virtualbox-sdk-svn

LOW
maintainer heavysink 2 votes base virtualbox-svn scanned 2026-10-17 00:21:55.226236
View on AUR
Why flagged

The package builds from the official VirtualBox SVN repository, which is a legitimate source; the flagged non-standard host refers to SVN protocol usage, not a malicious download, and the privileged installs (setuid binaries) are standard for VirtualBox functionality and expected in this context.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official VirtualBox SVN repository, which is a legitimate source; the flagged non-standard host refers to SVN protocol usage, not a malicious download, and the privileged installs (setuid binaries) are standard for VirtualBox functionality and expected in this context.

2 higher static findings superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:60 source=('VirtualBox::svn+https://www.virtualbox.org/svn/vbox/trunk'
Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

  • PKGBUILD:172 install -m4755 VirtualBoxVM VBoxSDL VBoxHeadless VBoxNetAdpCtl VBoxNetDHCP VBoxNetNAT -t "${pkgdir}/usr/lib/virtualbox"

PKGBUILD

2 offending line(s) highlighted
1# $Id$
2# Maintainer: Sébastien "Seblu" Luttringer
3# Contributor: Ionut Biru <ibiru@archlinux.org>
4
5pkgbase=virtualbox-svn
6pkgname=('virtualbox-svn'
7 'virtualbox-host-dkms-svn'
8 'virtualbox-sdk-svn'
9 'virtualbox-guest-utils-svn'
10 'virtualbox-guest-utils-nox-svn'
11 'virtualbox-ext-vnc-svn')
12pkgver=113712
13pkgrel=3
14arch=('x86_64')
15_vbox_arch='amd64'
16url='https://www.virtualbox.org'
17license=('GPL-3.0-only AND (GPL-3.0-only OR CDDL-1.0)')
18makedepends=('alsa-lib'
19 'cdrkit'
20 'curl'
21 'device-mapper'
22 'subversion'
23 'glu'
24 'gsoap'
25 'glslang'
26 'iasl'
27 'jdk8-openjdk'
28 'libidl2'
29 'libpulse'
30 'libvncserver'
31 'libvpx'
32 'libxcomposite'
33 'libxcursor'
34 'libxinerama'
35 'libxml2'
36 'libxmu'
37 'libxrandr'
38 'liblzf'
39 'libtpms'
40 'libxslt'
41 'libxtst'
42 'libssh'
43 'linux-headers'
44 'mesa'
45 'nasm'
46 'opus'
47 'python'
48 'python-setuptools'
49 'qt6-base'
50 'qt6-5compat'
51 'qt6-scxml'
52 'qt6-tools'
53 'sdl'
54 'sdl2_ttf'
55 'vde2'
56 'xalan-c'
57 'xorgproto'
58 'xorg-server-devel'
59 'yasm')
60source=('VirtualBox::svn+https://www.virtualbox.org/svn/vbox/trunk'
61 'virtualbox-host-dkms.conf'
62 'virtualbox.sysusers'
63 'virtualbox-guest-utils.sysusers'
64 '60-vboxdrv.rules'
65 '60-vboxguest.rules'
66 'LocalConfig.kmk'
67 'vboxservice.service'
68 'vboxservice-nox.service'
69 'vboxweb.service'
70 'vboxreload'
71 '001-disable-update.patch'
72 '004-drop-Wno-format.patch'
73 '008-no-vboxvideo.patch'
74 '009-properly-handle-i3wm.patch'
75 '012-vbglR3GuestCtrlDetectPeekGetCancelSupport.patch'
76 '013-support-building-from-dkms.patch'
77 '018-upate-xclient-script.patch'
78 '019-linux-7.2-vboxnetadp.patch'
79 '0020-python-3-12.patch')
80options=(!debug)
81
82pkgver() {
83 cd "VirtualBox"
84 local ver="$(svnversion)"
85 printf "%s" "${ver//[[:alpha:]]}"
86}
87
88prepare() {
89 cd "VirtualBox"
90
91 # apply patch from the source array (should be a pacman feature)
92 local filename
93 for filename in "${source[@]}"; do
94 if [[ "$filename" =~ \.patch$ ]]; then
95 if [[ "${filename##*/}" == 019-linux-7.2-vboxnetadp.patch ]] &&
96 patch --batch --dry-run --reverse -p1 -i "$srcdir/${filename##*/}" &>/dev/null; then
97 echo "Skipping patch ${filename##*/} (already applied upstream)"
98 continue
99 fi
100 echo "Applying patch ${filename##*/}"
101 patch --batch --forward -p1 -i "$srcdir/${filename##*/}"
102 fi
103 done
104
105 echo 'Applying local config'
106 cp "$srcdir/LocalConfig.kmk" .
