virtualhere-client

maintainer craggles17 · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary (vhclientx86_64) directly from virtualhere.com, which is the official vendor website for the VirtualHere product. However, both checksums are set to SKIP, meaning there is no integrity verification of the downloaded binary. The binary is then executed during pkgver() to extract the version string, and installed to /usr/bin. While virtualhere.com is the legitimate upstream vendor host (not a personal or unofficial host), the complete absence of checksums means any MITM or server-side substitution would go undetected. Executing a downloaded binary with no checksum verification during the build process is a genuine supply-chain concern. This is a real medium-severity issue: prebuilt binary from a vendor host with SKIP checksums and execution during build, but not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://www.virtualhere.com/sites/default/files/usbclient/scripts/virtualhereclient.service"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary (vhclientx86_64) directly from virtualhere.com, which is the official vendor website for the VirtualHere product. However, both checksums are set to SKIP, meaning there is no integrity verification of the downloaded binary. The binary is then executed during pkgver() to extract the version string, and installed to /usr/bin. While virtualhere.com is the legitimate upstream vendor host (not a personal or unofficial host), the complete absence of checksums means any MITM or server-side substitution would go undetected. Executing a downloaded binary with no checksum verification during the build process is a genuine supply-chain concern. This is a real medium-severity issue: prebuilt binary from a vendor host with SKIP checksums and execution during build, but not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Craggles <craggles17@gmail.com>
    
      2# Source: https://www.virtualhere.com/client_service
    
      3
    
      4pkgname=virtualhere-client
    
      5pkgver=5.5.6
    
      6pkgrel=1
    
      7pkgdesc="VirtualHere USB Client for Linux Desktop"
    
      8arch=("i686" "x86_64")
    
      9url="https://www.virtualhere.com/usb_server_software"
    
      10license=("BSD")
    
      11optdepends=("avahi: systemd unit support")
    
      12provides=("virtualhereclient")
    
      13conflicts=("virtualhereclient")
    
      14source=("https://www.virtualhere.com/sites/default/files/usbclient/scripts/virtualhereclient.service"
    
      15       "https://www.virtualhere.com/sites/default/files/usbclient/vhclientx86_64")
    
      16md5sums=('SKIP'
    
      17	'SKIP')
    
      18
    
      19pkgver() {
    
      20    chmod +x "${srcdir}/vhclientx86_64"
    
      21    "${srcdir}/vhclientx86_64" --help 2>&1 | head -n 1| sed 's/.[^0-9]*\([0-9]\+[\.0-9]*\),.*/\1/'
    
      22}
    
      23
    
      24package() {
    
      25    install -Dm755 vhclientx86_64              "${pkgdir}/usr/bin/vhclientx86_64"
    
      26    install -Dm644 virtualhereclient.service "${pkgdir}/etc/systemd/system/virtualhereclient.service"
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2