@JedPhillips: When you click the download link on their website, it directs you to the .works URL, so my guess is it's their CDN. In any case, the downloads are verified with ExpressVPN's release signing key, so unless makepkg fails to validate the files, you can either assume they're genuine, or that ExpressVPN has leaked the private key, someone has made their own spoof packages, AND hijacked the .com website to make the download link point to a site hosting the spoof packages, AND they've been keeping up this charade since September 2021 (which is when the .works URL replaced the old .xyz URL) without anyone noticing on ExpressVPN's side. I'm not saying the latter is impossible, but it's incredibly unlikely. ;)
If you are genuinely worried about the downloads, please contact ExpressVPN support for clarification on why the downloads are served from the .works URL. All we can provide here is speculation.
Pinned Comments
paintie commented on 2020-07-28 21:16 (UTC)
Info from expressvpn's site ...
wget https://www.expressvpn.com/expressvpn_release_public_key_0xAFF2A1415F6A3A38.asc
gpg --import expressvpn_release_public_key_0xAFF2A1415F6A3A38.asc
All installed fine; thank you very much for maintaining.
WorMzy commented on 2019-11-06 13:15 (UTC)
Looks like update notifications are working for the linux client now, but unfortunately the current version (2.3.2) thinks it's an older version (2.3.1 -- check
expressvpn --version
), so the update alert people get when they runexpressvpn status
may be a false positive.Please check what version is reported at https://www.expressvpn.com/latest (or https://www.expressvpn.com/support/troubleshooting/china-status/#linux as this sometimes gets updates listed sooner) before flagging the package as out-of-date.
WorMzy commented on 2019-01-11 11:38 (UTC) (edited on 2019-01-23 20:41 (UTC) by WorMzy)
Please note that, from v2.0.0, ExpressVPN will be providing signed Arch packages on their website (alongside the deb and rpm packages). I'll be continuing to update this package, but for those that find using the AUR cumbersome or just don't want to wait, please be aware of this option.
EDIT: packages were delayed for testing, but seem to be live as of 2019-01-23.