todesk-enterprise-host-bin

LOW

maintainer armory 0 votes scanned 2026-10-23 03:38:07.483364

View on AUR

Why flagged

Downloads a prebuilt proprietary binary from dl.todesk.com, which is the vendor's own official CDN (ToDesk enterprise), with a pinned sha256 checksum; the custom DLAGENTS is a documented workaround for TLS fingerprinting, not obfuscation or exfiltration, and poses no additional risk beyond the inherent trust placed in the vendor's binary.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a prebuilt proprietary binary from dl.todesk.com, which is the vendor's own official CDN (ToDesk enterprise), with a pinned sha256 checksum; the custom DLAGENTS is a documented workaround for TLS fingerprinting, not obfuscation or exfiltration, and poses no additional risk beyond the inherent trust placed in the vendor's binary.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("ToDesk_Host_${pkgver}_amd64.deb::https://dl.todesk.com/tob/linux/ToDesk_Host_${pkgver}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bootloader <bootloader@localhost>
    
      2# Upstream download page: https://enterprise.todesk.com/download
    
      3# 上游只发 rpm/deb，本包解 deb 转打包。主控端见 todesk-enterprise-client-bin。
    
      4
    
      5pkgname=todesk-enterprise-host-bin
    
      6pkgver=3.2.0.0
    
      7pkgrel=1
    
      8pkgdesc="ToDesk Enterprise Host (controlled endpoint) - remote control, enterprise edition"
    
      9arch=('x86_64')
    
      10url="https://enterprise.todesk.com"
    
      11license=('LicenseRef-Proprietary')
    
      12depends=('gtk3' 'kmod' 'nss' 'xcb-util' 'xcb-util-keysyms')
    
      13options=('!strip' 'emptydirs')
    
      14source=("ToDesk_Host_${pkgver}_amd64.deb::https://dl.todesk.com/tob/linux/ToDesk_Host_${pkgver}_amd64.deb")
    
      15sha256sums=('658aaa3275cf737bde10576181c181f1a7a6c3091aa3706ca38632540832a455')
    
      16install="${pkgname}.install"
    
      17
    
      18# 注意：dl.todesk.com 有腾讯 EdgeOne 反爬（按 TLS/HTTP2 指纹拦 curl，UA 无关），
    
      19# 默认 DLAGENTS 会拿到几 KB 的 JS 挑战页（HTTP 200，sha256 校验才会失败）。
    
      20# 实测 --http1.1（降 HTTP/1.1 绕开指纹检测）+ 浏览器 UA 可稳定直取真实文件。
    
      21DLAGENTS=('https::/usr/bin/curl -gqfL --http1.1 -A "Mozilla/5.0" --retry 3 --retry-delay 3 -o %o %u')
    
      22
    
      23package() {
    
      24    cd "${srcdir}"
    
      25
    
      26    # data.tar.zst contains /opt/todesk_host, /etc and /usr entries.
    
      27    bsdtar --no-same-owner -xf data.tar.zst -C "${pkgdir}"
    
      28
    
      29    # Arch 惯例：/usr/local/bin 启动器移到 /usr/bin
    
      30    install -Dm755 "${pkgdir}/usr/local/bin/todesk_host" "${pkgdir}/usr/bin/todesk_host"
    
      31    rm -r "${pkgdir}/usr/local"
    
      32    install -dm755 "${pkgdir}/opt/todesk_host/config"
    
      33
    
      34    # systemd 单元照装，但不 enable（Arch 惯例交给用户：
    
      35    #   sudo systemctl enable --now todesk_host.service）
    
      36    # deb 的 postinst 会自动 enable，不照抄。
    
      37    # 单元以 root 运行 /opt/todesk_host/bin/ToDesk_Host_Service。
    
      38    # res/20-todesk.conf 是 X11 intel 驱动虚拟显示器配置（本包未装到 xorg.conf.d，
    
      39    # 需要虚拟屏时用户自行拷贝到 /etc/X11/xorg.conf.d/）。
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 03:38:07	Low	3
2026-10-23 03:36:21	Medium	2