107
108 echo 'Use our CFLAGS'
109 echo "VBOX_GCC_OPT=$CXXFLAGS" >> LocalConfig.kmk
110}
111
112build() {
113 cd "VirtualBox"
114
115 echo 'Build virtualbox'
116 ./configure \
117 --disable-docs \
118 --disable-linux-kernel-headers \
119 --enable-webservice \
120 --with-kbuild-path="$PWD/kBuild/kBuild" \
121 --disable-makeself
122 # Qt 6.11's pkg-config includedir points at QtCore, while kBuild expects
123 # the common module include root.
124 echo 'PATH_SDK_QT6_INC := /usr/include/qt6' >> AutoConfig.kmk
125 source ./env.sh
126 kmk
127
128 echo 'Build VNC extension pack'
129 kmk -C src/VBox/ExtPacks/VNC packing
130}
131
132package_virtualbox-svn() {
133 pkgdesc='Powerful x86 virtualization for enterprise as well as home use'
134 depends=('curl' 'libcurl.so'
135 'glibc'
136 'libgcc' 'libgcc_s.so'
137 'libglvnd' 'libGL.so'
138 'liblzf' 'liblzf.so'
139 'libogg' 'libogg.so'
140 'libpng' 'libpng16.so'
141 'libstdc++' 'libstdc++.so'
142 'libtpms' 'libssh'
143 'libvorbis' 'libvorbisenc.so' 'libvorbis.so'
144 'libvpx' 'libvpx.so'
145 'libx11' 'libxcb'
146 'libxml2' 'libxml2.so'
147 'libxt'
148 'openssl' 'libcrypto.so' 'libssl.so'
149 'procps-ng' 'python'
150 'qt6-base' 'qt6-scxml' 'qt6-tools'
151 'sdl' 'shared-mime-info'
152 'xz' 'liblzma.so'
153 'zlib' 'libz.so'
154 'VIRTUALBOX-HOST-MODULES')
155 optdepends=('vde2: Virtual Distributed Ethernet support'
156 'virtualbox-guest-iso: Guest Additions CD image'
157 'virtualbox-ext-vnc-svn: VNC server support'
158 'virtualbox-sdk-svn: Developer kit')
159 backup=('etc/vbox/vbox.cfg')
160 provides=('virtualbox')
161 replaces=('virtualbox-ose')
162 conflicts=('virtualbox-ose' 'virtualbox')
163
164 source "VirtualBox/env.sh"
165 cd "VirtualBox/out/linux.${_vbox_arch}/release/bin"
166
167 # libraries (and non-PATH executables)
168 install -d -m0755 "${pkgdir}/usr/lib/virtualbox"
169 install -m0755 *.so -t "${pkgdir}/usr/lib/virtualbox"
170 install -m0644 *.r0 VBoxEFI*.fd -t "${pkgdir}/usr/lib/virtualbox"
171 ## setuid root binaries
172 install -m4755 VirtualBoxVM VBoxSDL VBoxHeadless VBoxNetAdpCtl VBoxNetDHCP VBoxNetNAT -t "${pkgdir}/usr/lib/virtualbox"
173 ## other binaries
174 install -m0755 VirtualBox VBoxManage VBoxSVC VBoxExtPackHelperApp VBoxBalloonCtrl vbox-img vboximg-mount vboxwebsrv webtest -t "${pkgdir}/usr/lib/virtualbox"
175
176 # binaries (in /usr/bin)
177 install -d -m0755 "${pkgdir}/usr/bin"
178 install -m0755 VBox.sh "${pkgdir}/usr/bin/VBox"
179 for i in VirtualBox VirtualBoxVM VBoxManage VBoxSDL VBoxHeadless VBoxBugReport VBoxBalloonCtrl VBoxAutostart vboxwebsrv; do
180 ln -sf VBox "${pkgdir}/usr/bin/${i}"
181 ln -sf VBox "${pkgdir}/usr/bin/${i,,}"
182 done
183 for i in vbox-img vboximg-mount; do
184 ln -s ../lib/virtualbox/"${i}" "${pkgdir}/usr/bin/${i}"
185 done
186
187 # components
188 install -dm0755 "$pkgdir/usr/lib/virtualbox/components"
189 install -m0755 components/* -t "$pkgdir/usr/lib/virtualbox/components"
190
191 # extensions packs
192 ## as virtualbox install itself stuff in this directory, move it to /var and
193 ## trick it with a symlink
194 ## FIXME: trick is disabled for now
195 #install -dm0755 "$pkgdir/var/lib/virtualbox/extensions"
196 #install -dm0755 "$pkgdir/usr/share/virtualbox/extensions"
