vp
maintainer thatdude
· 2 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
This PKGBUILD installs prebuilt binaries (a Pascal IDE and compiler) extracted from a zip archive hosted on outpostbbs.net, which is not the official Virtual Pascal project host (vpascal.ning.com). The binaries are then made executable and symlinked into /usr/bin. The checksums (md5, sha1, sha256) are present and provide some integrity guarantee against tampering in transit, but they cannot verify that the binaries themselves are trustworthy or unmodified from the original upstream release — the source host is a third-party BBS file archive, not the official distribution point. Installing prebuilt, closed-source compiler/IDE binaries from an unofficial third-party host is a genuine supply-chain concern: if the file on outpostbbs.net was ever replaced or was never authentic, the checksums would simply reflect the malicious version. This is a classic medium-severity supply-chain risk: executed binaries from an unofficial host, not clearly malicious but not verifiably safe.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
source=("vp21b279.zip::http://outpostbbs.net/files/vp21b279.zip")
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt binaries (a Pascal IDE and compiler) extracted from a zip archive hosted on outpostbbs.net, which is not the official Virtual Pascal project host (vpascal.ning.com). The binaries are then made executable and symlinked into /usr/bin. The checksums (md5, sha1, sha256) are present and provide some integrity guarantee against tampering in transit, but they cannot verify that the binaries themselves are trustworthy or unmodified from the original upstream release — the source host is a third-party BBS file archive, not the official distribution point. Installing prebuilt, closed-source compiler/IDE binaries from an unofficial third-party host is a genuine supply-chain concern: if the file on outpostbbs.net was ever replaced or was never authentic, the checksums would simply reflect the malicious version. This is a classic medium-severity supply-chain risk: executed binaries from an unofficial host, not clearly malicious but not verifiably safe.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Declan Hoare <declanhoare at exemail dot com dot au>
2
pkgname=vp
3
pkgver=2.1.279
4
pkgrel=1
5
pkgdesc="Virtual Pascal IDE & compiler"
6
arch=('i686' 'x86_64')
7
url="http://vpascal.ning.com/"
8
license=('custom')
9
depends_i686=('glibc')
10
depends_x86_64=('lib32-glibc')
11
makedepends=('unrar')
12
options=('!strip')
13
backup=('opt/vp21/bin.lnx/vp.vpo')
14
source=("vp21b279.zip::http://outpostbbs.net/files/vp21b279.zip")
15
md5sums=('ed0ea436b15cba55c35f72ffbe87f26c')
16
sha1sums=('bcc679532668fae986fe9c194a5331cbb7863a29')
17
sha224sums=('6d23cb93787fb475f09cecfa3523fc5d2e690aa56b48869957178f93')
18
sha256sums=('786b4f5da3863ea4cedc614aaf94c90004dc67b7e1ae09d8c829a84199262ac9')
19
20
package() {
21
mkdir -pv "$pkgdir"/opt/vp21/common
22
mkdir -pv "$pkgdir"/opt/vp21/doc/os2
23
mkdir -pv "$pkgdir"/opt/vp21/{{bin,units,res}.{os2,w32,lnx},lib.{os2,w32,lnx}/defs}
24
mkdir -pv "$pkgdir"/opt/vp21/out.{os2,w32,lnx}/units
25
mkdir -pv "$pkgdir"/opt/vp21/examples/lnx
26
mkdir -pv "$pkgdir"/opt/vp21/examples/w32/{glide,gui,opengl/{metabls,pctwatch,shared,stencil}}
27
mkdir -pv "$pkgdir"/opt/vp21/examples/os2/{clock,dive,ea,flame,objclass}
28
mkdir -pv "$pkgdir"/opt/vp21/examples/os2/{os2exec,rexx,syslevel,triplex}
29
mkdir -pv "$pkgdir"/opt/vp21/examples/common/bp7/{breakout,tvdemo,tvfm}
30
mkdir -pv "$pkgdir"/opt/vp21/examples/common/{delphi,dll,memmgr,msgfltr}
31
mkdir -pv "$pkgdir"/opt/vp21/{examples/common/{ratrace,sort,test,testutil,touch,unrar},tests}
32
mkdir -pv "$pkgdir"/opt/vp21/source/{rtl/sys,os2,w32,lnx/{linklnx,pe2elf},tv,opro,demo}
33
mkdir -pv "$pkgdir"/usr/bin
34
unrar x -cl -r -o+ aidevph.rar \* "$pkgdir"/opt/vp21/common
35
unrar x -cl -r -o+ aidedoc.rar \* "$pkgdir"/opt/vp21/doc
36
unrar x -cl -r -o+ ovpbase.rar \* "$pkgdir"/opt/vp21/bin.os2
37
unrar x -cl -r -o+ ortlbin.rar \* "$pkgdir"/opt/vp21/units.os2
38
unrar x -cl -r -o+ oapilib.rar \* "$pkgdir"/opt/vp21/lib.os2
39
unrar x -cl -r -o+ oresbin.rar \* "$pkgdir"/opt/vp21/res.os2
40
unrar x -cl -r -o+ wvpbase.rar \* "$pkgdir"/opt/vp21/bin.w32
41
unrar x -cl -r -o+ wrtlbin.rar \* "$pkgdir"/opt/vp21/units.w32
42
unrar x -cl -r -o+ wapilib.rar \* "$pkgdir"/opt/vp21/lib.w32
43
unrar x -cl -r -o+ wresbin.rar \* "$pkgdir"/opt/vp21/res.w32
44
unrar x -cl -r -o+ lvpbase.rar \* "$pkgdir"/opt/vp21/bin.lnx
45
unrar x -cl -r -o+ lrtlbin.rar \* "$pkgdir"/opt/vp21/units.lnx
46
unrar x -cl -r -o+ lapilib.rar \* "$pkgdir"/opt/vp21/lib.lnx
47
unrar x -cl -r -o+ lresbin.rar \* "$pkgdir"/opt/vp21/res.lnx
48
unrar x -cl -r -o+ oapivph.rar \* "$pkgdir"/opt/vp21/common
49
unrar x -cl -r -o+ oapiinf.rar \* "$pkgdir"/opt/vp21/doc/os2
50
unrar x -cl -r -o+ oexmpsrc.rar \* "$pkgdir"/opt/vp21/examples/os2
51
unrar x -cl -r -o+ wexmpsrc.rar \* "$pkgdir"/opt/vp21/examples/w32
52
unrar x -cl -r -o+ lexmpsrc.rar \* "$pkgdir"/opt/vp21/examples/lnx
53
unrar x -cl -r -o+ artlvph.rar \* "$pkgdir"/opt/vp21/common
54
unrar x -cl -r -o+ artlsrc.rar \* "$pkgdir"/opt/vp21/source/rtl
55
unrar x -cl -r -o+ ortlsrc.rar \* "$pkgdir"/opt/vp21/source/os2
56
unrar x -cl -r -o+ wrtlsrc.rar \* "$pkgdir"/opt/vp21/source/w32
57
unrar x -cl -r -o+ lrtlsrc.rar \* "$pkgdir"/opt/vp21/source/lnx
58
unrar x -cl -r -o+ aexmpsrc.rar \* "$pkgdir"/opt/vp21/examples/common
59
unrar x -cl -r -o+ testsrc.rar \* "$pkgdir"/opt/vp21/examples/tests
60
unrar x -cl -r -o+ atvsrc.rar \* "$pkgdir"/opt/vp21/source/tv
61
unrar x -cl -r -o+ op130vp.rar \* "$pkgdir"/opt/vp21/source/opro
62
unrar x -cl -r -o+ ox130vp.rar \* "$pkgdir"/opt/vp21/source/opro/demo
63
unrar x -cl -r -o+ oh130vp.rar \* "$pkgdir"/opt/vp21/common
64
chmod +x "$pkgdir"/opt/vp21/bin.lnx/*
65
chmod 666 "$pkgdir"/opt/vp21/bin.lnx/vp.vpo # VP needs write permissions on this file
66
sed -i "s|\\\|\/|g" "$pkgdir"/opt/vp21/bin.lnx/vp.vpo
67
sed -i "s|{BASEDIR}|/opt/vp21|g" "$pkgdir"/opt/vp21/bin.lnx/vp.vpo
68
ln -s /opt/vp21/bin.lnx/pe2elf "$pkgdir"/usr/bin/pe2elf
69
ln -s /opt/vp21/bin.lnx/vp "$pkgdir"/usr/bin/vp
70
ln -s /opt/vp21/bin.lnx/vpc "$pkgdir"/usr/bin/vpc
71
install -D -m644 licence.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
72
}
73
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |