virtualbox-kvm

maintainer knoelli · 16 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads the official VirtualBox source from the project's own domain (download.virtualbox.org) and a patch from a GitHub repository; both are used to build the software from source, which is a normal and safe practice for AUR packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official VirtualBox source from the project's own domain (download.virtualbox.org) and a patch from a GitHub repository; both are used to build the software from source, which is a normal and safe practice for AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 source=("https://download.virtualbox.org/virtualbox/${_vboxver}/VirtualBox-${_vboxver}${_vboxsubver}.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: xyzzy
    
      2# Maintainer: knoelli
    
      3
    
      4# Adapted from the official virtualbox package by
    
      5# Contributor: Christian Hesse <eworm@archlinux.org>
    
      6# Contributor: Sébastien "Seblu" Luttringer
    
      7# Contributor: Ionut Biru <ibiru@archlinux.org>
    
      8
    
      9pkgname=virtualbox-kvm
    
      10pkgdesc='Powerful x86 virtualization for enterprise as well as home use (KVM backend)'
    
      11pkgver=20260201
    
      12_pkgver=dev-${pkgver}
    
      13_vboxver='7.2.14'
    
      14_pkgvboxver='7.2.6'	# Version of VBox the patch was made for
    
      15_vboxsubver=''
    
      16pkgrel=6
    
      17conflicts=('virtualbox' 'virtualbox-ose')
    
      18depends=('curl' 'gcc-libs' 'glibc' 'liblzf' 'libpng' 'libtpms' 'libvpx' 'libx11' 'libxcursor'
    
          'libxext' 'libxinerama' 'libxml2' 'libxmu' 'libxt' 'openssl' 'procps-ng' 'python'
    
          'qt6-base' 'qt6-scxml' 'qt6-tools' 'sdl' 'shared-mime-info' 'zlib')
    
      21optdepends=('vde2: Virtual Distributed Ethernet support'
    
          'virtualbox-guest-iso: Guest Additions CD image'
    
          'virtualbox-ext-vnc: VNC server support'
    
          'virtualbox-sdk: Developer kit')
    
      25backup=('etc/vbox/vbox.cfg')
    
      26replaces=('virtualbox-ose')
    
      27arch=('x86_64')
    
      28url='https://github.com/cyberus-technology/virtualbox-kvm'
    
      29license=('GPL-3.0-only AND (GPL-3.0-only OR CDDL-1.0)')
    
      30
    
      31makedepends=('alsa-lib' 'cdrkit' 'curl' 'device-mapper' 'git' 'glu' 'gsoap' 'glslang' 'iasl'
    
           'jdk8-openjdk' 'libidl2' 'liblzf' 'libpulse' 'libtpms' 'libvncserver' 'libvpx'
    
           'libxcomposite' 'libxcursor' 'libxinerama' 'libxml2' 'libxmu' 'libxrandr' 'libxslt'
    
           'libxtst' 'linux-headers' 'mesa' 'python' 'python-setuptools' 'qt6-base' 'qt6-scxml'
    
           'qt6-tools' 'sdl' 'sdl_ttf' 'vde2' 'xorgproto' 'xorg-server-devel' 'yasm')
    
      36
    
      37source=("https://download.virtualbox.org/virtualbox/${_vboxver}/VirtualBox-${_vboxver}${_vboxsubver}.tar.bz2"
    
      "${url}/releases/download/${_pkgver}/kvm-backend-${_pkgvboxver}-${_pkgver}.patch"
    
      'virtualbox-host-dkms.conf'
    
      'virtualbox.sysusers'
    
      'virtualbox-guest-utils.sysusers'
    
      '60-vboxdrv.rules'
    
      '60-vboxguest.rules'
    
      'LocalConfig.kmk'
    
      'vboxservice.service'
    
      'vboxservice-nox.service'
    
      'vboxdrmclient.path'
    
      'vboxdrmclient.service'
    
      'vboxweb.service'
    
      'vboxreload'
    
      '001-disable-update.patch'
    
      '004-drop-Wno-format.patch'
    
      '008-no-vboxvideo.patch'
    
      '009-properly-handle-i3wm.patch'
    
      '012-vbglR3GuestCtrlDetectPeekGetCancelSupport.patch'
    
      '013-support-building-from-dkms.patch'
    