197 #ln -s ../../../var/lib/virtualbox/extensions "$pkgdir/usr/lib/virtualbox/ExtensionPacks"
198 install -dm0755 "$pkgdir/usr/lib/virtualbox/ExtensionPacks"
199
200 # languages
201 install -dm0755 "$pkgdir/usr/share/virtualbox/nls"
202 install -m0755 nls/*.qm -t "$pkgdir/usr/share/virtualbox/nls"
203
204 # useless scripts
205 install -m0755 VBoxCreateUSBNode.sh VBoxSysInfo.sh -t "$pkgdir/usr/share/virtualbox"
206
207 # icons
208 install -Dm0644 VBox.png "$pkgdir/usr/share/pixmaps/VBox.png"
209
210 pushd icons >/dev/null
211 for i in *; do
212 install -d "$pkgdir/usr/share/icons/hicolor/$i/mimetypes"
213 cp $i/* "$pkgdir/usr/share/icons/hicolor/$i/mimetypes"
214 done
215 popd >/dev/null
216
217 #desktop
218 install -Dm0644 virtualbox.desktop "$pkgdir/usr/share/applications/virtualbox.desktop"
219 install -Dm0644 virtualbox.xml "$pkgdir/usr/share/mime/packages/virtualbox.xml"
220
221 #install configuration
222 install -dm0755 "$pkgdir/etc/vbox"
223 echo 'INSTALL_DIR=/usr/lib/virtualbox' > "$pkgdir/etc/vbox/vbox.cfg"
224
225 # templates for unattended guest installation
226 mv UnattendedTemplates "$pkgdir/usr/share/virtualbox/"
227
228 # back to srcdir
229 cd "$srcdir"
230
231 #licence
232 install -Dm0644 VirtualBox/COPYING "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
233 install -D -m0644 VirtualBox/COPYING.CDDL "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.CDDL"
234
235 # install systemd stuff
236 install -Dm0644 60-vboxdrv.rules "$pkgdir/usr/lib/udev/rules.d/60-vboxdrv.rules"
237 install -Dm0644 vboxweb.service "$pkgdir/usr/lib/systemd/system/vboxweb.service"
238 install -Dm0644 virtualbox.sysusers "$pkgdir/usr/lib/sysusers.d/virtualbox.conf"
239
240 # install module reloading shortcut (with a symlink with default helper)
241 install -Dm0755 vboxreload "$pkgdir/usr/bin"
242 ln -s vboxreload "$pkgdir/usr/bin/rcvboxdrv"
243}
244
245package_virtualbox-sdk-svn() {
246 pkgdesc='VirtualBox Software Developer Kit (SDK)'
247 depends=('python')
248 provides=('virtualbox-sdk')
249 conflicts=('virtualbox-sdk')
250
251 install -dm0755 "$pkgdir/usr/lib/virtualbox"
252
253 source "VirtualBox/env.sh"
254 cd "VirtualBox/out/linux.${_vbox_arch}/release/bin"
255
256 install -Dm0755 vboxshell.py "$pkgdir/usr/lib/virtualbox/vboxshell.py"
257 # python sdk
258 pushd sdk/installer/python
259 VBOX_INSTALL_PATH="/usr/lib/virtualbox" python vboxapisetup.py install --root "$pkgdir"
260 popd
261 cp -r sdk "$pkgdir/usr/lib/virtualbox"
262 rm -r "$pkgdir/usr/lib/virtualbox/sdk/installer"
263 # licence
264 install -Dm0644 "$srcdir/VirtualBox/COPYING" \
265 "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
266 install -D -m0644 "${srcdir}/VirtualBox/COPYING.CDDL" \
267 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.CDDL"
268}
269
270package_virtualbox-host-dkms-svn() {
271 pkgdesc='VirtualBox Host kernel modules sources'
272 depends=('dkms' 'gcc' 'make')
273 replaces=('virtualbox-source' 'virtualbox-host-source')
274 conflicts=('virtualbox-source' 'virtualbox-host-source' 'virtualbox-host-dkms')
275 provides=('VIRTUALBOX-HOST-MODULES')
276
277 install -dm0755 "$pkgdir/usr/src"
278 source "VirtualBox/env.sh"
279 cd "VirtualBox/out/linux.${_vbox_arch}/release/bin"
280 cp -r src "$pkgdir/usr/src/vboxhost-${pkgver}_OSE"
281 # licence
282 install -Dm0644 "$srcdir/VirtualBox/COPYING" \
283 "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
284 install -D -m0644 "${srcdir}/VirtualBox/COPYING.CDDL" \
285 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.CDDL"
286 # module loading
287 printf '%s\n' vboxdrv vboxnetadp vboxnetflt |
288 install -Dm0644 /dev/stdin "$pkgdir/usr/lib/modules-load.d/$pkgname.conf"
289 sed "s,@VERSION@,${pkgver}," < "$srcdir/virtualbox-host-dkms.conf" |
290 install -Dm0644 /dev/stdin "$pkgdir/usr/src/vboxhost-${pkgver}_OSE/dkms.conf"
291}
292
293package_virtualbox-guest-utils-svn() {
294 pkgdesc='VirtualBox Guest userspace utilities'
295 depends=('glibc' 'pam' 'libpam.so' 'zlib' 'libz.so'
296 'dbus' 'gtk3' 'libx11' 'libxfixes' 'libxmu' 'libxt'
297 'wayland' 'xorg-xrandr' 'VIRTUALBOX-GUEST-MODULES')
298 replaces=('virtualbox-archlinux-additions' 'virtualbox-guest-additions' 'virtualbox-guest-dkms-svn')
299 provides=('virtualbox-guest-utils')
300 conflicts=('virtualbox-archlinux-additions' 'virtualbox-guest-additions' 'virtualbox-guest-utils-nox' 'virtualbox-guest-utils' 'virtualbox-guest-dkms' 'virtualbox-guest-dkms-svn')
301
302 source "VirtualBox/env.sh"
303 pushd "VirtualBox/out/linux.${_vbox_arch}/release/bin/additions"
304 install -d "$pkgdir/usr/bin"
305 install -m0755 VBoxAudioTest VBoxClient VBoxControl VBoxDRMClient VBoxService "$pkgdir/usr/bin"
306 install -m0755 -D "$srcdir"/VirtualBox/src/VBox/Additions/x11/Installer/98vboxadd-xclient \
307 "$pkgdir"/usr/bin/VBoxClient-all
308 install -m0644 -D "$srcdir"/VirtualBox/src/VBox/Additions/x11/Installer/vboxclient.desktop \
309 "$pkgdir"/etc/xdg/autostart/vboxclient.desktop
310 install -m0755 -D pam_vbox.so "$pkgdir/usr/lib/security/pam_vbox.so"
311 popd
312 # systemd stuff
313 install -Dm0644 60-vboxguest.rules "$pkgdir/usr/lib/udev/rules.d/60-vboxguest.rules"
314 install -Dm0644 vboxservice.service "$pkgdir/usr/lib/systemd/system/vboxservice.service"
315 install -Dm0644 virtualbox-guest-utils.sysusers "$pkgdir/usr/lib/sysusers.d/virtualbox-guest-utils.conf"
316 # licence
317 install -Dm0644 VirtualBox/COPYING "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
318 install -Dm0644 VirtualBox/COPYING.CDDL "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.CDDL"
319}
320
321package_virtualbox-guest-utils-nox-svn() {
322 pkgdesc='VirtualBox Guest userspace utilities without X support'
323 depends=('glibc' 'pam' 'libpam.so' 'zlib' 'libz.so' 'VIRTUALBOX-GUEST-MODULES')
324 replaces=('virtualbox-guest-dkms-svn')
325 provides=('virtualbox-guest-utils-nox')
326 conflicts=('virtualbox-guest-utils' 'virtualbox-guest-utils-nox' 'virtualbox-guest-dkms' 'virtualbox-guest-dkms-svn')
327
328 source "VirtualBox/env.sh"
329 pushd "VirtualBox/out/linux.${_vbox_arch}/release/bin/additions"
330 install -d "$pkgdir/usr/bin"
331 install -m0755 VBoxControl VBoxService "$pkgdir/usr/bin"
332 install -m0755 -D pam_vbox.so "$pkgdir/usr/lib/security/pam_vbox.so"
333 popd
334 # systemd stuff
335 install -Dm0644 60-vboxguest.rules "$pkgdir/usr/lib/udev/rules.d/60-vboxguest.rules"
