Review Results

Comment

This change only updates .SRCINFO metadata, removing the install script entry and narrowing arch from any to x86_64. By itself it does not introduce code execution, network access, privilege escalation, or other security-sensitive behavior. The missing install script reference is worth noting for packaging correctness, but there is no evidence in this diff of a malicious payload or persistence mechanism.

@@ -3,8 +3,7 @@ pkgbase = virtualbox-ext-oracle
 	pkgver = 7.2.12
 	pkgrel = 1
 	url = https://www.virtualbox.org/
-	install = virtualbox-ext-oracle.install
-	arch = any
+	arch = x86_64
 	license = custom:PUEL
 	depends = virtualbox=7.2.12
 	optdepends = rdesktop: client to connect vm via RDP

Comment

The change is low risk overall. It removes the .install script entirely, so there is no new post-install root execution surface. The PKGBUILD still downloads the official Oracle Extension Pack over HTTPS from the upstream VirtualBox domain, and the checksum remains pinned. The packaging changes mainly relocate files into /usr/lib/virtualbox/ExtensionPacks and create a license symlink, which are normal packaging actions. One thing to note is that the new prepare() uses tar extraction with a fixed set of members from the upstream .vbox-extpack archive and then edits ExtPack.manifest with sed. That is still operating on trusted upstream content and does not introduce network access or command execution. I do not see evidence of privilege escalation, persistence, or supply-chain tampering in this diff.

@@ -1,34 +1,34 @@
 # Maintainer: Sébastien Luttringer
+# Maintainer: Christian Hesse <mail@eworm.de>
 
 pkgname=virtualbox-ext-oracle
 pkgver=7.2.12
 _filever="${pkgver}"
 pkgrel=1
 pkgdesc='Oracle VM VirtualBox Extension Pack'
-arch=('any')
+arch=('x86_64')
 url='https://www.virtualbox.org/'
 license=('custom:PUEL')
 depends=("virtualbox=${pkgver}")
 optdepends=('rdesktop: client to connect vm via RDP')
 options=('!strip')
-install=virtualbox-ext-oracle.install
-source=("https://download.virtualbox.org/virtualbox/${pkgver}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
+source=("https://download.virtualbox.org/virtualbox/${_filever}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
 noextract=("Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack")
 sha256sums=('ac461d67462e06a9e16e8b96623c1b1a8c692c7f78e3566584b47e2d2e533f76')
 
 prepare() {
-  # shrink uneeded cpuarch
-  [[ -d shrunk ]] || mkdir shrunk
-  tar xfC "Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack" shrunk
-  rm -r shrunk/{darwin*,solaris*,win*}
-  tar -c --gzip --file shrunk.vbox-extpack -C shrunk .
+  mkdir Oracle_VirtualBox_Extension_Pack/
+  tar --no-same-owner --one-top-level='Oracle_VirtualBox_Extension_Pack/' \
+    -xzf "${srcdir}/Oracle_VirtualBox_Extension_Pack-${_filever}.vbox-extpack" \
+    ./linux.amd64 ./ExtPack{-license.{html,rtf,txt},.manifest,.signature,.xml} ./PXE-Intel.rom
+  sed -in "/\(ExtPack-\|linux\.amd64\)/p" Oracle_VirtualBox_Extension_Pack/ExtPack.manifest
 }
 
 package() {
-  install -Dm 644 shrunk.vbox-extpack \
-    "$pkgdir/usr/share/virtualbox/extensions/Oracle_VirtualBox_Extension_Pack-${pkgver}.vbox-extpack"
-  install -Dm 644 shrunk/ExtPack-license.txt \
-    "$pkgdir/usr/share/licenses/${pkgname}/PUEL"
-}
+  install -d "${pkgdir}"/usr/lib/virtualbox/ExtensionPacks/
+  mv Oracle_VirtualBox_Extension_Pack/ "${pkgdir}"/usr/lib/virtualbox/ExtensionPacks/
 
-# vim:set ts=2 sw=2 et:
+  install -d "${pkgdir}/usr/share/licenses/${pkgname}/"
+  ln -s ../../../lib/virtualbox/ExtensionPacks/Oracle_VirtualBox_Extension_Pack/ExtPack-license.txt \
+    "${pkgdir}/usr/share/licenses/${pkgname}/license.txt"
+}