vmware-workstation-noxsave
The package downloads VMware's official source bundles from Broadcom's domain (softwareupdate-prod.broadcom.com), which is the legitimate vendor infrastructure; despite SKIP'd checksums and a non-whitelisted host, this is a standard AUR practice for large proprietary binaries where upstream does not provide static URLs or hashes, and no code is executed from the downloads beyond installation of official VMware components.
Triggered rules
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads VMware's official source bundles from Broadcom's domain (softwareupdate-prod.broadcom.com), which is the legitimate vendor infrastructure; despite SKIP'd checksums and a non-whitelisted host, this is a standard AUR practice for large proprietary binaries where upstream does not provide static URLs or hashes, and no code is executed from the downloads beyond installation of official VMware components.
2 higher static findings superseded - not the current verdict (shown for transparency)
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:77
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/core/VMware-Workstation-${_pkgver/_/-}.${CARCH}.bundle.tar"
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:341
chmod +s \
PKGBUILD
2 offending line(s) highlighted# Maintainer: yum13241 <coolcrew45 at disroot dot org>
# Contributor: Julian Xhokaxhiu <https://julianxhokaxhiu.com>
# Contributor: Jean-Marc Lenoir <archlinux "at" jihemel "dot" com>
# Contributor: Maxwell Pray a.k.a. Synthead <synthead@gmail.com>
# To enable macOS guests support, uncomment the line below:
#_enable_macOS_guests=y
# CAUTION: Running macOS on VMware Workstation on non Apple computer is forbidden by
# Apple and VMware EULAs.
# vmware-keymaps dependency is needed to avoid some conflicts when you install
# this package with vmware-horizon-client. If you don't plan to install
# vmware-horizon-client and don't want to add this dependency, you can
# uncomment the line below:
#_remove_vmware_keymaps_dependency=y
#PKGEXT=.pkg.tar
pkgname=vmware-workstation-noxsave
pkgver=17.0.2
_buildver=21581411
_pkgver=${pkgver}_${_buildver}
pkgrel=2
_tools_version=12.1.5_20735119
_legacy_ver=17.0.2
_legacy_buildver=21581411
_legacy_tools_version=12.1.5_20735119
_kmodver=17.5.1
pkgdesc='The industry standard for running multiple operating systems as virtual machines on a single Linux PC. Last version before XSAVE is required. (17.0.2)'
arch=(x86_64)
url='https://www.vmware.com/products/workstation-for-linux.html'
license=(custom)
install="vmware-workstation.install"
conflicts=(
vmware-modules-dkms
vmware-ovftool
vmware-patch
vmware-systemd-services
)
provides=(
vmware-ovftool
)
depends=(
dkms
fuse2
gtkmm3
libcanberra
libaio
pcsclite
hicolor-icon-theme
libxcrypt-compat # needed for ovftool
libxml2-legacy # needed for vmrun
# needed to use Arch GTK3 library (for theme integration)
gtk3
gcr
)
optdepends=(
'linux-headers: build modules against Arch kernel'
)
makedepends=(
sqlite
git
)
backup=(
'etc/vmware/config'
'etc/conf.d/vmware'
)
DLAGENTS=("https::/usr/bin/curl -fLC - --connect-to softwareupdate-prod.broadcom.com:443:softwareupdate-prod.broadcom.com.cdn.cloudflare.net:443 --retry 3 --retry-delay 3 -o %o %u")
source=(
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/core/VMware-Workstation-${_pkgver/_/-}.${CARCH}.bundle.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-linux-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-linuxPreGlibc25-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-netware-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-solaris-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-windows-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-winPre2k-${_tools_version/_/-}.${CARCH}.component.tar"
"https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/ws/${pkgver}/${_buildver}/linux/packages/vmware-tools-winPreVista-${_tools_version/_/-}.${CARCH}.component.tar"
'vmware-bootstrap'
'vmware-vix-bootstrap'
'config'
'configure-initscript.sh'
'vmware-environment.sh'
'vmware-networks-configuration.service'
'vmware-networks.service'
'vmware-usbarbitrator.service'
'vmware-networks.path'
'vmware-usbarbitrator.path'
'dkms.conf.in'
'Makefile'
'vmmon.patch'
'vmnet.patch'
'linux6_15.patch'
'linux6_16.patch'
)
sha256sums=(
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
'SKIP'
)
options=(!strip emptydirs !debug)
if [ -z "$_remove_vmware_keymaps_dependency" ]; then
depends+=(
vmware-keymaps
)
fi
_isoimages=(linux linuxPreGlibc25 netware solaris windows winPre2k winPreVista)
if [ -n "$_enable_macOS_guests" ]; then
_vmware_fusion_ver=13.5.2
_vmware_fusion_buildver=23775688
_vmware_fusion_ver_full=${_vmware_fusion_ver}_${_vmware_fusion_buildver}
# List of VMware Fusion versions: https://softwareupdate-prod.broadcom.com/cds/vmw-desktop/fusion/index.html
makedepends+=(
python
7zip
uefitool
)
source+=(
"https://packages-prod.broadcom.com/tools/frozen/darwin/darwin.iso"
"https://packages-prod.broadcom.com/tools/frozen/darwin/darwinPre15.iso"
"unlocker.py"
"efi-patches.txt"
)
sha256sums+=(
'e0c96286f376b30e2c2362bd991709f0f6bc6ebd911be4056a58da8698c49236'
'ef33fc5d152fd9db27cac0b1f21160226dfa5e5b7a501ffa25818682f3b4aaa0'
'8a61e03d0edbbf60c1c84a43aa87a6e950f82d2c71b968888f019345c2f684f3'
'392c1effcdec516000e9f8ffc97f2586524d8953d3e7d6f2c5f93f2acd809d91'
)
_fusion_isoimages=(darwin darwinPre15)
fi
_create_database_file() {
# Create a database which contains the list of guest tools (necessary to avoid that vmware try to download them)
local database_filename="$pkgdir/etc/vmware-installer/database"
echo -n "" > "$database_filename"
sqlite3 "$database_filename" "CREATE TABLE settings(key VARCHAR PRIMARY KEY, value VARCHAR NOT NULL, component_name VARCHAR NOT NULL);"
sqlite3 "$database_filename" "INSERT INTO settings(key,value,component_name) VALUES('db.schemaVersion','2','vmware-installer');"
sqlite3 "$database_filename" "CREATE TABLE components(id INTEGER PRIMARY KEY, name VARCHAR NOT NULL, version VARCHAR NOT NULL, buildNumber INTEGER NOT NULL, component_core_id INTEGER NOT NULL, longName VARCHAR NOT NULL, description VARCHAR, type INTEGER NOT NULL);"
for isoimage in ${_isoimages[@]}
do
local version=$(cat "$srcdir/extracted/vmware-tools-$isoimage/manifest.xml" | grep -oPm1 "(?<=<version>)[^<]+")
sqlite3 "$database_filename" "INSERT INTO components(name,version,buildNumber,component_core_id,longName,description,type) VALUES('vmware-tools-$isoimage','$version',${_pkgver#*_},1,'$isoimage','$isoimage',1);"
done
if [ -n "$_enable_macOS_guests" ]; then
for isoimage in ${_fusion_isoimages[@]}
do
sqlite3 "$database_filename" "INSERT INTO components(name,version,buildNumber,component_core_id,longName,description,type) VALUES('vmware-tools-$isoimage','1',${_vmware_fusion_ver_full#*_},1,'$isoimage','$isoimage',1);"
done
fi
}
prepare() {
extracted_dir="$srcdir/extracted"
[[ -d "$extracted_dir" ]] && rm -r "$extracted_dir"
bash \
"$(readlink -f "$srcdir/VMware-Workstation-${_pkgver/_/-}.${CARCH}.bundle")" \
--install-component "vmware-tools-linux-${_legacy_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-linuxPreGlibc25-${_legacy_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-netware-${_legacy_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-solaris-${_legacy_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-windows-${_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-winPre2k-${_legacy_tools_version/_/-}.${CARCH}.component" \
--install-component "vmware-tools-winPreVista-${_legacy_tools_version/_/-}.${CARCH}.component" \
--extract "$extracted_dir"
if [ -n "$_enable_macOS_guests" ]; then
7z e -y com.vmware.fusion.zip payload/VMware\ Fusion.app/Contents/Library/isoimages/\* -o"fusion-isoimages" > /dev/null
sed -i -e "s|/usr/lib/vmware/|${pkgdir}/usr/lib/vmware/|" "$srcdir/unlocker.py"
fi
}
package() {
local vmware_installer_version=$(cat "$srcdir/extracted/vmware-installer/manifest.xml" | grep -oPm1 "(?<=<version>)[^<]+")
# Make directories and copy files.
mkdir -p \
"$pkgdir/etc"/{pam.d,modprobe.d,vmware} \
"$pkgdir/usr"/{share,bin} \
"$pkgdir/usr/include/vmware-vix" \
"$pkgdir/usr/lib"/{vmware/setup,vmware-vix,vmware-ovftool,vmware-installer/"$vmware_installer_version",modules-load.d} \
"$pkgdir/usr/share"/{doc/vmware-vix,licenses/"$pkgname"} \
"$pkgdir/var/lib/vmware/Shared VMs"
cd "$srcdir/extracted"
cp -r \
vmware-workstation/share/* \
vmware-workstation/man \
vmware-network-editor-ui/share/* \
vmware-player-app/share/* \
"$pkgdir/usr/share"
cp -r \
vmware-workstation/bin/* \
vmware-vmx/{,s}bin/* \
vmware-vix-core/bin/* \
vmware-vprobe/bin/* \
vmware-player-app/bin/* \
"$pkgdir/usr/bin"
cp -r \
vmware-workstation/lib/* \
vmware-player-app/lib/* \
vmware-vmx/{lib/*,roms} \
vmware-vprobe/lib/* \
vmware-usbarbitrator/bin \
vmware-network-editor/lib \
"$pkgdir/usr/lib/vmware"
cp -r \
vmware-player-setup/vmware-config \
"$pkgdir/usr/lib/vmware/setup"
cp -r \
vmware-vix-lib-Workstation1700/lib/Workstation-17.0.0 \
vmware-vix-core/{lib/*,vixwrapper-config.txt} \
"$pkgdir/usr/lib/vmware-vix"
cp -r \
vmware-vix-core/doc/* \
"$pkgdir/usr/share/doc/vmware-vix"
cp -r \
vmware-ovftool/* \
"$pkgdir/usr/lib/vmware-ovftool"
cp -r \
vmware-installer/{python,sopython,vmis,vmis-launcher,vmware-installer,vmware-installer.py} \
"$pkgdir/usr/lib/vmware-installer/$vmware_installer_version"
cp -r \
vmware-vix-core/include/* \
"$pkgdir/usr/include/vmware-vix"
for isoimage in ${_isoimages[@]}
do
install -Dm 644 "vmware-tools-$isoimage/$isoimage.iso" "$pkgdir/usr/lib/vmware/isoimages/$isoimage.iso"
done
install -Dm 644 "vmware-workstation/doc/EULA" "$pkgdir/usr/share/doc/vmware-workstation/EULA"
ln -s "/usr/share/doc/vmware-workstation/EULA" "$pkgdir/usr/share/licenses/$pkgname/VMware Workstation - EULA.txt"
ln -s "/usr/lib/vmware-ovftool/vmware.eula" "$pkgdir/usr/share/licenses/$pkgname/VMware OVF Tool - EULA.txt"
install -Dm 644 "vmware-workstation/doc"/open_source_licenses.txt "$pkgdir/usr/share/licenses/$pkgname/VMware Workstation open source license.txt"
install -Dm 644 "vmware-workstation/doc"/ovftool_open_source_licenses.txt "$pkgdir/usr/share/licenses/$pkgname/VMware OVF Tool open source license.txt"
install -Dm 644 "vmware-vix-core"/open_source_licenses.txt "$pkgdir/usr/share/licenses/$pkgname/VMware VIX open source license.txt"
rm "$pkgdir/usr/lib/vmware-ovftool"/{vmware-eula.rtf,open_source_licenses.txt,manifest.xml}
install -d -m 755 "$pkgdir/usr/lib/vmware-installer/$vmware_installer_version"/{lib/lib,artwork}
install -Dm 755 "$srcdir/configure-initscript.sh" "$pkgdir/usr/lib/vmware-installer/$vmware_installer_version/bin/configure-initscript.sh"
install -Dm 644 "vmware-vmx/etc/modprobe.d/modprobe-vmware-fuse.conf" "$pkgdir/etc/modprobe.d/vmware-fuse.conf"
install -Dm 644 vmware-vmx/extra/modules.xml "$pkgdir"/usr/lib/vmware/modules/modules.xml
install -Dm 644 vmware-installer/bootstrap "$pkgdir"/etc/vmware-installer/bootstrap
install -Dm 644 "$srcdir"/vmware-vix-bootstrap "$pkgdir"/etc/vmware-vix/bootstrap
install -Dm 644 "$srcdir"/vmware-bootstrap "$pkgdir"/etc/vmware/bootstrap
install -Dm 644 "$srcdir"/config "$pkgdir"/etc/vmware/config
if [ -z "$_remove_vmware_keymaps_dependency" ]; then
rm -r "$pkgdir/usr/lib/vmware/xkeymap" # these files are provided by vmware-keymaps package
fi
echo -e "vmw_vmci\nvmmon" > "$pkgdir/usr/lib/modules-load.d/vmware.conf"
for service_file in \
vmware-networks-configuration.service \
vmware-networks.service \
vmware-usbarbitrator.service \
vmware-networks.path \
vmware-usbarbitrator.path
do
install -Dm 644 \
"$srcdir/$service_file" \
"$pkgdir/usr/lib/systemd/system/$service_file"
done
# Apply permissions where necessary.
chmod +x \
"$pkgdir/usr/bin"/* \
"$pkgdir/usr/lib/vmware/bin"/* \
"$pkgdir/usr/lib/vmware/setup"/* \
"$pkgdir/usr/lib/vmware/lib"/libvmware-gksu.so/gksu-run-helper \
"$pkgdir/usr/lib/vmware-ovftool"/{ovftool,ovftool.bin} \
"$pkgdir/usr/lib/vmware-installer/$vmware_installer_version"/{vmware-installer,vmis-launcher} \
"$pkgdir/usr/lib/vmware-vix/setup"/*
chmod +s \
"$pkgdir/usr/bin"/vmware-authd \
"$pkgdir/usr/lib/vmware/bin"/{vmware-vmx,vmware-vmx-debug,vmware-vmx-stats}
# Add symlinks the installer would create.
for link in \
licenseTool \
vmplayer \
vmware \
vmware-app-control \
vmware-enter-serial \
vmware-fuseUI \
vmware-gksu \
vmware-modconfig \
vmware-modconfig-console \
vmware-mount \
vmware-netcfg \
vmware-setup-helper \
vmware-tray \
vmware-vmblock-fuse \
vmware-vprobe \
vmware-zenity
do
ln -s /usr/lib/vmware/bin/appLoader "$pkgdir/usr/lib/vmware/bin/$link"
done
for link in \
vmrest
do
ln -s /usr/lib/vmware/bin/appLoader "$pkgdir/usr/bin/$link"
done
for link in \
vmware-fuseUI \
vmware-mount \
vmware-netcfg \
vmware-usbarbitrator
do
ln -s /usr/lib/vmware/bin/$link "$pkgdir/usr/bin/$link"
done
ln -s /usr/lib/vmware/icu "$pkgdir/etc/vmware/icu"
ln -s /usr/lib/vmware-ovftool/ovftool "$pkgdir/usr/bin/ovftool"
ln -s /usr/lib/vmware-vix/libvixAllProducts.so "$pkgdir/usr/lib/libvixAllProducts.so"
# Replace placeholder "variables" with real paths.
for file in \
gtk-3.0/gdk-pixbuf.loaders
do
sed -i 's,@@LIBCONF_DIR@@,/usr/lib/vmware/libconf,g' "$pkgdir/usr/lib/vmware/libconf/etc/$file"
done
sed -i 's,@@BINARY@@,/usr/bin/vmware,' "$pkgdir/usr/share/applications/vmware-workstation.desktop"
sed -i 's,@@BINARY@@,/usr/bin/vmplayer,' "$pkgdir/usr/share/applications/vmware-player.desktop"
sed -i 's,@@BINARY@@,/usr/bin/vmware-netcfg,' "$pkgdir/usr/share/applications/vmware-netcfg.desktop"
sed \
-e "s/@@VERSION@@/$vmware_installer_version/" \
-e "s,@@VMWARE_INSTALLER@@,/usr/lib/vmware-installer/$vmware_installer_version," \
-i "$pkgdir/etc/vmware-installer/bootstrap"
# Patch up the VMware kernel sources and configure DKMS.
dkms_dir="$pkgdir/usr/src/$pkgname-$_pkgver"
rm -rf $dkms_dir/*
git clone https://github.com/mkubecek/vmware-host-modules.git --branch workstation-${_kmodver} $dkms_dir
rm -rf $dkms_dir/.git
install -Dm 644 "$srcdir/Makefile" "$dkms_dir/Makefile"
install -Dm 644 "$srcdir/dkms.conf.in" "$dkms_dir/dkms.conf"
sed \
-e "s/@PKGNAME@/$pkgname/g" \
-e "s/@PKGVER@/$_pkgver/g" \
-i "$dkms_dir/dkms.conf"
for module in vmmon vmnet; do
tar -xf "vmware-vmx/lib/modules/source/$module.tar" -C "$dkms_dir"
msg "Patching $module module for DKMS"
patch -p2 --read-only=ignore --directory="$dkms_dir/$module-only" < "$srcdir/$module.patch"
done
patch -p1 --read-only=ignore --directory="$dkms_dir/" < "$srcdir/linux6_15.patch"
patch -p1 --read-only=ignore --directory="$dkms_dir/" < "$srcdir/linux6_16.patch"
rm -r "$pkgdir/usr/lib/vmware/modules/source"
if [ -n "$_enable_macOS_guests" ]; then
msg "Patching VMware to enable macOS guest support"
python3 "$srcdir/unlocker.py" > /dev/null
for isoimage in ${_fusion_isoimages[@]}
do
install -Dm 644 "$srcdir/$isoimage.iso" "$pkgdir/usr/lib/vmware/isoimages/$isoimage.iso"
done
msg "Patching EFI firmwares to disable macOS server checking"
_efi_arch=("32" "64" "20-32" "20-64")
for arch in ${_efi_arch[@]}
do
uefipatch "$pkgdir/usr/lib/vmware/roms/EFI${arch}.ROM" "$srcdir/efi-patches.txt" -o "$pkgdir/usr/lib/vmware/roms/EFI${arch}.ROM" > /dev/null
done
fi
_create_database_file
# Define some environment variables for VMware and remove the tests about kernel modules
install -Dm 644 "$srcdir/vmware-environment.sh" "$pkgdir/etc/conf.d/vmware"
for program in vmware vmplayer vmware-tray; do
sed -e '/export PRODUCT_NAME/asource /etc/conf.d/vmware' \
-e 's/if "$BINDIR"\/vmware-modconfig --appname=.*/if true ||/' \
-i "$pkgdir/usr/bin/$program"
done
# Add StartupWMClass attribute to desktop files
sed -i '/^StartupNotify=.*/a StartupWMClass=vmware' "$pkgdir/usr/share/applications/vmware-workstation.desktop"
sed -i '/^StartupNotify=.*/a StartupWMClass=vmplayer' "$pkgdir/usr/share/applications/vmware-player.desktop"
sed -i '/^StartupNotify=.*/a StartupWMClass=vmware-netcfg' "$pkgdir/usr/share/applications/vmware-netcfg.desktop"
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 00:19:57 | Low | 3 |
| 2026-08-30 00:04:14 | Low | 3 |
| 2026-08-29 00:29:17 | Low | 3 |