zenvpn

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from app.zenvpn.net (the official ZenVPN application download endpoint) with sha256sums='SKIP', meaning no integrity verification is performed on the downloaded binary. The binary daemon 'zenvpnd' is extracted and installed to /usr/lib/zenvpn/, and node_modules native binaries are also installed. While app.zenvpn.net appears to be the legitimate vendor's own distribution host (not a personal/unofficial host), the use of 'SKIP' for the checksum means any compromise or substitution of the upstream binary would go undetected. This is a genuine supply-chain concern: a VPN client daemon running with elevated privileges (it uses iproute2, libpcap, systemd units) with no integrity verification. The pattern is common for 'latest' rolling download URLs but still represents a real risk. Not high because there is no evidence of malicious intent or actual substitution, and the host is the vendor's own infrastructure.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("${pkgname}-x86_64.deb::https://app.zenvpn.net/downloads/linux/amd64/latest/")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): This PKGBUILD downloads a prebuilt binary .deb from app.zenvpn.net (the official ZenVPN application download endpoint) with sha256sums='SKIP', meaning no integrity verification is performed on the downloaded binary. The binary daemon 'zenvpnd' is extracted and installed to /usr/lib/zenvpn/, and node_modules native binaries are also installed. While app.zenvpn.net appears to be the legitimate vendor's own distribution host (not a personal/unofficial host), the use of 'SKIP' for the checksum means any compromise or substitution of the upstream binary would go undetected. This is a genuine supply-chain concern: a VPN client daemon running with elevated privileges (it uses iproute2, libpcap, systemd units) with no integrity verification. The pattern is common for 'latest' rolling download URLs but still represents a real risk. Not high because there is no evidence of malicious intent or actual substitution, and the host is the vendor's own infrastructure.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_electron=25
    
      4_Name="ZenVPN"
    
      5pkgname="${_Name,,}"
    
      6pkgver=1.2.26
    
      7pkgrel=1
    
      8pkgdesc="ZenVPN client"
    
      9arch=('x86_64')
    
      10url="https://zenvpn.net"
    
      11license=('custom:Proprietary')
    
      12depends=("electron${_electron}" 'glibc' 'iproute2' 'libpcap' 'sh')
    
      13makedepends=('dpkg')
    
      14source=("${pkgname}.sh")
    
      15source_x86_64=("${pkgname}-x86_64.deb::https://app.zenvpn.net/downloads/linux/amd64/latest/")
    
      16noextract=("${source_x86_64[@]%%::*}")
    
      17sha256sums=('f38be1d4f732d1dcf1b9705431de6f3eaae0e1616e81bc4f9cf7b566416545ca')
    
      18sha256sums_x86_64=('SKIP')
    
      19
    
      20prepare() {
    
      21  cd "${srcdir}"
    
      22  sed -e "s/@electronversion@/${_electron}/g" \
    
      23      -e "s/@appname@/${pkgname}/g" \
    
      24      -e "s/@runname@/app.asar/g" \
    
      25      -e "s/@cfgdirname@/${_Name}/g" \
    
      26      -e "s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g" \
    
      27      -i "${pkgname}.sh"
    
      28
    
      29  local _pkgver="$(dpkg-deb --show --showformat='${Version}' "${pkgname}-${CARCH}.deb" | tr - _)"
    
      30  dpkg-deb --extract "${pkgname}-${CARCH}.deb" "${pkgname}-${_pkgver}-${CARCH}"
    
      31
    
      32  cd "${pkgname}-${_pkgver}-${CARCH}/usr/lib/${pkgname}"
    
      33  local target_electron="$(cat version)"
    
      34  if [[ "${target_electron%%.*}" != "${_electron}" ]]; then
    
      35    echo "  ==> ERROR: Electron version mismatch! Expected: '${_electron}', actual: '${target_electron%%.*}'" >&2
    
      36    exit 1
    
      37  fi
    
      38
    
      39  patchelf --replace-needed 'libpcap.so.0.8' 'libpcap.so' "zenvpnd"
    
      40}
    
      41
    
      42pkgver() {
    
      43  cd "${srcdir}"
    
      44  # shellcheck disable=SC2016
    
      45  dpkg-deb --show --showformat='${Version}' "${pkgname}-${CARCH}.deb" | tr - _
    
      46}
    
      47
    
      48package() {
    
      49  cd "${srcdir}"
    
      50  install -vDm755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      51
    
      52  cd "${srcdir}/${pkgname}-${pkgver}-${CARCH}/usr/lib"
    
      53  find "systemd" -type f -exec \
    
      54    install -vDm644 "{}" "${pkgdir}/usr/lib/{}" \;
    
      55
    
      56  cd "${pkgname}"
    
      57  find "resources/app.asar.unpacked/node_modules" -type d \( -name 'darwin-*' -o -name 'win32-*' \) -exec \
    
      58    rm -rf "{}" +
    
      59  find . -type f -name '*.bash' -delete
    
      60
    
      61  install -vDm755 "zenvpnd" "${pkgdir}/usr/lib/${pkgname}/zenvpnd"
    
      62  cp -vrL "resources"/* "${pkgdir}/usr/lib/${pkgname}"
    
      63
    
      64  # not used?
    
      65  # cd "${srcdir}/${pkgname}-${pkgver}-${CARCH}/usr/local"
    
      66  # find "bin" -type f -exec \
    
      67  #   install -vDm755 "{}" "${pkgdir}/usr/{}" \;
    
      68
    
      69  cd "${srcdir}/${pkgname}-${pkgver}-${CARCH}/usr/share"
    
      70  rm -rf "doc" "lintian"
    
      71  find . -type f -exec \
    
      72    install -vDm644 "{}" "${pkgdir}/usr/share/{}" \;
    
      73
    
      74  cd "${pkgdir}/usr/lib/${pkgname}/assets"
    
      75  ln -vsf "${_Name}.png" "${pkgname}.png"
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2