11license=('custom')
    
      12install=${pkgname}.install
    
      13options=(!debug)
    
      14
    
      15depends=('gcc-libs' 'ghostscript' 'glibc' 'gtk3' 'iproute2' 'krb5' 'libx11'
    
      16         'libxcrypt-compat' 'msmtp-mta' 'nss' 'nspr' 'pam' 'procps-ng'
    
      17         'python-cairo' 'python-gobject' 'python-six' 'systemd' 'xorg-xauth'
    
      18         'xorg-xhost' 'zlib')
    
      19
    
      20optdepends=('cups: printer redirection'
    
      21            'nfs-utils: local drive redirection'
    
      22            'openssh: native client support'
    
      23            'python-ldap: LDAP integration')
    
      24
    
      25source=("https://www.cendio.com/downloads/server/tl-${pkgver}-server.zip")
    
      26
    
      27sha256sums=('4a7f217ccff9ff58606e3867e1fd0c951762752d2623bfedc3282d653803e9ac')
    
      28
    
      29prepare() {
    
      30    cd "${srcdir}/tl-${pkgver}-server/packages"
    
      31    mkdir -p extract
    
      32
    
      33    for rpm in *${CARCH}*rpm; do
    
      34        bsdtar -C extract -xf "${rpm}"
    
      35    done
    
      36}
    
      37
    
      38package() {
    
      39    cd "${srcdir}/tl-${pkgver}-server/packages/extract"
    
      40    cp -aR etc/ opt/ usr/ var/ "$pkgdir"
    
      41
    
      42    install -dm755 "$pkgdir"/usr/lib
    
      43    cp -af usr/lib64/libnss_passwdaliases.so.2 "$pkgdir"/usr/lib
    
      44
    
      45    cd "$srcdir/tl-${pkgver}-server"
    
      46    cp -aR libs/etc/* "$pkgdir"/etc
    
      47    cp -aR libs/libexec/* "$pkgdir"/opt/thinlinc/libexec
    
      48    cp -aR libs/modules/* "$pkgdir"/opt/thinlinc/modules
    
      49    cp -aR libs/share/* "$pkgdir"/opt/thinlinc/share
    
      50    rm -rf "$pkgdir/usr/lib64"
    
      51    ln -s "/opt/thinlinc/modules" "$pkgdir/usr/lib/$pkgname"
    
      52    chmod u+s "$pkgdir"/opt/thinlinc/libexec/tl-mount-personal
    
      53    
    
      54    install -Dm644 "$srcdir/tl-${pkgver}-server/EULA.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 00:15:14	Medium	3
2026-09-21 23:36:21	Medium	3
2026-06-19 19:07:35	Clean	2
2026-06-19 18:54:17	Clean	2
2026-06-18 16:11:54	Medium	1