das-keyboard-q

maintainer xiota · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from an AWS S3 bucket (das-keyboard-q-releases.s3.us-east-2.amazonaws.com) rather than from the official daskeyboard.io domain. While this S3 bucket appears to be the vendor's own release bucket (the bucket name 'das-keyboard-q-releases' and path structure suggest official use), it is not the canonical project website and S3 buckets can be misconfigured or taken over. A sha256 checksum is present, which mitigates substitution risk for the specific version, but the binary is an Electron-based application (evidenced by the dependency list: libdrm, mesa, nss, nspr, at-spi2-core, etc.) that executes with significant privileges and udev rules. The PKGBUILD does take reasonable precautions: it disables shell scripts bundled in the package and installs a placeholder udev rules file. However, the core concern remains: this is an unverified prebuilt binary from a non-canonical host with no GPG signature verification, only a hash. The risk is real but not clearly malicious — consistent with a medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("$_pkgsrc.$_pkgext"::"https://das-keyboard-q-releases.s3.us-east-2.amazonaws.com/das-keyboard-q/linux/x64/das-keyboard-q_${pkgver}_amd64.$_pkgext")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from an AWS S3 bucket (das-keyboard-q-releases.s3.us-east-2.amazonaws.com) rather than from the official daskeyboard.io domain. While this S3 bucket appears to be the vendor's own release bucket (the bucket name 'das-keyboard-q-releases' and path structure suggest official use), it is not the canonical project website and S3 buckets can be misconfigured or taken over. A sha256 checksum is present, which mitigates substitution risk for the specific version, but the binary is an Electron-based application (evidenced by the dependency list: libdrm, mesa, nss, nspr, at-spi2-core, etc.) that executes with significant privileges and udev rules. The PKGBUILD does take reasonable precautions: it disables shell scripts bundled in the package and installs a placeholder udev rules file. However, the core concern remains: this is an unverified prebuilt binary from a non-canonical host with no GPG signature verification, only a hash. The risk is real but not clearly malicious — consistent with a medium rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:
    
      2
    
      3_pkgname="das-keyboard-q"
    
      4pkgname="$_pkgname"
    
      5pkgver=4.3.0
    
      6pkgrel=1
    
      7pkgdesc="Software for Das Keyboard 5Q, 5Qs, 4Q"
    
      8url="https://www.daskeyboard.io/get-started/software/"
    
      9license=('LicenseRef-Unknown')
    
      10arch=('x86_64')
    
      11
    
      12options=('!debug')
    
      13
    
      14_pkgsrc="$_pkgname-$pkgver"
    
      15_pkgext="deb"
    
      16source=("$_pkgsrc.$_pkgext"::"https://das-keyboard-q-releases.s3.us-east-2.amazonaws.com/das-keyboard-q/linux/x64/das-keyboard-q_${pkgver}_amd64.$_pkgext")
    
      17sha256sums=('1a065d5ebd751d26ef96a957e051274fba0bb10df43596b1edd70deafbacd319')
    
      18
    
      19package() {
    
      20  depends+=(
    
      21    alsa-lib
    
      22    at-spi2-core
    
      23    bash
    
      24    cairo
    
      25    dbus
    
      26    expat
    
      27    glib2
    
      28    gtk3
    
      29    libcups
    
      30    libdrm
    
      31    libx11
    
      32    libxcb
    
      33    libxcomposite
    
      34    libxdamage
    
      35    libxext
    
      36    libxfixes
    
      37    libxkbcommon
    
      38    libxrandr
    
      39    mesa
    
      40    nspr
    
      41    nss
    
      42    pango
    
      43  )
    
      44
    
      45  tar xf data.tar.zst -C "$pkgdir"
    
      46
    
      47  install -Dm644 "$pkgdir/usr/lib/das-keyboard-q/resources/extra_resources/scripts/70-daskeyboard.rules" -t "$pkgdir/usr/lib/udev/rules.d/"
    
      48
    
      49  # unwanted
    
      50  rm -rf "$pkgdir"/usr/share/{doc,lintian}
    
      51
    
      52  # disable scripts
    
      53  for i in "$pkgdir/usr/lib/das-keyboard-q/resources/extra_resources/scripts"/*.sh; do
    
      54    install -Dm755 /dev/stdin "$i" << END
    
      55#!/usr/bin/env sh
    
      56
    
      57# This script was disabled during packaging.
    
      58# Notify the package maintainers if there are any problems.
    
      59END
    
      60  done
    
      61
    
      62  # may still be needed, based on contents of createRules.sh
    
      63  install -Dm644 /dev/stdin "$pkgdir"/etc/udev/rules.d/99-daskeyboard.rules << END
    
      64# Do not edit this file.  It will be overwritten when aur/das-keyboard-q is upgraded.
    
      65#
    
      66# The purpose of this file is to prevent das-keyboard-q from creating incorrect rules.
    
      67# The real rules are at /usr/lib/udev/rules.d/70-daskeyboard.rules
    
      68END
    
      69
    
      70  # permissions, remove sticky bit
    
      71  chmod -R u+rwX,go+rX,go-ws,u-s "$pkgdir/"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2