huiontablet

maintainer jhon · 15 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary driver tarball from driverdl.huion.com, which is Huion's official driver distribution domain (the same domain referenced from huion.com/download/). The sha256sum is pinned, which mitigates substitution risk at download time. However, the tarball contains prebuilt binary blobs (a Linux driver) that are then installed by executing install.sh (itself extracted from the tarball and modified via sed). Executing a binary blob and a shell script from a vendor CDN — even an official one — is a genuine supply-chain concern: if the domain or CDN were compromised, arbitrary code would execute during the build. This is the standard pattern for proprietary hardware driver AUR packages (e.g. nvidia-installer style), which are conventionally rated medium. The PKGBUILD itself is not malicious, the host appears to be the legitimate vendor domain, and the checksum is pinned, but the executed binary nature of the payload keeps this at medium rather than clean/low.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://driverdl.huion.com/driver/Linux/HuionTablet_LinuxDriver_v$pkgver.$arch.tar.xz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary driver tarball from driverdl.huion.com, which is Huion's official driver distribution domain (the same domain referenced from huion.com/download/). The sha256sum is pinned, which mitigates substitution risk at download time. However, the tarball contains prebuilt binary blobs (a Linux driver) that are then installed by executing install.sh (itself extracted from the tarball and modified via sed). Executing a binary blob and a shell script from a vendor CDN — even an official one — is a genuine supply-chain concern: if the domain or CDN were compromised, arbitrary code would execute during the build. This is the standard pattern for proprietary hardware driver AUR packages (e.g. nvidia-installer style), which are conventionally rated medium. The PKGBUILD itself is not malicious, the host appears to be the legitimate vendor domain, and the checksum is pinned, but the executed binary nature of the payload keeps this at medium rather than clean/low.

PKGBUILD

1 offending line(s) highlighted

      1
    
      2# Maintainer: Wai <waicool20@gmail.com>
    
      3pkgname=huiontablet
    
      4pkgver=15.0.0.162
    
      5pkgrel=1
    
      6pkgdesc="Official Huion tablet drivers"
    
      7arch=('x86_64')
    
      8url="https://www.huion.com/download/"
    
      9license=('unknown')
    
      10source=("https://driverdl.huion.com/driver/Linux/HuionTablet_LinuxDriver_v$pkgver.$arch.tar.xz")
    
      11sha256sums=("7066b75c613aabbf8cf1a57ea54910a4f62245ddb8986aa01aef300e0b2de87d")
    
      12
    
      13prepare() {
    
      14  cd "${srcdir}"
    
      15
    
      16  # Modify install script with our dirs
    
      17  sed -E -i "s|(sysRuleDir=).*|\1$pkgdir/usr/lib/udev/rules.d|" install.sh
    
      18  sed -E -i "s|(sysAppDir=).*|\1$pkgdir/usr/lib/|" install.sh
    
      19  sed -E -i "s|(sysDesktopDir=).*|\1$pkgdir/usr/share/applications|" install.sh
    
      20  sed -E -i "s|(sysAppIconDir=).*|\1$pkgdir/usr/share/icons|" install.sh
    
      21  sed -E -i "s|(sysAutoStartDir=).*|\1$pkgdir/etc/xdg/autostart|" install.sh
    
      22
    
      23  # Remove problematic commands
    
      24  sed -E -i "s|killall.*||" install.sh
    
      25  sed -E -i "s|sudo ||g" install.sh
    
      26  sed -E -i "/^.*uninstall.*$/d" install.sh
    
      27  sed -E -i "/^.*close.*$/d" install.sh
    
      28  sed -E -i "/^echo.*$/d" install.sh
    
      29  sed -E -i "s|/usr/lib/huiontablet/res|$pkgdir\0|" install.sh
    
      30
    
      31  # Remove stuff after this line
    
      32  sed -E -i "/#Copy config files/Q" install.sh
    
      33
    
      34  # Remove files with problematic UTF-8 characters
    
      35  find . -name "*按键*" -delete 2>/dev/null || true
    
      36}
    
      37
    
      38package() {
    
      39	cd "${srcdir}"
    
      40
    
      41  # Make directories
    
      42  grep "sys.*Dir=" install.sh | sed -E 's/.*=(.*)/\1/' | tr -d '"' | xargs mkdir -p
    
      43
    
      44  # Set proper locale for UTF-8 handling
    
      45  export LC_ALL=C.UTF-8
    
      46
    
      47  # Invoke install script
    
      48	sh install.sh
    
      49}
    
      50
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2