virtualbox-bin-guest-iso

MEDIUM
maintainer dbermond 62 votes base virtualbox-bin scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads a prebuilt Oracle-signed binary installer from a non-whitelisted host (download.virtualbox.org), which is unverifiable and could be swapped; combined with setting suid binaries, this constitutes a real supply-chain risk despite the source being plausibly official.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:32 source=("http://download.virtualbox.org/virtualbox/${pkgver}/VirtualBox-${pkgver}-${_build}-Linux_amd64.run"
Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

  • PKGBUILD:128 chmod 4755 "${pkgdir}/${_installdir}"/{VirtualBoxVM,VBox{Headless,Net{AdpCtl,DHCP,NAT},VolInfo}}
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt Oracle-signed binary installer from a non-whitelisted host (download.virtualbox.org), which is unverifiable and could be swapped; combined with setting suid binaries, this constitutes a real supply-chain risk despite the source being plausibly official.

PKGBUILD

2 offending line(s) highlighted
1# Maintainer : Daniel Bermond <dbermond@archlinux.org>
2# Contributor: Rainmaker <rainmaker52@gmail.com>
3# Contributor: gary9872 <garysBoXatgeemale.com>
4# Contributor: khomutsky <bogdan@khomutsky.com>
5# Contributor: M0Rf30
6
7pkgbase=virtualbox-bin
8pkgname=(
9 'virtualbox-bin'
10 'virtualbox-bin-guest-iso'
11 'virtualbox-bin-sdk')
12pkgver=7.2.14
13_build=174565
14_sdk_commit=72af1bf47ae4fa0cbca89251155953051c5acd67
15pkgrel=1
16pkgdesc='Powerful x86 virtualization for enterprise as well as home use (Oracle branded non-OSE)'
17arch=('x86_64')
18url='https://www.virtualbox.org/'
19license=('GPL-3.0-only')
20makedepends=(
21 'at-spi2-core' # to satisfy namcap
22 'cairo' # to satisfy namcap
23 'gdk-pixbuf2' # to satisfy namcap
24 #'gtk2' # to satisfy namcap
25 'gtk3' # to satisfy namcap
26 'pango' # to satisfy namcap
27 'python'
28 'python-build'
29 'python-installer'
30 'python-setuptools'
31 'python-wheel')
32source=("http://download.virtualbox.org/virtualbox/${pkgver}/VirtualBox-${pkgver}-${_build}-Linux_amd64.run"
33 "https://download.virtualbox.org/virtualbox/${pkgver}/VirtualBoxSDK-${pkgver}-${_build}.zip"
34 "VBoxAuth-g${_sdk_commit:0:7}.h"::"https://raw.githubusercontent.com/VirtualBox/virtualbox/${_sdk_commit}/include/VBox/VBoxAuth.h"
35 "VBoxAuthPAM-g${_sdk_commit:0:7}.c"::"https://raw.githubusercontent.com/VirtualBox/virtualbox/${_sdk_commit}/src/VBox/HostServices/auth/pam/VBoxAuthPAM.c"
36 "VBoxAuthSimple-g${_sdk_commit:0:7}.cpp"::"https://raw.githubusercontent.com/VirtualBox/virtualbox/${_sdk_commit}/src/VBox/HostServices/auth/simple/VBoxAuthSimple.cpp"
37 'dkms.conf'
38 'vboxreload'
39 '60-vboxdrv.rules'
40 'vboxweb.service'
41 'virtualbox.sysusers'
42 'LICENSE.sdk'
43 '013-Makefile.patch')
44noextract=("VirtualBoxSDK-${pkgver}-${_build}.zip")
45sha256sums=('9bb917f8b8264482946efc56ba098f24c87cb06c8430754b2c3c3720a56d1540'
46 '7f388e22957f126535df297a3a6f258b293a39b73548485ba3257141175a3189'
47 'f54c6a3e118e24ea36474b23e6376bf83ed945e76bb627257457c018f0e11018'