      '018-upate-xclient-script.patch'
    
      '020-python-3-12.patch'
    
      '024-soapC.patch'
    
      '025-v7_2_14.patch')
    
      61sha256sums=('384f293184c52fd51bc941c17d753b4019446f53a6b07c828adfb3e61fe0a500'
    
          'c1b1db76af6a79f84c6eb51212ac440b67a7968951ea071472c83da98fc8ca45'
    
          'f753501352054576c510aa81e83f4935079ea620e601057784b02b4d4d1eeb04'
    
          '2101ebb58233bbfadf3aa74381f22f7e7e508559d2b46387114bc2d8e308554c'
    
          'da4c49f6ca94e047e196cdbcba2c321199f4760056ea66e0fbc659353e128c9e'
    
          'f876e9f55243eded423fda4fc2ffe3b174dca90380a6315f7c9b3cd1c9d07206'
    
          '033c597e0f5285d2ddb0490868e5b6f945f45c7b1b1152a02a9e6fea438b2c95'
    
          '4e93d8944a72ff615ccd99d46ea5f426a472cdafd3943c6813fa5e8ade5da7b0'
    
          'c41a801fe344a4471a7b61a4764d1d857c403e4fb96e2ba6bc89c77a35f2be7a'
    
          '01dbb921bd57a852919cc78be5b73580a564f28ebab2fe8d6c9b8301265cbfce'
    
          '83d8f24bff25bb925083cf39b3195236c6136105e62417712cc3f25b92e14b47'
    
          '2beab8de525220fa418c9873f9e0d657ddbad4ff9e4a46d7053e6cd9bc4ce95e'
    
          'e6e875ef186578b53106d7f6af48e426cdaf1b4e86834f01696b8ef1c685787f'
    
          '4001b5927348fe669a541e80526d4f9ea91b883805f102f7d571edbb482a9b9d'
    
          '9ee947c9b5ec5b25f52d3e72340fc3a57ca6e65a604e15b669ac582a3fb0dc1b'
    
          'eea2671ca4be1d06d1c8e6903ba4bad90581da9fbeea218023409de298803d58'
    
          '053bfeee8863f3ffdf2f0e3f9f0d77dc61dd32764700a97a7635fd8611e20491'
    
          'd76b52d955215a72c296aa36d173897bcaa357528bf5a73347c52ccec8654ced'
    
          '81900e13d36630488accd8c0bfd2ceb69563fb2c4f0f171caba1cca59d438024'
    
          '00f68b86d32a1fada900c2da8dad2ab4215106cd58004f049bded99727cda2ff'
    
          '2540381de895fabbcc68d820c1f72ba644ef566ff5dab0f60be055c7b45cc06f'
    
          'ddb2092a5a000aa6ef854796f39dcdf86e72c06d53b24bac3835350571182df6'
    
          'b70d86e7ca687f65e2bd71ec87d70daad32872acd9b141fb609dff7cce0cd291'
    
          '43112d2c885957ce220219b2f9446e7e67de103774f28393993eac452213b988')
    
      85
    
      86prepare() {
    
  cd "VirtualBox-${_vboxver}"
    
      88
    
  # apply patches from the source array
    
  local filename
    
  for filename in "${source[@]}"; do
    
      if [[ "${filename}" =~ \.patch$ ]]; then
    
          echo "Applying patch ${filename##*/}"
    
          patch -p1 -N -i "${srcdir}/${filename##*/}"
    
      fi
    
  done
    
      97
    
  echo 'Applying local config'
    
  cp "${srcdir}/LocalConfig.kmk" .
    
      100
    
  echo 'Use our CFLAGS'
    
  echo "VBOX_GCC_OPT=$CXXFLAGS" >> LocalConfig.kmk
    
      103}
    
      104
    
      105build() {
    
  cd "VirtualBox-${_vboxver}"
    
      107
    
  echo 'Build virtualbox-kvm'
    
