virtualbox-kvm

LOW

maintainer knoelli 18 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads the main source from Oracle's official virtualbox.org and a patch from the project's GitHub repository; the patch host is not whitelisted but is a standard forge, and the patch is applied transparently to build the software from official sources, which is normal AUR packaging behavior.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the main source from Oracle's official virtualbox.org and a patch from the project's GitHub repository; the patch host is not whitelisted but is a standard forge, and the patch is applied transparently to build the software from official sources, which is normal AUR packaging behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 source=("https://download.virtualbox.org/virtualbox/${_vboxver}/VirtualBox-${_vboxver}${_vboxsubver}.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: xyzzy
    
      2# Maintainer: knoelli
    
      3
    
      4# Adapted from the official virtualbox package by
    
      5# Contributor: Christian Hesse <eworm@archlinux.org>
    
      6# Contributor: Sébastien "Seblu" Luttringer
    
      7# Contributor: Ionut Biru <ibiru@archlinux.org>
    
      8
    
      9pkgname=virtualbox-kvm
    
      10pkgdesc='Powerful x86 virtualization for enterprise as well as home use (KVM backend)'
    
      11pkgver=20260930
    
      12_pkgver=dev-${pkgver}
    
      13_vboxver='7.2.20'
    
      14_pkgvboxver='7.2.20'	# Version of VBox the patch was made for
    
      15_vboxsubver=''
    
      16pkgrel=1
    
      17conflicts=('virtualbox' 'virtualbox-ose')
    
      18depends=('curl' 'gcc-libs' 'glibc' 'liblzf' 'libpng' 'libtpms' 'libvpx' 'libx11' 'libxcursor'
    
          'libxext' 'libxinerama' 'libxml2' 'libxmu' 'libxt' 'openssl' 'procps-ng' 'python'
    
          'qt6-base' 'qt6-scxml' 'qt6-tools' 'sdl' 'shared-mime-info' 'zlib')
    
      21optdepends=('vde2: Virtual Distributed Ethernet support'
    
          'virtualbox-guest-iso: Guest Additions CD image'
    
          'virtualbox-ext-vnc: VNC server support'
    
          'virtualbox-sdk: Developer kit')
    
      25backup=('etc/vbox/vbox.cfg')
    
      26replaces=('virtualbox-ose')
    
      27arch=('x86_64')
    
      28url='https://github.com/cyberus-technology/virtualbox-kvm'
    
      29license=('GPL-3.0-only AND (GPL-3.0-only OR CDDL-1.0)')
    
      30
    
      31makedepends=('alsa-lib' 'cdrkit' 'curl' 'device-mapper' 'git' 'glu' 'gsoap' 'glslang' 'iasl'
    
           'jdk8-openjdk' 'libidl2' 'liblzf' 'libpulse' 'libtpms' 'libvncserver' 'libvpx'
    
           'libxcomposite' 'libxcursor' 'libxinerama' 'libxml2' 'libxmu' 'libxrandr' 'libxslt'
    
           'libxtst' 'linux-headers' 'mesa' 'python' 'python-setuptools' 'qt6-base' 'qt6-scxml'
    
           'qt6-tools' 'sdl' 'sdl_ttf' 'vde2' 'xorgproto' 'xorg-server-devel' 'yasm')
    
      36
    
      37source=("https://download.virtualbox.org/virtualbox/${_vboxver}/VirtualBox-${_vboxver}${_vboxsubver}.tar.bz2"
    
      "${url}/releases/download/${_pkgver}/kvm-backend-${_pkgvboxver}-${_pkgver}.patch"
    
      'virtualbox-host-dkms.conf'
    
      'virtualbox.sysusers'
    
      'virtualbox-guest-utils.sysusers'
    
      '60-vboxdrv.rules'
    
      '60-vboxguest.rules'
    
      'LocalConfig.kmk'
    
      'vboxservice.service'
    
      'vboxservice-nox.service'
    
      'vboxdrmclient.path'
    
      'vboxdrmclient.service'
    
      'vboxweb.service'
    
      'vboxreload'
    
      '001-disable-update.patch'
    
      '004-drop-Wno-format.patch'
    
      '008-no-vboxvideo.patch'
    
      '009-properly-handle-i3wm.patch'
    
      '012-vbglR3GuestCtrlDetectPeekGetCancelSupport.patch'
    
      '013-support-building-from-dkms.patch'
    
      '020-python-3-12.patch'
    
      '024-soapC.patch')
    
      59sha256sums=('5c2138213b72f36c129b92c2c267f2a40e9c98513f4c86a584327f09f9be706d'
    
          'cf6c8ec1d23b378e67939dff6affaa1a99587552100c2c5a147289fe3bb8e85a'
    
          'f753501352054576c510aa81e83f4935079ea620e601057784b02b4d4d1eeb04'
    
          '2101ebb58233bbfadf3aa74381f22f7e7e508559d2b46387114bc2d8e308554c'
    
          'da4c49f6ca94e047e196cdbcba2c321199f4760056ea66e0fbc659353e128c9e'
    
          'f876e9f55243eded423fda4fc2ffe3b174dca90380a6315f7c9b3cd1c9d07206'
    
          '033c597e0f5285d2ddb0490868e5b6f945f45c7b1b1152a02a9e6fea438b2c95'
    
          '4e93d8944a72ff615ccd99d46ea5f426a472cdafd3943c6813fa5e8ade5da7b0'
    
          'c41a801fe344a4471a7b61a4764d1d857c403e4fb96e2ba6bc89c77a35f2be7a'
    
          '01dbb921bd57a852919cc78be5b73580a564f28ebab2fe8d6c9b8301265cbfce'
    
          '83d8f24bff25bb925083cf39b3195236c6136105e62417712cc3f25b92e14b47'
    
          '2beab8de525220fa418c9873f9e0d657ddbad4ff9e4a46d7053e6cd9bc4ce95e'
    
          'e6e875ef186578b53106d7f6af48e426cdaf1b4e86834f01696b8ef1c685787f'
    
          '4001b5927348fe669a541e80526d4f9ea91b883805f102f7d571edbb482a9b9d'
    
          '9ee947c9b5ec5b25f52d3e72340fc3a57ca6e65a604e15b669ac582a3fb0dc1b'
    
          'eea2671ca4be1d06d1c8e6903ba4bad90581da9fbeea218023409de298803d58'
    
          '053bfeee8863f3ffdf2f0e3f9f0d77dc61dd32764700a97a7635fd8611e20491'
    
          'd76b52d955215a72c296aa36d173897bcaa357528bf5a73347c52ccec8654ced'
    
          '81900e13d36630488accd8c0bfd2ceb69563fb2c4f0f171caba1cca59d438024'
    
          '00f68b86d32a1fada900c2da8dad2ab4215106cd58004f049bded99727cda2ff'
    
          'ddb2092a5a000aa6ef854796f39dcdf86e72c06d53b24bac3835350571182df6'
    
          'b70d86e7ca687f65e2bd71ec87d70daad32872acd9b141fb609dff7cce0cd291')
    
      81
    
      82prepare() {
    
  cd "VirtualBox-${_vboxver}"
    
      84
    
  # apply patches from the source array
    
  local filename
    
  for filename in "${source[@]}"; do
    
      if [[ "${filename}" =~ \.patch$ ]]; then
    
          echo "Applying patch ${filename##*/}"
    
          patch -p1 -N -i "${srcdir}/${filename##*/}"
    
      fi
    
  done
    
      93
    
  echo 'Applying local config'
    
  cp "${srcdir}/LocalConfig.kmk" .
    
      96
    
  echo 'Use our CFLAGS'
    
  echo "VBOX_GCC_OPT=$CXXFLAGS" >> LocalConfig.kmk
    
      99}
    
      100
    
      101build() {
    
  cd "VirtualBox-${_vboxver}"
    
      103
    
  echo 'Build virtualbox-kvm'
    
  ./configure \
    
      --with-kvm \
    
      --disable-docs \
    
      --disable-kmods \
    
      --disable-vmmraw \
    
      --disable-hardening \
    
      --enable-vde \
    
      --enable-vnc \
    
      --enable-webservice \
    
      --with-makeself=/usr/bin/echo
    
  # fake makeself binary to compile without nofatal
    
  # makeself is used by linux installer. we don't need it.
    
  source ./env.sh
    
  kmk
    
      119
    
  echo 'Build VNC extension pack'
    
  kmk -C src/VBox/ExtPacks/VNC packing
    
      122}
    
      123
    
      124package() {
    
  source "VirtualBox-${_vboxver}/env.sh"
    
  cd "VirtualBox-${_vboxver}/out/linux.${BUILD_PLATFORM_ARCH}/release/bin"
    
      127
    
  # libraries (and non-PATH executables)
    
  install -d -m0755 "${pkgdir}/usr/lib/virtualbox"
    
  install -m0755 *.so -t "${pkgdir}/usr/lib/virtualbox"
    
  install -m0644 *.r0 VBoxEFI*.fd -t "${pkgdir}/usr/lib/virtualbox"
    
      132
    
  # binaries (in /usr/lib/virtualbox)
    
  install -m0755 \
    
      VirtualBoxVM \
    
      VBoxHeadless \
    
      VBoxNetAdpCtl \
    
      VBoxNetDHCP \
    
      VBoxNetNAT \
    
      VBoxSDL \
    
      VirtualBox \
    
      VBoxManage \
    
      VBoxSVC \
    
      VBoxExtPackHelperApp \
    
      VBoxBalloonCtrl \
    
      vbox-img \
    
      vboximg-mount \
    
      vboxwebsrv \
    
      webtest \
    
      -t "${pkgdir}/usr/lib/virtualbox"
    
      151
    
  # binaries (in /usr/bin)
    
  install -d -m0755 "${pkgdir}/usr/bin"
    
  install -m0755 VBox.sh "${pkgdir}/usr/bin/VBox"
    
  for i in VirtualBox VirtualBoxVM VBoxManage VBoxSDL VBoxHeadless VBoxBugReport VBoxBalloonCtrl VBoxAutostart vboxwebsrv; do
    
      ln -sf VBox "${pkgdir}/usr/bin/${i}"
    
      ln -sf VBox "${pkgdir}/usr/bin/${i,,}"
    
  done
    
  for i in vbox-img vboximg-mount; do
    
      ln -s ../lib/virtualbox/"${i}" "${pkgdir}/usr/bin/${i}"
    
  done
    
      162
    
  # components
    
  install -d -m0755 "${pkgdir}/usr/lib/virtualbox/components"
    
  install -m0755 components/* -t "${pkgdir}/usr/lib/virtualbox/components"
    
      166
    
  # extension packs
    
  install -d -m0755 "${pkgdir}/usr/lib/virtualbox/ExtensionPacks"
    
      169
    
  # unattended installation templates
    
  install -d -m0755 "${pkgdir}/usr/lib/virtualbox/UnattendedTemplates"
    
  install -m0644 UnattendedTemplates/* -t "${pkgdir}/usr/lib/virtualbox/UnattendedTemplates"
    
      173
    
  # languages
    
  install -d -m0755 "${pkgdir}/usr/lib/virtualbox/nls"
    
  install -m0644 nls/*.qm -t "${pkgdir}/usr/lib/virtualbox/nls"
    
      177
    
  # scripts
    
  install -d -m0755 "${pkgdir}/usr/share/virtualbox"
    
  install -m0755 VBoxCreateUSBNode.sh VBoxSysInfo.sh -t "${pkgdir}/usr/share/virtualbox"
    
      181
    
  # icons
    
  install -D -m0644 VBox.png "${pkgdir}/usr/share/pixmaps/VBox.png"
    
  pushd icons >/dev/null
    
  for i in *; do
    
      install -d "${pkgdir}/usr/share/icons/hicolor/${i}/mimetypes"
    
      cp "${i}/"* "${pkgdir}/usr/share/icons/hicolor/${i}/mimetypes"
    
  done
    
  popd >/dev/null
    
      190
    
  # desktop
    
  install -D -m0644 virtualbox.desktop "${pkgdir}/usr/share/applications/virtualbox.desktop"
    
  install -D -m0644 virtualbox.xml "${pkgdir}/usr/share/mime/packages/virtualbox.xml"
    
      194
    
  # configuration
    
  install -d -m0755 "${pkgdir}/etc/vbox"
    
  echo 'INSTALL_DIR=/usr/lib/virtualbox' > "${pkgdir}/etc/vbox/vbox.cfg"
    
      198
    
  cd "${srcdir}"
    
      200
    
  # license
    
  install -D -m0644 VirtualBox-${_vboxver}/COPYING "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
  install -D -m0644 VirtualBox-${_vboxver}/COPYING.CDDL "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.CDDL"
    
      204
    
  # systemd
    
  install -D -m0644 60-vboxdrv.rules "${pkgdir}/usr/lib/udev/rules.d/60-vboxdrv.rules"
    
  install -D -m0644 vboxweb.service "${pkgdir}/usr/lib/systemd/system/vboxweb.service"
    
  install -D -m0644 virtualbox.sysusers "${pkgdir}/usr/lib/sysusers.d/virtualbox.conf"
    
      209
    
  # module reloading shortcut (with a symlink with default helper)
    
  install -D -m0755 vboxreload "${pkgdir}/usr/bin"
    
  ln -s vboxreload "${pkgdir}/usr/bin/rcvboxdrv"
    
      213}
    
      214

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 19:38:15	Medium	1
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2