48 '0fe446cdc96d227e3f9a2d905d39ea2804c15560a42ff2dec207349f03ac9206'
49 'a2923c8828c540ae2e2b4da38c402892b8e16d19fb86af2ecb0ab080e3745c9e'
50 '63f1e9eabedec2170bd0589aaa2bf5025ff8f8ec1764cc4823cbe446e9ce1388'
51 '4001b5927348fe669a541e80526d4f9ea91b883805f102f7d571edbb482a9b9d'
52 '9c5238183019f9ebc7d92a8582cad232f471eab9d3278786225abc1a1c7bf66e'
53 'e6e875ef186578b53106d7f6af48e426cdaf1b4e86834f01696b8ef1c685787f'
54 '2101ebb58233bbfadf3aa74381f22f7e7e508559d2b46387114bc2d8e308554c'
55 '09335d7d1075df02d29cec13119538134efdf43ea73a93b0f89d0d7d4b6625a1'
56 'a3ec0cab869e2d64914bffbf1c11a3c571808438656af654932f96e7a69114fd')
57
58prepare() {
59 local _extractdir="${pkgbase}-${pkgver}/VirtualBox-extracted"
60
61 # extract files
62 mkdir -p "$_extractdir"
63 sh "VirtualBox-${pkgver}-${_build}-Linux_amd64.run" --noexec --nox11 --target "${pkgbase}-${pkgver}"
64 bsdtar -xf "${pkgbase}-${pkgver}/VirtualBox.tar.bz2" -C "$_extractdir"
65 bsdtar -xf "VirtualBoxSDK-${pkgver}-${_build}.zip" -C "${pkgbase}-${pkgver}"
66
67 # dkms configuration
68 install -D -m644 dkms.conf -t "${_extractdir}/src/vboxhost"
69 sed -i "s/^\(PACKAGE_VERSION\)=.*/\1=${pkgver}/" "${_extractdir}/src/vboxhost/dkms.conf"
70
71 # fix dkms build
72 patch -d "$_extractdir" -Np1 -i "${srcdir}/013-Makefile.patch"
73}
74
75build() {
76 cd "${pkgbase}-${pkgver}/sdk/installer/python/vboxapi"
77 VBOX_INSTALL_PATH='/opt/VirtualBox' python -m build --wheel --no-isolation
78}
79
80package_virtualbox-bin() {
81 depends=(
82 'bash'
83 'dbus'
84 'dkms'
85 'fontconfig'
86 'freetype2'
87 'glib2'
88 'glibc'
89 'hicolor-icon-theme'
90 'libgcc'
91 'libgl'
92 'libstdc++'
93 'libx11'
94 'libxcb'
95 'libxkbcommon'
96 'libxkbcommon-x11'
97 'libxt'
98 'wayland'
99 'xcb-util-cursor'
100 'xcb-util-image'
101 'xcb-util-keysyms'
102 'xcb-util-renderutil'
103 'xcb-util-wm'
104 'zlib')
105 optdepends=(
106 'at-spi2-core: for GTK2/GTK3 platformthemes plugins and GTK2 styles plugin'
107 'cairo: for GTK3 platformthemes plugin'
108 'gdk-pixbuf2: for GTK2/GTK3 platformthemes plugins and GTK2 styles plugin'
109 'gtk2: for GTK2 platformthemes and styles plugins'
110 'gtk3: for GTK3 platformthemes plugin'
111 'pango: for GTK2/GTK3 platformthemes plugins and GTK2 styles plugin'
112 'virtualbox-bin-guest-iso: for guest additions CD image'
113 'virtualbox-bin-sdk: for the software developer kit'
114 'virtualbox-ext-oracle: for Oracle extensions pack')
115 provides=("virtualbox=${pkgver}" 'virtualbox-host-dkms' 'VIRTUALBOX-HOST-MODULES')
116 conflicts=('virtualbox' 'virtualbox-host-dkms' 'virtualbox-host-modules-arch')
117 replaces=('virtualbox_bin' 'virtualbox-sun')
118 backup=('etc/vbox/vbox.cfg')
119 options=('!debug' '!emptydirs' '!strip')
120
121 local _installdir='opt/VirtualBox'
122
123 # install bundled files
124 install -d -m755 "${pkgdir}/opt"
125 cp -Pr --no-preserve='ownership' "${pkgbase}-${pkgver}/VirtualBox-extracted" "${pkgdir}/${_installdir}"
126
127 # mark binaries suid root, and make sure the directory is only writable by the user
128 chmod 4755 "${pkgdir}/${_installdir}"/{VirtualBoxVM,VBox{Headless,Net{AdpCtl,DHCP,NAT},VolInfo}}
129 chmod go-w "${pkgdir}/${_installdir}"
