activdriver

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from activsoftware.co.uk, which is not Promethean's primary domain (prometheanworld.com). However, activsoftware.co.uk appears to be a long-standing Promethean-affiliated distribution mirror used by multiple AUR packages for Promethean products (activinspire, activtools, activdriver), suggesting it is a legitimate vendor-operated host rather than a random third-party. The .deb contains compiled kernel module source and a binary (activlc) that are built and installed. The MD5 checksum provides minimal integrity protection. The real concern is that activsoftware.co.uk is not the canonical vendor domain, so if it were compromised or the package swapped, malicious kernel code or binaries could be executed. This is a genuine supply-chain concern (non-primary vendor host serving compiled/executable content including kernel modules), keeping it at medium rather than clean, though it is likely a legitimate vendor mirror.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("http://activsoftware.co.uk/linux/repos/driver/ubuntu/pool/oss/a/$pkgname/${pkgname}_$pkgver-0~Ubuntu~1804_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt .deb from activsoftware.co.uk, which is not Promethean's primary domain (prometheanworld.com). However, activsoftware.co.uk appears to be a long-standing Promethean-affiliated distribution mirror used by multiple AUR packages for Promethean products (activinspire, activtools, activdriver), suggesting it is a legitimate vendor-operated host rather than a random third-party. The .deb contains compiled kernel module source and a binary (activlc) that are built and installed. The MD5 checksum provides minimal integrity protection. The real concern is that activsoftware.co.uk is not the canonical vendor domain, so if it were compromised or the package swapped, malicious kernel code or binaries could be executed. This is a genuine supply-chain concern (non-primary vendor host serving compiled/executable content including kernel modules), keeping it at medium rather than clean, though it is likely a legitimate vendor mirror.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Malstrond <malstrond@gmail.com>
    
      2# Contributor: Jose Riha <jose1711@gmail.com>
    
      3# Contributor: Bazon <bazonbloch@arcor.de> 
    
      4# Contributor: Christian Bühler <christian@cbuehler.de>
    
      5# Contributor: Zsolt Udvari <udvzsolt@gmail.com>
    
      6
    
      7pkgname=activdriver
    
      8pkgver=5.18.19
    
      9pkgrel=0
    
      10pkgdesc="Drivers for Promethean hardware"
    
      11arch=('x86_64')
    
      12url="https://support.prometheanworld.com/product/activdriver"
    
      13license=('unknown')
    
      14makedepends=('linux-headers>=5.0.1.arch1-1')
    
      15optdepends=('activinspire: Prometheans presentation software'
    
      16            'activtools: Tools for Promethean hardware, e.g. calibration or systray monitor')
    
      17install=$pkgname.install
    
      18source=("http://activsoftware.co.uk/linux/repos/driver/ubuntu/pool/oss/a/$pkgname/${pkgname}_$pkgver-0~Ubuntu~1804_amd64.deb"
    
      19        "activdriver.install")
    
      20md5sums=('4200e2d39c40b817e1fe3768f19b4cb3'
    
      21         '8a8a6ddd6741a80a5839593ed385cd9a')
    
      22
    
      23prepare() {
    
      24  # Extract the source
    
      25  bsdtar -xf data.tar.xz
    
      26 
    
      27  # Patch the makefile of activlc so it doesn't try to get its includes from an absoulte path outside the build chroot
    
      28  sed -i "s%KERN_INC = /usr/src/promethean%KERN_INC = ..%" usr/src/promethean/activlc/Makefile
    
      29  
    
      30  # Patch promethean.sh to not use absolute paths to /usr/local, which isn't used in Arch
    
      31  sed -i s%/usr/local/bin/%%g usr/bin/promethean.sh
    
      32  
    
      33  # Patch usbpromethean.c to be compatible with this kernel change: https://lkml.org/lkml/2019/1/4/418
    
      34  # If are building on kernel versions <=4.19, remove these 2 lines
    
      35  sed -i  s%VERIFY_WRITE,%%g usr/src/promethean/kernel/usbpromethean.c
    
      36  sed -i  s%VERIFY_READ,%%g usr/src/promethean/kernel/usbpromethean.c
    
      37  
    
      38   # Remove files relating to HAL, which was deprecated by Arch almost a decade ago
    
      39  rm -r usr/share/hal
    
      40  
    
      41  # The driver includes two duplicate X configuration files and this path isn't used in Arch
    
      42  rm -r usr/lib/X11/xorg.conf.d
    
      43}
    
      44
    
      45
    
      46build() {
    
      47  echo " "
    
      48  echo "Attention!"
    
      49  echo "This build will fail if run in a directory with space(s) in its path due to an error in the upstream makefile."
    
      50  echo " "
    
      51  make -C /lib/modules/$(uname -r)/build M="$srcdir"/usr/src/promethean/kernel modules
    
      52  BUILD=release make -C usr/src/promethean/activlc
    
      53}
    
      54
    
      55package() {
    
      56  mkdir -p "$pkgdir"/usr 
    
      57  cp -r etc lib "$pkgdir"
    
      58  cp -r usr/bin usr/lib usr/share "$pkgdir"/usr
    
      59  install -D usr/src/promethean/activlc/release/activlc "$pkgdir"/usr/bin/activlc
    
      60  
    
      61  # Set the module directory and install module
    
      62  _moddir="/usr/lib/modules/$(</usr/src/linux/version)/extramodules/kernel/drivers/input/tablet"
    
      63  install -m644 -D usr/src/promethean/kernel/promethean.ko "$pkgdir${_moddir}"/promethean.ko
    
      64  find "${pkgdir}" -name '*.ko' -exec gzip -9 {} \;
    
      65
    
      66  # Use /usr/lib instead of /lib to match Arch packaging standards
    
      67  mv "${pkgdir}"/lib/* "${pkgdir}"/usr/lib/ 
    
      68  rmdir "${pkgdir}"/lib
    
      69
    
      70  # Load module on boot. 
    
      71  # If you don't want this, delete the following 2 lines.
    
      72  mkdir -p "$pkgdir"/etc/modules-load.d
    
      73  echo "promethean" > "$pkgdir"/etc/modules-load.d/promethean.conf
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2