huion-tablet-h610prov2

maintainer anya-desdein · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from driverdl.huion.com, which is the official Huion vendor download domain (not a personal or unofficial host). The sha256sum is present and pins the specific binary. However, the package installs multiple prebuilt executables (huiontablet, huionCore, bundled xdotool) extracted from that .deb directly into the system — these are closed-source, unauditable binaries running with user privileges and udev rules granting broad input device access (MODE:=0666). The risk is not that the host is unofficial (it is the legitimate vendor CDN), but that the package installs opaque prebuilt binaries with no source build, and the sha256 provides only integrity against the current file, not against future substitution or a compromised vendor server. This is a standard medium-risk pattern for proprietary vendor driver packages in the AUR: real supply-chain concern (executed closed-source binaries from a vendor CDN), but not an active attack or clearly malicious pattern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("https://driverdl.huion.com/driver/Linux/HuionTablet_LinuxDriver_v${pkgver}.x86_64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from driverdl.huion.com, which is the official Huion vendor download domain (not a personal or unofficial host). The sha256sum is present and pins the specific binary. However, the package installs multiple prebuilt executables (huiontablet, huionCore, bundled xdotool) extracted from that .deb directly into the system — these are closed-source, unauditable binaries running with user privileges and udev rules granting broad input device access (MODE:=0666). The risk is not that the host is unofficial (it is the legitimate vendor CDN), but that the package installs opaque prebuilt binaries with no source build, and the sha256 provides only integrity against the current file, not against future substitution or a compromised vendor server. This is a standard medium-risk pattern for proprietary vendor driver packages in the AUR: real supply-chain concern (executed closed-source binaries from a vendor CDN), but not an active attack or clearly malicious pattern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: BABEL (Anya Desdein)
    
      2# Contributor: Ported from Debian package v15.0.0.175
    
      3
    
      4# Ensure UTF-8 so bsdtar can handle pathnames with non-ASCII characters (e.g. Chinese in res/DevImg)
    
      5export LC_ALL=C.UTF-8
    
      6export LANG=C.UTF-8
    
      7
    
      8pkgname=huion-tablet-h610prov2
    
      9pkgver=15.0.0.175
    
      10pkgrel=2
    
      11pkgdesc="Huion Tablet Driver Setting Software (requires X11)"
    
      12arch=('x86_64')
    
      13url="https://www.huion.com"
    
      14license=('ISC' 'custom:Huion')
    
      15options=('!debug') #comment that if you need debug symbols
    
      16provides=('huion')
    
      17conflicts=('huiontablet')
    
      18depends=('qt5-base' 'qt5-declarative' 'qt5-quickcontrols' 'libx11' 'libxext' 'libxrender' 'libxrandr' 'dbus' 'systemd-libs')
    
      19install=huion-tablet-h610prov2.install
    
      20source=("https://driverdl.huion.com/driver/Linux/HuionTablet_LinuxDriver_v${pkgver}.x86_64.deb"
    
      21        "huiontablet-launch.sh")
    
      22sha256sums=('bcf4d9263f2a82e942c79929a89d9841adef527febf91c43027ab3311f2c3ede'
    
      23            'd4a7faa8a401382b7da065b2bb56877057eb882a5ea066e52db593ed52b1f27b')
    
      24
    
      25prepare() {
    
      26    cd "$srcdir"
    
      27    
    
      28    # Extract the .deb file that contains:
    
      29    # - debian-binary (version info)
    
      30    # - control.tar.xz (metadata and scripts)
    
      31    # - data.tar.xz (actual files)
    
      32    ar x "HuionTablet_LinuxDriver_v${pkgver}.x86_64.deb"
    
      33    
    
      34    # Extract data archive
    
      35    tar -xf data.tar.*
    
      36    
    
      37    # Use our launch script (fixes false "already running", quieter, stderr -> log)
    
      38    cp -f huiontablet-launch.sh usr/lib/huiontablet/huiontablet.sh
    
      39}
    
      40
    
      41package() {
    
      42    cd "$srcdir"
    
      43
    
      44    install -dm755 "$pkgdir/opt/huiontablet"
    
      45    cp -r usr/lib/huiontablet/* "$pkgdir/opt/huiontablet/"
    
      46
    
      47    install -dm755 "$pkgdir/opt/huiontablet/share/icons"
    
      48    install -m644 usr/share/icons/huiontablet.png "$pkgdir/opt/huiontablet/share/icons/"
    
      49
    
      50    install -dm755 "$pkgdir/usr/lib/udev/rules.d"
    
      51    install -m644 usr/lib/udev/rules.d/20-huion.rules "$pkgdir/usr/lib/udev/rules.d/"
    
      52    # H610 Pro v2 and similar use different input device names; without these, EventGet=-1
    
      53    echo '' >> "$pkgdir/usr/lib/udev/rules.d/20-huion.rules"
    
      54    echo '# H610 Pro v2 and similar (Huion Huion Tablet Pen / Huion Tablet)' >> "$pkgdir/usr/lib/udev/rules.d/20-huion.rules"
    
      55    echo 'SUBSYSTEM=="input", KERNEL=="event*", ATTRS{name}=="HUION Huion Tablet Pen", MODE:="0666"' >> "$pkgdir/usr/lib/udev/rules.d/20-huion.rules"
    
      56    echo 'SUBSYSTEM=="input", KERNEL=="event*", ATTRS{name}=="HUION Huion Tablet", MODE:="0666"' >> "$pkgdir/usr/lib/udev/rules.d/20-huion.rules"
    
      57
    
      58    install -dm755 "$pkgdir/usr/bin"
    
      59    ln -s /opt/huiontablet/huiontablet.sh "$pkgdir/usr/bin/huiontablet"
    
      60
    
      61    # Fix permissions for executables
    
      62    chmod +x "$pkgdir/opt/huiontablet/huiontablet"
    
      63    chmod +x "$pkgdir/opt/huiontablet/huionCore"
    
      64    chmod +x "$pkgdir/opt/huiontablet/huiontablet.sh"
    
      65    chmod +x "$pkgdir/opt/huiontablet/huionCore.sh"
    
      66
    
      67    # Fix permissions for bundled xdotool
    
      68    if [ -f "$pkgdir/opt/huiontablet/xdotool/xdotool" ]; then
    
      69        chmod +x "$pkgdir/opt/huiontablet/xdotool/xdotool"
    
      70    fi
    
      71
    
      72    # Remove temporary files that shouldn't be in the package
    
      73    rm -f "$pkgdir/opt/huiontablet/.DriverUI.pid"
    
      74    rm -f "$pkgdir/opt/huiontablet/.huion.log"
    
      75    rm -f "$pkgdir/opt/huiontablet/.HuionCore.pid"
    
      76
    
      77    # Remove incompatible bundled libraries - use system libraries instead
    
      78    echo "Removing incompatible bundled libraries..."
    
      79    rm -f "$pkgdir/opt/huiontablet/libs/libdbus-1.so.3"
    
      80    rm -f "$pkgdir/opt/huiontablet/libs/libsystemd.so.0"
    
      81
    
      82    # Allow users to write HUION_*.cfg (user config) in res/; binary has no XDG/config option
    
      83    chmod 777 "$pkgdir/opt/huiontablet/res"
    
      84
    
      85    install -dm755 "$pkgdir/usr/share/applications"
    
      86    sed -e 's|/usr/lib/huiontablet/|/opt/huiontablet/|g' \
    
      87        -e 's|/usr/share/icons/huiontablet.png|/opt/huiontablet/share/icons/huiontablet.png|g' \
    
      88        usr/share/applications/huiontablet.desktop > "$pkgdir/usr/share/applications/huiontablet.desktop"
    
      89}
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2