130
131 # remove guest iso and bundled sdk files
132 rm -r "${pkgdir}/${_installdir}"/{additions/VBoxGuestAdditions.iso,sdk}
133
134 # module sources_pypath
135 install -d -m755 "${pkgdir}/usr/src"
136 mv "${pkgdir}/${_installdir}/src/vboxhost" "${pkgdir}/usr/src/vboxhost-${pkgver}_non_OSE"
137
138 # module reloading shortcut (with a symlink with default helper)
139 install -D -m755 vboxreload -t "${pkgdir}/usr/bin"
140 ln -s vboxreload "${pkgdir}/usr/bin/rcvboxdrv"
141
142 # udev rules
143 ## we need to copy and not symlink VBoxCreateUSBNode.sh in /usr/lib/udev to avoid udevd
144 ## to look /opt when /opt is not mounted. This can be done until VBoxCreateUSBNode.sh doesn't
145 ## need more stuff from /opt
146 install -D -m644 60-vboxdrv.rules -t "${pkgdir}/usr/lib/udev/rules.d"
147 install -D -m755 "${pkgdir}/${_installdir}/VBoxCreateUSBNode.sh" -t "${pkgdir}/usr/lib/udev"
148 install -D -m755 "${pkgdir}/${_installdir}/VBoxCreateUSBNode.sh" -t "${pkgdir}/usr/share/virtualbox"
149
150 # configuration file
151 install -D -m644 <(printf '%s\n' "INSTALL_DIR=/${_installdir}") "${pkgdir}/etc/vbox/vbox.cfg"
152
153 # modules-load.d configuration
154 install -D -m644 <(printf 'vboxdrv\nvboxnetadp\nvboxnetflt\n') "${pkgdir}/usr/lib/modules-load.d/${pkgname}.conf"
155
156 # systemd
157 install -D -m644 vboxweb.service -t "${pkgdir}/usr/lib/systemd/system"
158 install -D -m644 virtualbox.sysusers "${pkgdir}/usr/lib/sysusers.d/virtualbox.conf"
159
160 # symlinks
161 local _dir
162 local _file
163 install -d -m755 "${pkgdir}/usr/share"/{applications,{doc,licenses}/"$pkgname",mime/packages,pixmaps}
164 for _file in vboxwebsrv VirtualBox{,VM} VBox{Manage,SDL,VRDP,Headless,Autostart,BalloonCtrl,BugReport,DTrace}
165 do
166 ln -s "../../${_installdir}/VBox.sh" "${pkgdir}/usr/bin/${_file}"
167 [ "$_file" != 'vboxwebsrv' ] && ln -s "../../${_installdir}/VBox.sh" "${pkgdir}/usr/bin/${_file,,}"
168 done
169 ln -s "../../../${_installdir}/VBoxSysInfo.sh" "${pkgdir}/usr/share/virtualbox/VBoxSysInfo.sh"
170 ln -s "../../../usr/src/vboxhost-${pkgver}_non_OSE" "${pkgdir}/${_installdir}/src/vboxhost"
171 ln -s "../../../${_installdir}/VBox.png" "${pkgdir}/usr/share/pixmaps/VBox.png"
172 ln -s "../../../${_installdir}/virtualbox.desktop" "${pkgdir}/usr/share/applications/virtualbox.desktop"
173 ln -s "../../../../${_installdir}/virtualbox.xml" "${pkgdir}/usr/share/mime/packages/virtualbox.xml"
174 ln -s "../../../../${_installdir}/UserManual.pdf" "${pkgdir}/usr/share/doc/${pkgname}/UserManual.pdf"
175 ln -s "../../../../${_installdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
176 ## hicolor icons
177 while read -r -d '' _file
178 do
179 if grep -Eq '/virtualbox\.(png|svg)$' <<< "$_file"
180 then
181 _dir="${_file%/*}/apps"
182 else
183 _dir="${_file%/*}/mimetypes"
184 fi
185 install -d -m755 "${pkgdir}/usr/share/icons/hicolor/${_dir}"
186 ln -s "../../../../../../${_installdir}/icons/${_dir%/*}/${_file##*/}" \
187 "${pkgdir}/usr/share/icons/hicolor/${_dir}/${_file##*/}"
188 done < <(find "${pkgdir}/${_installdir}/icons" -type f -print0 | sed -z "s|${pkgdir}/${_installdir}/icons/||")
189 ## workaround for unsupported $ORIGIN/.. in VBoxC.so
190 for _file in VBox{RT,XPCOM}.so
191 do
192 ln -s "../${_file}" "${pkgdir}/${_installdir}/components/${_file}"
193 done
194
195 # https://www.virtualbox.org/ticket/22193
196 # https://bbs.archlinux.org/viewtopic.php?pid=2199183#p2199183
197 ln -s ../../usr/lib/libdl.so.2 "${pkgdir}/${_installdir}/libdl.so"
198 ln -s ../../usr/lib/libpthread.so.0 "${pkgdir}/${_installdir}/libpthread.so"
199 ln -sr /usr/lib/libdl.so.2 "${srcdir}/${pkgbase}-${pkgver}/VirtualBox-extracted/libdl.so"
200 ln -sr /usr/lib/libpthread.so.0 "${srcdir}/${pkgbase}-${pkgver}/VirtualBox-extracted/libpthread.so"
201}
202
203package_virtualbox-bin-guest-iso() {
204 pkgdesc='VirtualBox guest additions ISO image for use with virtualbox-bin package'
205 arch=('any')
206 provides=('virtualbox-guest-iso')
207
208 install -D -m644 "${pkgbase}-${pkgver}/VirtualBox-extracted/additions/VBoxGuestAdditions.iso" \
209 -t "${pkgdir}/opt/VirtualBox/additions"
210}
211
212package_virtualbox-bin-sdk() {
213 pkgdesc='VirtualBox software developer kit for use with virtualbox-bin package'
214 arch=('any')
215 license=('LGPL-2.1-only' 'GPL-3.0-only' 'LicenseRef-Custom')
216 depends=('python')
217 optdepends=('java-runtime: for webservice java bindings')
218 provides=('virtualbox-sdk')
219 conflicts=('virtualbox-sdk')
220
221 local _dir
222 local _installdir='opt/VirtualBox'
223
224 install -d -m755 "${pkgdir}/${_installdir}/sdk"
225 while read -r -d '' _dir
226 do
227 cp -Pr --no-preserve='ownership' "$_dir" "${pkgdir}/${_installdir}/sdk"
228 done < <(find "${pkgbase}-${pkgver}/sdk" -mindepth 1 -maxdepth 1 -type d ! -name 'installer' -print0)
229
230 install -D -m644 "VBoxAuth-g${_sdk_commit:0:7}.h" "${pkgdir}/${_installdir}/sdk/bindings/auth/include/VBoxAuth.h"
231 install -D -m644 "VBoxAuthPAM-g${_sdk_commit:0:7}.c" "${pkgdir}/${_installdir}/sdk/bindings/auth/VBoxAuthPAM.cpp"
232 install -D -m644 "VBoxAuthSimple-g${_sdk_commit:0:7}.cpp" "${pkgdir}/${_installdir}/sdk/bindings/auth/VBoxAuthSimple.cpp"
233 install -D -m644 LICENSE.sdk "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
234
235 python -m installer --destdir="$pkgdir" "${pkgbase}-${pkgver}/sdk/installer/python/vboxapi/dist"/*.whl
236
237 local _sitepkgs
238 _sitepkgs="$(python -c 'import site; print(site.getsitepackages()[0])')"
239 ln -s "../../../../${_installdir}/sdk/bindings/xpcom/python/xpcom" "${pkgdir}${_sitepkgs}/xpcom"
240}
241

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Medium 3
2026-09-16 00:03:17 Medium 3
2026-09-15 00:25:31 Medium 3
2026-09-14 00:27:57 Medium 3
2026-09-13 00:19:54 Medium 3
2026-09-12 00:25:17 Medium 3
2026-09-11 00:19:22 Medium 3
2026-09-10 00:22:44 Medium 3
2026-09-09 00:04:09 Medium 3
2026-09-08 00:18:08 Medium 3
2026-09-07 00:30:15 Medium 3
2026-09-06 00:17:06 Medium 3
2026-09-05 00:16:27 Medium 3
2026-09-04 00:03:13 Medium 3
2026-09-03 00:15:47 Medium 3
2026-09-02 00:02:31 Medium 3
2026-09-01 00:11:19 Medium 3
2026-08-31 00:19:57 Medium 3
2026-08-30 00:04:14 Medium 3
2026-08-29 01:37:41 Medium 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion