vmware-workstation-noxsave
Triggered rules
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads VMware's official source bundles from Broadcom's domain (softwareupdate-prod.broadcom.com), which is the legitimate vendor infrastructure; despite SKIP'd checksums and a non-whitelisted host, this is a standard AUR practice for large proprietary binaries where upstream does not provide static URLs or hashes, and no code is executed from the downloads beyond installation of official VMware components.
2 higher static findings superseded - not the current verdict (shown for transparency)
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:77
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/core/VMware-Workstation-${_pkgver/_/-}.${CARCH}.bundle.tar"
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:341
chmod +s \
PKGBUILD
2 offending line(s) highlighted# Maintainer: yum13241 <coolcrew45 at disroot dot org>
# Contributor: Julian Xhokaxhiu <https://julianxhokaxhiu.com>
# Contributor: Jean-Marc Lenoir <archlinux "at" jihemel "dot" com>
# Contributor: Maxwell Pray a.k.a. Synthead <synthead@gmail.com>
# To enable macOS guests support, uncomment the line below:
#_enable_macOS_guests=y
# CAUTION: Running macOS on VMware Workstation on non Apple computer is forbidden by
# Apple and VMware EULAs.
# vmware-keymaps dependency is needed to avoid some conflicts when you install
# this package with vmware-horizon-client. If you don't plan to install
# vmware-horizon-client and don't want to add this dependency, you can
# uncomment the line below:
#_remove_vmware_keymaps_dependency=y
#PKGEXT=.pkg.tar
pkgname=vmware-workstation-noxsave
pkgver=17.0.2
_buildver=21581411
_pkgver=${pkgver}_${_buildver}
pkgrel=2
_tools_version=12.1.5_20735119
_legacy_ver=17.0.2
_legacy_buildver=21581411
_legacy_tools_version=12.1.5_20735119
_kmodver=17.5.1
pkgdesc='The industry standard for running multiple operating systems as virtual machines on a single Linux PC. Last version before XSAVE is required. (17.0.2)'
arch=(x86_64)
url='https://www.vmware.com/products/workstation-for-linux.html'
license=(custom)
install="vmware-workstation.install"
conflicts=(
vmware-modules-dkms
vmware-ovftool
vmware-patch
vmware-systemd-services
)
provides=(
vmware-ovftool
)
depends=(
dkms
fuse2
gtkmm3
libcanberra
libaio
pcsclite
hicolor-icon-theme
libxcrypt-compat # needed for ovftool
libxml2-legacy # needed for vmrun
# needed to use Arch GTK3 library (for theme integration)
gtk3
gcr
)
optdepends=(
'linux-headers: build modules against Arch kernel'
)
makedepends=(
sqlite
git
)
backup=(
'etc/vmware/config'
'etc/conf.d/vmware'
)
DLAGENTS=("https::/usr/bin/curl -fLC - --connect-to softwareupdate-prod.broadcom.com:443:softwareupdate-prod.broadcom.com.cdn.cloudflare.net:443 --retry 3 --retry-delay 3 -o %o %u")
source=(
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/core/VMware-Workstation-${_pkgver/_/-}.${CARCH}.bundle.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-linux-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-linuxPreGlibc25-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-netware-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-solaris-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-windows-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-winPre2k-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-winPreVista-${_tools_version/_/-}.${CARCH}.component.tar"
'vmware-bootstrap'
'vmware-vix-bootstrap'
'config'
'configure-initscript.sh'
'vmware-environment.sh'
'vmware-networks-configuration.service'
'vmware-networks.service'
'vmware-usbarbitrator.service'
'vmware-networks.path'
'vmware-usbarbitrator.path'
'dkms.conf.in'
'Makefile'
'vmmon.patch'
'vmnet.patch'
'linux6_15.patch'
'linux6_16.patch'
)
sha256sums=(
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
)
options=(!strip emptydirs !debug)
if [ -z "$_remove_vmware_keymaps_dependency" ]; then
depends+=(
vmware-keymaps
)
fi
_isoimages=(linux linuxPreGlibc25 netware solaris windows winPre2k winPreVista)
if [ -n "$_enable_macOS_guests" ]; then
_vmware_fusion_ver=13.5.2
_vmware_fusion_buildver=23775688
_vmware_fusion_ver_full=${_vmware_fusion_ver}_${_vmware_fusion_buildver}
# List of VMware Fusion versions: https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/fusion/index.html
makedepends+=(
python
7zip
uefitool
)
source+=(
"https://packages-prod.broadcom.com/tools/frozen/darwin/darwin.iso"
"https://packages-prod.broadcom.com/tools/frozen/darwin/darwinPre15.iso"
"unlocker.py"
"efi-patches.txt"
)
sha256sums+=(
'e0c96286f376b30e2c2362bd991709f0f6bc6ebd911be4056a58da8698c49236'
'ef33fc5d152fd9db27cac0b1f21160226dfa5e5b7a501ffa25818682f3b4aaa0'
'8a61e03d0edbbf60c1c84a43aa87a6e950f82d2c71b968888f019345c2f684f3'
'392c1effcdec516000e9f8ffc97f2586524d8953d3e7d6f2c5f93f2acd809d91'
)
_fusion_isoimages=(darwin darwinPre15)
fi
_create_database_file() {
# Create a database which contains the list of guest tools (necessary to avoid that vmware try to download them)
local database_filename="$pkgdir/etc/vmware-installer/database"
echo -n "" > "$database_filename"
sqlite3 "$database_filename" "CREATE TABLE settings(key VARCHAR PRIMARY KEY, value VARCHAR NOT NULL, component_name VARCHAR NOT NULL);"
sqlite3 "$database_filename" "INSERT INTO settings(key,value,component_name) VALUES('db.schemaVersion','2','vmware-installer');"
sqlite3 "$database_filename" "CREATE TABLE components(id INTEGER PRIMARY KEY, name VARCHAR NOT NULL, version VARCHAR NOT NULL, buildNumber INTEGER NOT NULL, component_core_id INTEGER NOT NULL, longName VARCHAR NOT NULL, description VARCHAR, type INTEGER NOT NULL);"
for isoimage in ${_isoimages[@]}
do
local version=$(cat "$srcdir/extracted/vmware-tools-$isoimage/manifest.xml" | grep -oPm1 "(?<=<version>)[^<]+")
sqlite3 "$database_filename" "INSERT INTO components(name,version,buildNumber,component_core_id,longName,description,type) VALUES('vmware-tools-$isoimage','$version',${_pkgver#*_},1,'$isoimage','$isoimage',1);"
done
if [ -n "$_enable_macOS_guests" ]; then
for isoimage in ${_fusion_isoimages[@]}
do
sqlite3 "$database_filename" "INSERT INTO components(name,version,buildNumber,component_core_id,longName,description,type) VALUES('vmware-tools-$isoimage','1',${_vmware_fusion_ver_full#*_},1,'$isoimage','$isoimage',1);"
done
fi
}
prepare() {
extracted_dir="$srcdir/extracted"
[[ -d "$extracted_dir" ]] && rm -r "$extracted_dir"
bash \
"$(readlink -f "$srcdir/VMware-Workstation-${_pkgver/_/-}.${CARCH}.bundle")" \
--install-component "vmware-tools-linux-${_legacy_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-linuxPreGlibc25-${_legacy_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-netware-${_legacy_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-solaris-${_legacy_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-windows-${_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-winPre2k-${_legacy_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-winPreVista-${_legacy_tools_version/_/-}.${CARCH}.component" \
--extract "$extracted_dir"
if [ -n "$_enable_macOS_guests" ]; then
7z e -y com.vmware.fusion.zip payload/VMware\ Fusion.app/Contents/Library/isoimages/\* -o"fusion-isoimages" > /dev/null
sed -i -e "s|/usr/lib/vmware/|${pkgdir}/usr/lib/vmware/|" "$srcdir/unlocker.py"
fi
}
package() {
local vmware_installer_version=$(cat "$srcdir/extracted/vmware-installer/manifest.xml" | grep -oPm1 "(?<=<version>)[^<]+")
# Make directories and copy files.
mkdir -p \
"$pkgdir/etc"/{pam.d,modprobe.d,vmware} \
"$pkgdir/usr"/{share,bin} \
"$pkgdir/usr/include/vmware-vix" \
"$pkgdir/usr/lib"/{vmware/setup,vmware-vix,vmware-ovftool,vmware-installer/"$vmware_installer_version",modules-load.d} \
"$pkgdir/usr/share"/{doc/vmware-vix,licenses/"$pkgname"} \
"$pkgdir/var/lib/vmware/Shared VMs"
cd "$srcdir/extracted"
cp -r \
vmware-workstation/share/* \
vmware-workstation/man \
vmware-network-editor-ui/share/* \
vmware-player-app/share/* \
"$pkgdir/usr/share"
cp -r \
vmware-workstation/bin/* \
vmware-vmx/{,s}bin/* \
vmware-vix-core/bin/* \
vmware-vprobe/bin/* \
vmware-player-app/bin/* \
"$pkgdir/usr/bin"
cp -r \
vmware-workstation/lib/* \
vmware-player-app/lib/* \
vmware-vmx/{lib/*,roms} \
vmware-vprobe/lib/* \
vmware-usbarbitrator/bin \
vmware-network-editor/lib \
"$pkgdir/usr/lib/vmware"
cp -r \
vmware-player-setup/vmware-config \
"$pkgdir/usr/lib/vmware/setup"
cp -r \
vmware-vix-lib-Workstation1700/lib/Workstation-17.0.0 \
vmware-vix-core/{lib/*,vixwrapper-config.txt} \
"$pkgdir/usr/lib/vmware-vix"
cp -r \
vmware-vix-core/doc/* \
"$pkgdir/usr/share/doc/vmware-vix"
cp -r \
vmware-ovftool/* \
"$pkgdir/usr/lib/vmware-ovftool"
cp -r \
vmware-installer/{python,sopython,vmis,vmis-launcher,vmware-installer,vmware-installer.py} \
"$pkgdir/usr/lib/vmware-installer/$vmware_installer_version"
cp -r \
vmware-vix-core/include/* \
"$pkgdir/usr/include/vmware-vix"
for isoimage in ${_isoimages[@]}
do
install -Dm 644 "vmware-tools-$isoimage/$isoimage.iso" "$pkgdir/usr/lib/vmware/isoimages/$isoimage.iso"
done
install -Dm 644 "vmware-workstation/doc/EULA" "$pkgdir/usr/share/doc/vmware-workstation/EULA"
ln -s "/usr/share/doc/vmware-workstation/EULA" "$pkgdir/usr/share/licenses/$pkgname/VMware Workstation - EULA.txt"
ln -s "/usr/lib/vmware-ovftool/vmware.eula" "$pkgdir/usr/share/licenses/$pkgname/VMware OVF Tool - EULA.txt"
install -Dm 644 "vmware-workstation/doc"/open_source_licenses.txt "$pkgdir/usr/share/licenses/$pkgname/VMware Workstation open source license.txt"
install -Dm 644 "vmware-workstation/doc"/ovftool_open_source_licenses.txt "$pkgdir/usr/share/licenses/$pkgname/VMware OVF Tool open source license.txt"
install -Dm 644 "vmware-vix-core"/open_source_licenses.txt "$pkgdir/usr/share/licenses/$pkgname/VMware VIX open source license.txt"
rm "$pkgdir/usr/lib/vmware-ovftool"/{vmware-eula.rtf,open_source_licenses.txt,manifest.xml}
install -d -m 755 "$pkgdir/usr/lib/vmware-installer/$vmware_installer_version"/{lib/lib,artwork}
install -Dm 755 "$srcdir/configure-initscript.sh" "$pkgdir/usr/lib/vmware-installer/$vmware_installer_version/bin/configure-initscript.sh"
install -Dm 644 "vmware-vmx/etc/modprobe.d/modprobe-vmware-fuse.conf" "$pkgdir/etc/modprobe.d/vmware-fuse.conf"
install -Dm 644 vmware-vmx/extra/modules.xml "$pkgdir"/usr/lib/vmware/modules/modules.xml
install -Dm 644 vmware-installer/bootstrap "$pkgdir"/etc/vmware-installer/bootstrap
install -Dm 644 "$srcdir"/vmware-vix-bootstrap "$pkgdir"/etc/vmware-vix/bootstrap
install -Dm 644 "$srcdir"/vmware-bootstrap "$pkgdir"/etc/vmware/bootstrap
install -Dm 644 "$srcdir"/config "$pkgdir"/etc/vmware/config
if [ -z "$_remove_vmware_keymaps_dependency" ]; then
rm -r "$pkgdir/usr/lib/vmware/xkeymap" # these files are provided by vmware-keymaps package
fi
echo -e "vmw_vmci\nvmmon" > "$pkgdir/usr/lib/modules-load.d/vmware.conf"
for service_file in \
vmware-networks-configuration.service \
vmware-networks.service \
vmware-usbarbitrator.service \
vmware-networks.path \
vmware-usbarbitrator.path
do
install -Dm 644 \
"$srcdir/$service_file" \
"$pkgdir/usr/lib/systemd/system/$service_file"
done
# Apply permissions where necessary.
chmod +x \
"$pkgdir/usr/bin"/* \
"$pkgdir/usr/lib/vmware/bin"/* \
"$pkgdir/usr/lib/vmware/setup"/* \
"$pkgdir/usr/lib/vmware/lib"/libvmware-gksu.so/gksu-run-helper \
"$pkgdir/usr/lib/vmware-ovftool"/{ovftool,ovftool.bin} \
"$pkgdir/usr/lib/vmware-installer/$vmware_installer_version"/{vmware-installer,vmis-launcher} \
"$pkgdir/usr/lib/vmware-vix/setup"/*
chmod +s \
"$pkgdir/usr/bin"/vmware-authd \
"$pkgdir/usr/lib/vmware/bin"/{vmware-vmx,vmware-vmx-debug,vmware-vmx-stats}
# Add symlinks the installer would create.
for link in \
licenseTool \
vmplayer \
vmware \
vmware-app-control \
vmware-enter-serial \
vmware-fuseUI \
vmware-gksu \
vmware-modconfig \
vmware-modconfig-console \
vmware-mount \
vmware-netcfg \
vmware-setup-helper \
vmware-tray \
vmware-vmblock-fuse \
vmware-vprobe \
vmware-zenity
do
ln -s /usr/lib/vmware/bin/appLoader "$pkgdir/usr/lib/vmware/bin/$link"
done
for link in \
vmrest
do
ln -s /usr/lib/vmware/bin/appLoader "$pkgdir/usr/bin/$link"
done
for link in \
vmware-fuseUI \
vmware-mount \
vmware-netcfg \
vmware-usbarbitrator
do
ln -s /usr/lib/vmware/bin/$link "$pkgdir/usr/bin/$link"
done
ln -s /usr/lib/vmware/icu "$pkgdir/etc/vmware/icu"
ln -s /usr/lib/vmware-ovftool/ovftool "$pkgdir/usr/bin/ovftool"
ln -s /usr/lib/vmware-vix/libvixAllProducts.so "$pkgdir/usr/lib/libvixAllProducts.so"
# Replace placeholder "variables" with real paths.
for file in \
gtk-3.0/gdk-pixbuf.loaders
do
sed -i 's,@@LIBCONF_DIR@@,/usr/lib/vmware/libconf,g' "$pkgdir/usr/lib/vmware/libconf/etc/$file"
done
sed -i 's,@@BINARY@@,/usr/bin/vmware,' "$pkgdir/usr/share/applications/vmware-workstation.desktop"
sed -i 's,@@BINARY@@,/usr/bin/vmplayer,' "$pkgdir/usr/share/applications/vmware-player.desktop"
sed -i 's,@@BINARY@@,/usr/bin/vmware-netcfg,' "$pkgdir/usr/share/applications/vmware-netcfg.desktop"
sed \
-e "s/@@VERSION@@/$vmware_installer_version/" \
-e "s,@@VMWARE_INSTALLER@@,/usr/lib/vmware-installer/$vmware_installer_version," \
-i "$pkgdir/etc/vmware-installer/bootstrap"
# Patch up the VMware kernel sources and configure DKMS.
dkms_dir="$pkgdir/usr/src/$pkgname-$_pkgver"
rm -rf $dkms_dir/*
git clone https://github.com/mkubecek/vmware-host-modules.git --branch workstation-${_kmodver} $dkms_dir
rm -rf $dkms_dir/.git
install -Dm 644 "$srcdir/Makefile" "$dkms_dir/Makefile"
install -Dm 644 "$srcdir/dkms.conf.in" "$dkms_dir/dkms.conf"
sed \
-e "s/@PKGNAME@/$pkgname/g" \
-e "s/@PKGVER@/$_pkgver/g" \
-i "$dkms_dir/dkms.conf"
for module in vmmon vmnet; do
tar -xf "vmware-vmx/lib/modules/source/$module.tar" -C "$dkms_dir"
msg "Patching $module module for DKMS"
patch -p2 --read-only=ignore --directory="$dkms_dir/$module-only" < "$srcdir/$module.patch"
done
patch -p1 --read-only=ignore --directory="$dkms_dir/" < "$srcdir/linux6_15.patch"
patch -p1 --read-only=ignore --directory="$dkms_dir/" < "$srcdir/linux6_16.patch"
rm -r "$pkgdir/usr/lib/vmware/modules/source"
if [ -n "$_enable_macOS_guests" ]; then
msg "Patching VMware to enable macOS guest support"
python3 "$srcdir/unlocker.py" > /dev/null
for isoimage in ${_fusion_isoimages[@]}
do
install -Dm 644 "$srcdir/$isoimage.iso" "$pkgdir/usr/lib/vmware/isoimages/$isoimage.iso"
done
msg "Patching EFI firmwares to disable macOS server checking"
_efi_arch=("32" "64" "20-32" "20-64")
for arch in ${_efi_arch[@]}
do
uefipatch "$pkgdir/usr/lib/vmware/roms/EFI${arch}.ROM" "$srcdir/efi-patches.txt" -o "$pkgdir/usr/lib/vmware/roms/EFI${arch}.ROM" > /dev/null
done
fi
_create_database_file
# Define some environment variables for VMware and remove the tests about kernel modules
install -Dm 644 "$srcdir/vmware-environment.sh" "$pkgdir/etc/conf.d/vmware"
for program in vmware vmplayer vmware-tray; do
sed -e '/export PRODUCT_NAME/asource /etc/conf.d/vmware' \
-e 's/if "$BINDIR"\/vmware-modconfig --appname=.*/if true ||/' \
-i "$pkgdir/usr/bin/$program"
done
# Add StartupWMClass attribute to desktop files
sed -i '/^StartupNotify=.*/a StartupWMClass=vmware' "$pkgdir/usr/share/applications/vmware-workstation.desktop"
sed -i '/^StartupNotify=.*/a StartupWMClass=vmplayer' "$pkgdir/usr/share/applications/vmware-player.desktop"
sed -i '/^StartupNotify=.*/a StartupWMClass=vmware-netcfg' "$pkgdir/usr/share/applications/vmware-netcfg.desktop"
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |
| 2026-07-15 00:09:25 | LOW | 3 |