virtualbox-ext-oracle

maintainer seblu · 1369 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a prebuilt Oracle Extension Pack from the official VirtualBox download domain, which is a legitimate and expected source for this package;虽非白名单主机 but the file is a signed extension pack, not executable code built from untrusted source, and the checksum is verified.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The source is a prebuilt Oracle Extension Pack from the official VirtualBox download domain, which is a legitimate and expected source for this package;虽非白名单主机 but the file is a signed extension pack, not executable code built from untrusted source, and the checksum is verified.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://download.virtualbox.org/virtualbox/${_filever}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sébastien Luttringer
    
      2# Maintainer: Christian Hesse <mail@eworm.de>
    
      3
    
      4pkgname=virtualbox-ext-oracle
    
      5pkgver=7.2.14
    
      6_filever="${pkgver}"
    
      7pkgrel=1
    
      8pkgdesc='Oracle VM VirtualBox Extension Pack'
    
      9arch=('x86_64')
    
      10url='https://www.virtualbox.org/'
    
      11license=('custom:PUEL')
    
      12depends=("virtualbox=${pkgver}")
    
      13optdepends=('rdesktop: client to connect vm via RDP')
    
      14options=('!strip')
    
      15source=("https://download.virtualbox.org/virtualbox/${_filever}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
    
      16noextract=("Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
    
      17sha256sums=('ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d')
    
      18
    
      19prepare() {
    
      20  mkdir Oracle_VirtualBox_Extension_Pack/
    
      21  tar --no-same-owner --one-top-level='Oracle_VirtualBox_Extension_Pack/' \
    
      22    -xzf "${srcdir}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack" \
    
      23    ./linux.amd64 ./ExtPack{-license.{html,rtf,txt},.manifest,.signature,.xml} ./PXE-Intel.rom
    
      24  sed -in "/\(ExtPack-\|linux\.amd64\)/p" Oracle_VirtualBox_Extension_Pack/ExtPack.manifest
    
      25}
    
      26
    
      27package() {
    
      28  install -d "${pkgdir}"/usr/lib/virtualbox/ExtensionPacks/
    
      29  mv Oracle_VirtualBox_Extension_Pack/ "${pkgdir}"/usr/lib/virtualbox/ExtensionPacks/
    
      30
    
      31  install -d "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      32  ln -s ../../../lib/virtualbox/ExtensionPacks/Oracle_VirtualBox_Extension_Pack/ExtPack-license.txt \
    
      33    "${pkgdir}/usr/share/licenses/${pkgname}/license.txt"
    
      34}
    
      35

Changes since previous scan

--- PKGBUILD @ 2026-07-21 13:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,9 +2,9 @@
 # Maintainer: Christian Hesse <mail@eworm.de>
 
 pkgname=virtualbox-ext-oracle
-pkgver=7.2.12
+pkgver=7.2.14
 _filever="${pkgver}"
-pkgrel=2
+pkgrel=1
 pkgdesc='Oracle VM VirtualBox Extension Pack'
 arch=('x86_64')
 url='https://www.virtualbox.org/'
@@ -14,7 +14,7 @@
 options=('!strip')
 source=("https://download.virtualbox.org/virtualbox/${_filever}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
 noextract=("Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
-sha256sums=('ac461d67462e06a9e16e8b96623c1b1a8c692c7f78e3566584b47e2d2e533f76')
+sha256sums=('ce4461de974f041435660751b382f987fece831028a8c98572d668eda2eee96d')
 
 prepare() {
   mkdir Oracle_VirtualBox_Extension_Pack/

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 15:17:04	LOW	2
2026-07-21 13:17:02	LOW	2
2026-07-01 06:40:17	CLEAN	2
2026-06-19 19:07:35	CLEAN	2
2026-06-18 18:04:49	CLEAN	2
2026-06-18 16:11:54	LOW	1