todesk-enterprise-client-bin

LOW

maintainer armory 0 votes scanned 2026-10-23 03:38:07.483364

View on AUR

Why flagged

Downloads a prebuilt proprietary .deb from dl.todesk.com, which is the vendor's own official download domain; the DLAGENTS override is a documented workaround for CDN fingerprinting, not obfuscation or exfiltration; checksum is provided; the main concern is a closed-source binary from a Chinese vendor running as root, but that is a trust/policy issue rather than a packaging attack.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a prebuilt proprietary .deb from dl.todesk.com, which is the vendor's own official download domain; the DLAGENTS override is a documented workaround for CDN fingerprinting, not obfuscation or exfiltration; checksum is provided; the main concern is a closed-source binary from a Chinese vendor running as root, but that is a trust/policy issue rather than a packaging attack.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("ToDesk_Client_${pkgver}_amd64.deb::https://dl.todesk.com/tob/linux/ToDesk_Client_${pkgver}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bootloader <bootloader@localhost>
    
      2# Upstream download page: https://enterprise.todesk.com/download
    
      3# 上游只发 rpm/deb，本包解 deb 转打包。被控端见 todesk-enterprise-host-bin。
    
      4
    
      5pkgname=todesk-enterprise-client-bin
    
      6pkgver=3.2.0.0
    
      7pkgrel=1
    
      8pkgdesc="ToDesk Enterprise Client (controller) - remote control, enterprise edition"
    
      9arch=('x86_64')
    
      10url="https://enterprise.todesk.com"
    
      11license=('LicenseRef-Proprietary')
    
      12depends=('gtk3' 'kmod' 'libpulse' 'nss' 'xcb-util' 'xcb-util-keysyms')
    
      13options=('!strip' 'emptydirs')
    
      14source=("ToDesk_Client_${pkgver}_amd64.deb::https://dl.todesk.com/tob/linux/ToDesk_Client_${pkgver}_amd64.deb")
    
      15sha256sums=('1339d29d911789221dd5676baf568fb5b7841973052f501101aadb374aa4a63f')
    
      16install="${pkgname}.install"
    
      17
    
      18# 注意：dl.todesk.com 有腾讯 EdgeOne 反爬（按 TLS/HTTP2 指纹拦 curl，UA 无关），
    
      19# 默认 DLAGENTS 会拿到几 KB 的 JS 挑战页（HTTP 200，sha256 校验才会失败）。
    
      20# 实测 --http1.1（降 HTTP/1.1 绕开指纹检测）+ 浏览器 UA 可稳定直取真实文件。
    
      21DLAGENTS=('https::/usr/bin/curl -gqfL --http1.1 -A "Mozilla/5.0" --retry 3 --retry-delay 3 -o %o %u')
    
      22
    
      23package() {
    
      24    cd "${srcdir}"
    
      25
    
      26    # data.tar.zst contains /opt/todesk_client, /etc and /usr entries.
    
      27    bsdtar --no-same-owner -xf data.tar.zst -C "${pkgdir}"
    
      28
    
      29    # Arch 惯例：/usr/local/bin 启动器移到 /usr/bin
    
      30    install -Dm755 "${pkgdir}/usr/local/bin/todesk_client" "${pkgdir}/usr/bin/todesk_client"
    
      31    rm -r "${pkgdir}/usr/local"
    
      32    install -dm755 "${pkgdir}/opt/todesk_client/config"
    
      33
    
      34    # systemd 单元照装，但不 enable（Arch 惯例交给用户：
    
      35    #   sudo systemctl enable --now todesk_client.service）
    
      36    # deb 的 postinst 会自动 enable，不照抄。
    
      37    # 单元以 root 运行 /opt/todesk_client/bin/ToDesk_Client_Service。
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 03:38:07	Low	3
2026-10-23 03:36:21	Medium	2