via
This PKGBUILD downloads a prebuilt RPM binary (a VPN client) from h30326.www3.hpe.com, which is an HPE/Aruba distribution host. HPE/Aruba is the legitimate vendor of the VIA VPN client, and the maintainer's email (@hpe.com) is consistent with this. The URL includes a merchantId parameter suggesting it's an authorized distribution channel. However, the source is a prebuilt binary RPM that gets directly installed — not compiled from source — and the host is not the canonical upstream download page (which is asp.arubanetworks.com per the url= field). The sha256sum is provided but cannot be independently cross-validated against an official manifest. The package also sets SUID on via-vpn-srv (chmod o+s), which is a privilege escalation vector if the binary is compromised. This is a legitimate vendor binary VPN client distributed via a CDN/mirror host rather than the official product page, which constitutes a real supply-chain concern: if the HPE CDN host were compromised or the URL were hijacked, a malicious binary would be installed with SUID privileges. This warrants MEDIUM severity — it's not clearly malicious but represents a genuine executed-binary-from-unofficial-host risk.
Triggered rules
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
source=("https://h30326.www3.hpe.com/hpn/via-${pkgver}-rpm.x86_64.rpm?merchantId=ASP_DROPBOX")
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:48
chmod o+s "${pkgdir}/usr/bin/via-vpn-srv"
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt RPM binary (a VPN client) from h30326.www3.hpe.com, which is an HPE/Aruba distribution host. HPE/Aruba is the legitimate vendor of the VIA VPN client, and the maintainer's email (@hpe.com) is consistent with this. The URL includes a merchantId parameter suggesting it's an authorized distribution channel. However, the source is a prebuilt binary RPM that gets directly installed — not compiled from source — and the host is not the canonical upstream download page (which is asp.arubanetworks.com per the url= field). The sha256sum is provided but cannot be independently cross-validated against an official manifest. The package also sets SUID on via-vpn-srv (chmod o+s), which is a privilege escalation vector if the binary is compromised. This is a legitimate vendor binary VPN client distributed via a CDN/mirror host rather than the official product page, which constitutes a real supply-chain concern: if the HPE CDN host were compromised or the URL were hijacked, a malicious binary would be installed with SUID privileges. This warrants MEDIUM severity — it's not clearly malicious but represents a genuine executed-binary-from-unofficial-host risk.
PKGBUILD
2 offending line(s) highlighted# Maintainer: Matthew Hiles <matthew.hiles@hpe.com>
pkgname=via
pkgver=4.6.0.2305302
pkgrel=1
epoch=
pkgdesc="Aruba Networks' Virtual Intranet Access (VIA)"
arch=('x86_64')
url="https://asp.arubanetworks.com/downloads;fileTypes=SOFTWARE;products=Aruba%20Virtual%20Intranet%20Access%20%28VIA%29;fileContents=Linux"
license=('unknown') # have not been able to find this
groups=()
# auto generated dpends might be excessive...
depends=(net-tools brotli bzip2 dbus double-conversion e2fsprogs freetype2 gcc-libs glib2 glibc graphite harfbuzz icu keyutils krb5 libcap libffi libgcrypt libglvnd libgpg-error libnm libpng libproxy libx11 libxau libxcb libxdmcp libxml2 lz4 md4c nspr nss openssl pcre pcre2 qt5-base systemd-libs tdb util-linux-libs xz zlib zstd)
makedepends=()
checkdepends=()
optdepends=(networkmanager)
provides=()
conflicts=()
replaces=()
backup=()
options=()
install=
changelog=
options=(!strip)
source=("https://h30326.www3.hpe.com/hpn/via-${pkgver}-rpm.x86_64.rpm?merchantId=ASP_DROPBOX")
noextract=()
sha256sums=('75f1a8c9ffd8ac3b62434a24188789a3135ae328ce482427df59a625e6784026')
validpgpkeys=()
prepare() {
cd "$srcdir"
## Make work with arch's root fs layout
cd usr
mv lib64/* lib
rmdir lib64
cd ..
## fix up some file conflicts with via (the QMK keyboard configurator)
find -name via.png -execdir mv {} anvia.png \;
mv usr/share/applications/via.desktop usr/share/applications/anvia.desktop
sed -i -e 's/Icon=via/Icon=anvia/' usr/share/applications/anvia.desktop
}
package() {
#cd "$pkgname-$pkgver"
cp -R "$srcdir/usr" "$srcdir/etc" "$pkgdir/"
cp -R "$srcdir/lib64/security" "$pkgdir/usr/lib/"
mkdir -p "$pkgdir/usr/lib/systemd/system/"
cp "${srcdir}/../via-vpn-srv.service" "$pkgdir/usr/lib/systemd/system/"
chmod o+s "${pkgdir}/usr/bin/via-vpn-srv"
## autostart by default is bad :|
rm "${pkgdir}/etc/xdg/autostart/via-auto.desktop"
rmdir "${pkgdir}/etc/xdg/autostart"
rmdir "${pkgdir}/etc/xdg"
#rpmextract.sh ../$pkgname-$pkgver*.rpm*
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 3 |
| 2026-09-16 00:03:17 | Medium | 3 |
| 2026-09-15 00:25:31 | Medium | 3 |
| 2026-09-14 00:27:57 | Medium | 3 |
| 2026-09-13 00:19:54 | Medium | 3 |
| 2026-09-12 00:25:17 | Medium | 3 |
| 2026-09-11 00:19:22 | Medium | 3 |
| 2026-09-10 00:22:44 | Medium | 3 |
| 2026-09-09 00:04:09 | Medium | 3 |
| 2026-09-08 00:18:08 | Medium | 3 |
| 2026-09-07 00:30:15 | Medium | 3 |
| 2026-09-06 00:17:06 | Medium | 3 |
| 2026-09-05 00:16:27 | Medium | 3 |
| 2026-09-04 00:03:13 | Medium | 3 |
| 2026-09-03 00:15:47 | Medium | 3 |
| 2026-09-02 00:02:31 | Medium | 3 |
| 2026-09-01 00:11:19 | Medium | 3 |
| 2026-08-31 00:19:57 | Medium | 3 |
| 2026-08-30 00:04:14 | Medium | 3 |
| 2026-08-29 00:29:17 | Medium | 3 |