x2goserver

maintainer leoneii · 12 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source URL uses code.x2go.org, a non-whitelisted host, but it is the project's official Git and release infrastructure; the download is of the project's own source code, which is then built locally, a normal and safe AUR practice.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URL uses code.x2go.org, a non-whitelisted host, but it is the project's official Git and release infrastructure; the download is of the project's own source code, which is then built locally, a normal and safe AUR practice.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:86 source=(https://code.x2go.org/releases/source/${pkgname}/${pkgname}-${pkgver}.tar.gz{,.asc}

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:146 chmod 750 "${pkgdir}"/etc/sudoers.d
PKGBUILD:147 chmod 0440 "${pkgdir}"/etc/sudoers.d/x2goserver
PKGBUILD:141 chmod 2755 "${pkgdir}"/usr/lib/x2go/libx2go-server-db-sqlite3-wrapper
PKGBUILD:144 chmod 2755 "${pkgdir}"/usr/bin/x2goprint

PKGBUILD

5 offending line(s) highlighted

      1# Maintainer: AndyRTR <andyrtr@archlinux.org>
    
      2
    
      3# Contributor: Gerhard Brauer <gerbra@archlinux.de>
    
      4# Contributor: Richard Murri <admin@richardmurri.com>
    
      5# Contributor: Markus Opitz <mastero23 at gmail dot com>
    
      6# Contributor: Milan Knížek <knizek@volny.cz>
    
      7
    
      8pkgname=x2goserver
    
      9pkgver=4.1.0.6
    
      10pkgrel=1
    
      11pkgdesc="Open source graphical Remote Desktop and terminal server based on NX technology"
    
      12arch=('x86_64')
    
      13url="https://www.x2go.org/"
    
      14license=('GPL2')
    
      15# https://code.x2go.org/gitweb?p=x2goserver.git;a=blob;f=x2goserver.spec
    
      16
    
      17# from 4.0.1.20 changelog there could be new deps on bash, xkeyboard-config, perl-cwd-guard
    
      18
    
      19depends=(
    
      20         'openssh'
    
      21         'nxagent' # FS#67024
    
      22         # certain shell script hardcode bash
    
      23         'bash'
    
      24         # for x2goruncommand - for now
    
      25         'bc'
    
      26         # for ss in x2gogetfreeport 
    
      27        'iproute'
    
      28         # for x2goshowblocks
    
      29         'lsof'
    
      30         # For killall in x2gosuspend-session
    
      31         'psmisc'
    
      32         # For x2godbadmin
    
      33         'pwgen' # in community
    
      34         # For printing, file-sharing
    
      35         'sshfs'
    
      36	 # for /etc/sudoers.d
    
      37         'sudo'
    
      38         'which'
    
      39         # For /etc/X11/Xresources
    
      40         'xorg-xinit' 
    
      41         'inetutils' # FS#68276
    
      42         'xorg-fonts-misc'
    
      43         'xorg-xauth'
    
      44         'xkeyboard-config'
    
      45         'xorg-xwininfo' # FS#38558
    
      46         'xorg-setxkbmap' # FS#53345
    
      47
    
      48         # for useradd/groupadd
    
      49         'shadow'
    
      50
    
      51         # for filemanager bindings
    
      52         'desktop-file-utils'
    
      53         'shared-mime-info'
    
      54         'xdg-utils'
    
      55
    
      56         # We need a database
    
      57         'perl-dbd-sqlite' 
    
      58
    
      59         'perl-capture-tiny'
    
      60         'perl-config-simple'
    
      61         'perl-file-basedir' # FS#38551
    
      62         'perl-file-which' # FS#44125
    
      63         'perl-switch'
    
      64         'perl-try-tiny' # FS#58226
    
      65 #        'perl-file-readbackwards' ?
    
      66
    
      67         'dbus'
    
      68)
    
      69#makedepends=('man2html' 'perl-extutils-makemaker' 'systemd')
    
      70makedepends=('man2html' 'perl-extutils-makemaker' 'systemd' 
    
      71             # only needed for file system paths
    
      72             'sudo'
    
      73)
    
      74optdepends=('perl-dbd-pg: Postgres support')
    
      75#conflicts=('x2go-agent')
    
      76#replaces=('x2go-agent')
    
      77#provides=('x2go-agent' 'x2goagent')
    
      78options=('emptydirs')
    
      79install=x2goserver.install
    
      80backup=('etc/x2go/x2goserver.conf'
    
      81        'etc/x2go/desktopsharing/settings'
    
      82        # from old x2go-agent pkg now provided here
    
      83        etc/x2go/{keystrokes.cfg,x2goagent.keyboard,x2goagent.options}
    
      84)
    
      85# no https due to invalid certificate
    
      86source=(https://code.x2go.org/releases/source/${pkgname}/${pkgname}-${pkgver}.tar.gz{,.asc}
    
      87       tmpfiles.d
    
      88       sysusers.d
    
      89       reproducible-man-gzip.patch)
    
      90sha256sums=('9c585f683996f0670aad3b118a1d98783ec897ef32add9b4c9e4e63ecf7b7c24'
    
      91            'SKIP'
    
      92            '548d48925171aeca198494236cfba7232921a25a1c4c81f5d004a734d83d1350'
    
      93            '04d429e8d8fe02c8078d75ba63ba57774274df877b2c6ec942621312b7bf9118'
    
      94            '2d52a5ca28d5b65a9cc9bd8cdc74d030d7faddb6d727d2df520686934ea125fb')
    
      95validpgpkeys=('1AD23D1B8F087A35AB74BDE9F4A7678C9C6B0B2B') # X2go Git Administrator <git-admin@x2go.org>
    
      96
    
      97prepare() {
    
      98  cd ${pkgname}-${pkgver}
    
      99  # -r option does not exist in Arch linux
    
      100  # (However, html man pages do not get installed anyway...)
    
      101  for Makefile in $(find . -type f -name Makefile); do
    
      102    sed -i 's@(MAN2HTML_BIN) -r @(MAN2HTML_BIN) < @g' $Makefile
    
      103    sed -i 's@ \$(MAN2HTML_SRC)/@ < \$(MAN2HTML_SRC)/@g' $Makefile
    
      104  done
    
      105
    
      106  # fix some Makefile permission options
    
      107  for Makefile in $(find . -type f -name Makefile); do
    
      108    sed -i "s:-o root -g root ::g" $Makefile
    
      109  done
    
      110  # Do not ship xsession - Debian specific
    
      111  sed -i -e '/xsession/s/^/#/' Makefile
    
      112
    
      113  # remove timestamp to solve reproducible build
    
      114  patch -Np1 -i ../reproducible-man-gzip.patch
    
      115}
    
      116
    
      117build() {
    
      118  cd ${pkgname}-${pkgver}
    
      119  make PREFIX=/usr SBINDIR=/usr/bin DESTDIR="$pkgdir" PERL_INSTALLDIRS=vendor
    
      120}
    
      121
    
      122package() {
    
      123  cd ${pkgname}-${pkgver}
    
      124  make -j1 PREFIX=/usr SBINDIR=/usr/bin DESTDIR="$pkgdir" install
    
      125
    
      126  # systemd files
    
      127  install -Dm 644 "$srcdir/${pkgname}-${pkgver}/x2goserver.service" "$pkgdir/usr/lib/systemd/system/x2goserver.service"
    
      128  # overwrite upstream systemd tmofile "x /tmp/.x2go-*" with ours
    
      129  cat ../tmpfiles.d >> "${pkgdir}"/usr/lib/tmpfiles.d/x2goserver.conf
    
      130  install -Dm644 ../sysusers.d "${pkgdir}"/usr/lib/sysusers.d/x2goserver.conf
    
      131  
    
      132  # load fuse module at system start
    
      133  install -dm755 "$pkgdir"/usr/lib/modules-load.d
    
      134  echo "fuse" > "$pkgdir"/usr/lib/modules-load.d/x2goserver.conf
    
      135
    
      136  install -dm 755 "${pkgdir}/usr/share/doc/${pkgname}"
    
      137  install -m 644 "ChangeLog" "${pkgdir}/usr/share/doc/${pkgname}/"
    
      138
    
      139  # fix permission - see INSTALL file
    
      140  chown root:111 "${pkgdir}"/usr/lib/x2go/libx2go-server-db-sqlite3-wrapper
    
      141  chmod 2755 "${pkgdir}"/usr/lib/x2go/libx2go-server-db-sqlite3-wrapper
    
      142  
    
      143  chown root:112 "${pkgdir}"/usr/bin/x2goprint
    
      144  chmod 2755 "${pkgdir}"/usr/bin/x2goprint
    
      145  
    
      146  chmod 750 "${pkgdir}"/etc/sudoers.d
    
      147  chmod 0440 "${pkgdir}"/etc/sudoers.d/x2goserver
    
      148
    
      149  # Arch offer logcheck package - http://logcheck.org/
    
      150  rm -r "${pkgdir}"/etc/logcheck
    
      151}
    
      152

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3