unifi-endpoint

LOW

maintainer jturbide 1 votes scanned 2026-08-19 03:50:56.065595

View on AUR

Why flagged

The .deb is downloaded from fw-download.ubnt.com, which is Ubiquiti's official firmware download infrastructure, with a hardcoded SHA256 checksum; this is a legitimate repackaging of a vendor binary from its own official distribution host, not an unverifiable third-party source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The .deb is downloaded from fw-download.ubnt.com, which is Ubiquiti's official firmware download infrastructure, with a hardcoded SHA256 checksum; this is a legitimate repackaging of a vendor binary from its own official distribution host, not an unverifiable third-party source.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:54 "${_deb}::https://fw-download.ubnt.com/data/unifi-endpoint-desktop-app-deb/bed2-linux-1.0.4-20-ff164d14-a211-419d-9a04-43192d56a952.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Julien Turbide <moi at jturbide dot com>
    
      2# SPDX-License-Identifier: 0BSD
    
      3
    
      4pkgname=unifi-endpoint
    
      5pkgver=1.0.4
    
      6pkgrel=1
    
      7_upstream_pkgrel=20
    
      8pkgdesc='Secure access client for UniFi-managed VPN, WiFi, and file resources'
    
      9arch=('x86_64')
    
      10url='https://community.ui.com/releases/UniFi-Endpoint-Linux-1-0-4/ea29f793-838d-4f03-9915-efb55ad594a6'
    
      11license=('LicenseRef-Ubiquiti-EULA')
    
      12depends=(
    
      13  'ca-certificates-utils'
    
      14  'desktop-file-utils'
    
      15  'fontconfig'
    
      16  'gcc-libs'
    
      17  'glibc'
    
      18  'gtk3'
    
      19  'hicolor-icon-theme'
    
      20  'icu'
    
      21  'iproute2'
    
      22  'krb5'
    
      23  'libglvnd'
    
      24  'libnotify'
    
      25  'libsecret'
    
      26  'networkmanager'
    
      27  'openssl'
    
      28  'polkit'
    
      29  'procps-ng'
    
      30  'resolvconf'
    
      31  'systemd'
    
      32  'wireguard-tools'
    
      33  'wpa_supplicant'
    
      34  'xdg-utils'
    
      35)
    
      36optdepends=(
    
      37  'gnome-keyring: Secret Service credential storage'
    
      38  'gvfs: file-access integration'
    
      39  'gvfs-nfs: NFS file access'
    
      40  'gvfs-smb: SMB file access'
    
      41  'kwallet: KDE credential storage'
    
      42  'systemd-resolvconf: preferred resolvconf provider with systemd-resolved'
    
      43  'vulkan-icd-loader: optional Vulkan rendering backend'
    
      44)
    
      45backup=(
    
      46  'etc/NetworkManager/conf.d/90-unifi-endpoint-unmanaged-vpn.conf'
    
      47  'etc/apparmor.d/local/wg-quick'
    
      48  'etc/polkit-1/rules.d/50-unifi-endpoint.rules'
    
      49)
    
      50options=('!strip' '!debug')
    
      51install='unifi-endpoint.install'
    
      52_deb="${pkgname}_${pkgver}-${_upstream_pkgrel}_amd64.deb"
    
      53source=(
    
      54  "${_deb}::https://fw-download.ubnt.com/data/unifi-endpoint-desktop-app-deb/bed2-linux-1.0.4-20-ff164d14-a211-419d-9a04-43192d56a952.deb"
    
      55  'README.Arch'
    
      56  'Ubiquiti-EULA.url'
    
      57  'unifi-endpoint-launcher'
    
      58)
    
      59noextract=("${_deb}")
    
      60sha256sums=(
    
      61  'e54342cc9c514e59469657e060149d46f7371b7fdb2d9fff1eb34434804311fa'
    
      62  'a616f007f158a38d24dc2601dd391c24bb4f416aa672c0806036cd8287b85659'
    
      63  '45fd9a9a193060c27ecc332dcdf87361b21f5e41861f053e9d65079be5d972cd'
    
      64  '7fdca3f607f4717ea9f59ce04e3cfd639b36de14a739d96f99532386a075c6bb'
    
      65)
    
      66
    
      67prepare() {
    
      68  bsdtar -xf "${_deb}" data.tar.zst
    
      69}
    
      70
    
      71check() {
    
      72  local required_path
    
      73  local required_paths=(
    
      74    './usr/lib/UniFi-Endpoint/UIDSTD.Avalonia'
    
      75    './usr/lib/UniFi-Endpoint/UniFi-Endpoint-Daemon'
    
      76    './usr/lib/UniFi-Endpoint/UniFi-Endpoint-PrivilegedHelper'
    
      77    './usr/lib/UniFi-Endpoint/utunnel'
    
      78    './usr/lib/systemd/user/UniFi-Endpoint-Daemon.service'
    
      79    './usr/lib/systemd/user/UniFi-Endpoint-Daemon.socket'
    
      80    './usr/share/polkit-1/actions/com.ui.unifi-endpoint.policy'
    
      81  )
    
      82
    
      83  for required_path in "${required_paths[@]}"; do
    
      84    bsdtar -tf data.tar.zst | grep -Fqx "${required_path}"
    
      85  done
    
      86}
    
      87
    
      88package() {
    
      89  bsdtar --no-same-owner -xf data.tar.zst -C "${pkgdir}"
    
      90
    
      91  # The vendor desktop entry starts the GUI directly. The Arch launcher starts
    
      92  # the socket on demand, preserving Arch's policy of not enabling services
    
      93  # automatically during package installation.
    
      94  install -Dm755 unifi-endpoint-launcher "${pkgdir}/usr/bin/unifi-endpoint"
    
      95  local desktop_file
    
      96  for desktop_file in \
    
      97      "${pkgdir}/usr/share/applications/unifi-endpoint.desktop" \
    
      98      "${pkgdir}/usr/lib/UniFi-Endpoint/Resources/unifi-endpoint.desktop"; do
    
      99    sed -i \
    
      100      -e 's|^Exec=.*|Exec=/usr/bin/unifi-endpoint %u|' \
    
      101      -e 's|^Categories=.*|Categories=Network;|' \
    
      102      "${desktop_file}"
    
      103  done
    
      104
    
      105  install -Dm644 README.Arch \
    
      106    "${pkgdir}/usr/share/doc/${pkgname}/README.Arch"
    
      107  mv "${pkgdir}/usr/share/doc/${pkgname}/README.Debian" \
    
      108    "${pkgdir}/usr/share/doc/${pkgname}/README.upstream-debian"
    
      109  install -Dm644 Ubiquiti-EULA.url \
    
      110    "${pkgdir}/usr/share/licenses/${pkgname}/Ubiquiti-EULA.url"
    
      111
    
      112  # UniFi Endpoint currently recognizes Debian, Fedora/RHEL, and openSUSE CA
    
      113  # anchor layouts. Bridge its Fedora path to Arch's p11-kit trust-source path.
    
      114  install -d "${pkgdir}/etc/pki/ca-trust/source"
    
      115  ln -s ../../../ca-certificates/trust-source/anchors \
    
      116    "${pkgdir}/etc/pki/ca-trust/source/anchors"
    
      117}
    
      118

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-19 03:50:56	Low	3
2026-08-19 03:41:13	Medium	2