  ./configure \
    
      --with-kvm \
    
      --disable-docs \
    
      --disable-kmods \
    
      --disable-vmmraw \
    
      --disable-hardening \
    
      --enable-vde \
    
      --enable-vnc \
    
      --enable-webservice \
    
      --with-makeself=/usr/bin/echo
    
  # fake makeself binary to compile without nofatal
    
  # makeself is used by linux installer. we don't need it.
    
  source ./env.sh
    
  kmk
    
      123
    
  echo 'Build VNC extension pack'
    
  kmk -C src/VBox/ExtPacks/VNC packing
    
      126}
    
      127
    
      128package() {
    
  source "VirtualBox-${_vboxver}/env.sh"
    
  cd "VirtualBox-${_vboxver}/out/linux.${BUILD_PLATFORM_ARCH}/release/bin"
    
      131
    
  # libraries (and non-PATH executables)
    
  install -d -m0755 "${pkgdir}/usr/lib/virtualbox"
    
  install -m0755 *.so -t "${pkgdir}/usr/lib/virtualbox"
    
  install -m0644 *.r0 VBoxEFI*.fd -t "${pkgdir}/usr/lib/virtualbox"
    
      136
    
  # binaries (in /usr/lib/virtualbox)
    
  install -m0755 \
    
      VirtualBoxVM \
    
      VBoxHeadless \
    
      VBoxNetAdpCtl \
    
      VBoxNetDHCP \
    
      VBoxNetNAT \
    
      VBoxSDL \
    
      VirtualBox \
    
      VBoxManage \
    
      VBoxSVC \
    
      VBoxExtPackHelperApp \
    
      VBoxBalloonCtrl \
    
      vbox-img \
    
      vboximg-mount \
    
      vboxwebsrv \
    
      webtest \
    
      -t "${pkgdir}/usr/lib/virtualbox"
    
      155
    
  # binaries (in /usr/bin)
    
  install -d -m0755 "${pkgdir}/usr/bin"
    
  install -m0755 VBox.sh "${pkgdir}/usr/bin/VBox"
    
  for i in VirtualBox VirtualBoxVM VBoxManage VBoxSDL VBoxHeadless VBoxBugReport VBoxBalloonCtrl VBoxAutostart vboxwebsrv; do
    
      ln -sf VBox "${pkgdir}/usr/bin/${i}"
    
      ln -sf VBox "${pkgdir}/usr/bin/${i,,}"
    
  done
    
  for i in vbox-img vboximg-mount; do
    
      ln -s ../lib/virtualbox/"${i}" "${pkgdir}/usr/bin/${i}"
    
  done
    
      166
    
  # components
    
  install -d -m0755 "${pkgdir}/usr/lib/virtualbox/components"
    
  install -m0755 components/* -t "${pkgdir}/usr/lib/virtualbox/components"
    
      170
    
  # extension packs
    
  install -d -m0755 "${pkgdir}/usr/lib/virtualbox/ExtensionPacks"
    
      173
    
  # unattended installation templates
    
  install -d -m0755 "${pkgdir}/usr/lib/virtualbox/UnattendedTemplates"
    
  install -m0644 UnattendedTemplates/* -t "${pkgdir}/usr/lib/virtualbox/UnattendedTemplates"
    
      177
    
  # languages
    
  install -d -m0755 "${pkgdir}/usr/lib/virtualbox/nls"
    
  install -m0644 nls/*.qm -t "${pkgdir}/usr/lib/virtualbox/nls"
    
      181
    
  # scripts
    
  install -d -m0755 "${pkgdir}/usr/share/virtualbox"
    
  install -m0755 VBoxCreateUSBNode.sh VBoxSysInfo.sh -t "${pkgdir}/usr/share/virtualbox"
    
      185
    
  # icons
    
  install -D -m0644 VBox.png "${pkgdir}/usr/share/pixmaps/VBox.png"
    
  pushd icons >/dev/null
    
  for i in *; do
    
      install -d "${pkgdir}/usr/share/icons/hicolor/${i}/mimetypes"
    
      cp "${i}/"* "${pkgdir}/usr/share/icons/hicolor/${i}/mimetypes"
    
  done
    
  popd >/dev/null
    
      194
    
  # desktop
    
  install -D -m0644 virtualbox.desktop "${pkgdir}/usr/share/applications/virtualbox.desktop"
    
  install -D -m0644 virtualbox.xml "${pkgdir}/usr/share/mime/packages/virtualbox.xml"
    
      198
    
  # configuration
    
  install -d -m0755 "${pkgdir}/etc/vbox"
    
  echo 'INSTALL_DIR=/usr/lib/virtualbox' > "${pkgdir}/etc/vbox/vbox.cfg"
    
      202
    
  cd "${srcdir}"
    
      204
    
  # license
    
  install -D -m0644 VirtualBox-${_vboxver}/COPYING "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
  install -D -m0644 VirtualBox-${_vboxver}/COPYING.CDDL "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.CDDL"
    
      208
    
  # systemd
    
  install -D -m0644 60-vboxdrv.rules "${pkgdir}/usr/lib/udev/rules.d/60-vboxdrv.rules"
    
  install -D -m0644 vboxweb.service "${pkgdir}/usr/lib/systemd/system/vboxweb.service"
    
  install -D -m0644 virtualbox.sysusers "${pkgdir}/usr/lib/sysusers.d/virtualbox.conf"
    
      213
    
  # module reloading shortcut (with a symlink with default helper)
    
  install -D -m0755 vboxreload "${pkgdir}/usr/bin"
    
  ln -s vboxreload "${pkgdir}/usr/bin/rcvboxdrv"
    
      217}
    
      218

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -10,9 +10,10 @@
 pkgdesc='Powerful x86 virtualization for enterprise as well as home use (KVM backend)'
 pkgver=20260201
 _pkgver=dev-${pkgver}
-_vboxver='7.2.6'
+_vboxver='7.2.14'
+_pkgvboxver='7.2.6'	# Version of VBox the patch was made for
 _vboxsubver=''
-pkgrel=4
+pkgrel=6
 conflicts=('virtualbox' 'virtualbox-ose')
 depends=('curl' 'gcc-libs' 'glibc' 'liblzf' 'libpng' 'libtpms' 'libvpx' 'libx11' 'libxcursor'
             'libxext' 'libxinerama' 'libxml2' 'libxmu' 'libxt' 'openssl' 'procps-ng' 'python'
@@ -34,7 +35,7 @@
              'qt6-tools' 'sdl' 'sdl_ttf' 'vde2' 'xorgproto' 'xorg-server-devel' 'yasm')
 
 source=("https://download.virtualbox.org/virtualbox/${_vboxver}/VirtualBox-${_vboxver}${_vboxsubver}.tar.bz2"
-        "${url}/releases/download/${_pkgver}/kvm-backend-${_vboxver}-${_pkgver}.patch"
+        "${url}/releases/download/${_pkgver}/kvm-backend-${_pkgvboxver}-${_pkgver}.patch"
         'virtualbox-host-dkms.conf'
         'virtualbox.sysusers'
         'virtualbox-guest-utils.sysusers'
@@ -55,8 +56,9 @@
         '013-support-building-from-dkms.patch'
         '018-upate-xclient-script.patch'
         '020-python-3-12.patch'
-        '024-soapC.patch')
-sha256sums=('c58443a0e6fcc7fc7e84c1011a10823b3540c6a2b8f2e27c4d8971272baf09f7'
+        '024-soapC.patch'
+        '025-v7_2_14.patch')
+sha256sums=('384f293184c52fd51bc941c17d753b4019446f53a6b07c828adfb3e61fe0a500'
             'c1b1db76af6a79f84c6eb51212ac440b67a7968951ea071472c83da98fc8ca45'
             'f753501352054576c510aa81e83f4935079ea620e601057784b02b4d4d1eeb04'
             '2101ebb58233bbfadf3aa74381f22f7e7e508559d2b46387114bc2d8e308554c'
@@ -78,7 +80,8 @@
             '00f68b86d32a1fada900c2da8dad2ab4215106cd58004f049bded99727cda2ff'
             '2540381de895fabbcc68d820c1f72ba644ef566ff5dab0f60be055c7b45cc06f'
             'ddb2092a5a000aa6ef854796f39dcdf86e72c06d53b24bac3835350571182df6'
-            'b70d86e7ca687f65e2bd71ec87d70daad32872acd9b141fb609dff7cce0cd291')
+            'b70d86e7ca687f65e2bd71ec87d70daad32872acd9b141fb609dff7cce0cd291'
+            '43112d2c885957ce220219b2f9446e7e67de103774f28393993eac452213b988')
 
 prepare() {
     cd "VirtualBox-${_vboxver}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 21:39:42	MEDIUM	1
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2