336 install -Dm0644 vboxservice-nox.service "$pkgdir/usr/lib/systemd/system/vboxservice.service"
337 install -Dm0644 virtualbox-guest-utils.sysusers "$pkgdir/usr/lib/sysusers.d/virtualbox-guest-utils.conf"
338 # licence
339 install -Dm0644 "$srcdir/VirtualBox/COPYING" \
340 "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
341 install -Dm0644 "${srcdir}/VirtualBox/COPYING.CDDL" \
342 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.CDDL"
343}
344
345package_virtualbox-ext-vnc-svn() {
346 pkgdesc='VirtualBox VNC extension pack'
347 depends=('virtualbox-svn' 'libvncserver')
348 optdepends=('tigervnc: vnc client')
349 provides=('virtualbox-ext-vnc')
350 conflicts=('virtualbox-ext-vnc')
351 install=virtualbox-ext-vnc.install
352
353 source "VirtualBox/env.sh"
354 cd "VirtualBox/out/linux.${_vbox_arch}/release/packages"
355 install -Dm0644 VNC-*.vbox-extpack "$pkgdir/usr/share/virtualbox/extensions/VNC-${pkgver}.vbox-extpack"
356 # licence
357 install -Dm0644 "$srcdir/VirtualBox/COPYING" \
358 "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
359 install -Dm0644 "${srcdir}/VirtualBox/COPYING.CDDL" \
360 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.CDDL"
361}
362sha256sums=('SKIP'
363 'f753501352054576c510aa81e83f4935079ea620e601057784b02b4d4d1eeb04'
364 '2101ebb58233bbfadf3aa74381f22f7e7e508559d2b46387114bc2d8e308554c'
365 'da4c49f6ca94e047e196cdbcba2c321199f4760056ea66e0fbc659353e128c9e'
366 'f876e9f55243eded423fda4fc2ffe3b174dca90380a6315f7c9b3cd1c9d07206'
367 '033c597e0f5285d2ddb0490868e5b6f945f45c7b1b1152a02a9e6fea438b2c95'
368 'efc820d51c105d1bee7a9dc49e8d7ed0340db78f0e97d041b58e98ff4da50c82'
369 '6aaa51b59595c76aab7bc773453e6e739950693d5336548f9a896695e0decb14'
370 '01dbb921bd57a852919cc78be5b73580a564f28ebab2fe8d6c9b8301265cbfce'
371 'e6e875ef186578b53106d7f6af48e426cdaf1b4e86834f01696b8ef1c685787f'
372 '4001b5927348fe669a541e80526d4f9ea91b883805f102f7d571edbb482a9b9d'
373 '9ee947c9b5ec5b25f52d3e72340fc3a57ca6e65a604e15b669ac582a3fb0dc1b'
374 '0d35b29c8f996491fe89e0bf4b61d68a9918b0abc11c500c42d9b8394532b80f'
375 '053bfeee8863f3ffdf2f0e3f9f0d77dc61dd32764700a97a7635fd8611e20491'
376 '615e4ec8896ee13549e28c52e700bd52f9ccf7de4dccb33c2b96bf574a2edb47'
377 '81900e13d36630488accd8c0bfd2ceb69563fb2c4f0f171caba1cca59d438024'
378 '00f68b86d32a1fada900c2da8dad2ab4215106cd58004f049bded99727cda2ff'
379 '3d790cb7c7ca0860d87d220c5aa047124bc6ba3697a01b511fa096e53e20ba78'
380 'cba1f2f9f6170e40ca9bddcbffc45feb1169811c707b885090c1b3aae3f1e6cd'
381 'ddb2092a5a000aa6ef854796f39dcdf86e72c06d53b24bac3835350571182df6')
382

Scan history

Scanned at (UTC)SeverityRules
2026-10-17 00:21:55 Low 3
2026-10-16 00:12:47 Low 3
2026-10-15 00:28:05 Low 3
2026-10-14 00:06:47 Low 3
2026-10-13 00:23:45 Low 3
2026-10-12 00:18:51 Low 3
2026-10-11 00:26:05 Low 3
2026-10-10 00:11:52 Low 3
2026-10-09 00:05:33 Low 3
2026-10-08 00:28:03 Low 3
2026-10-07 00:21:34 Low 3
2026-10-06 00:13:36 Low 3
2026-10-05 00:08:03 Low 3
2026-10-04 00:18:08 Low 3
2026-10-03 00:23:04 Low 3
2026-10-02 00:00:32 Low 3
2026-10-01 00:02:06 Low 3
2026-09-30 00:20:07 Low 3
2026-09-29 00:07:46 Low 3
2026-09-28 00:28:32 Low 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion