huiontablet-frego

maintainer Morrowdust · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from driver.huion.cn (Huion's official Chinese driver CDN) outside of the source=() array, meaning makepkg's integrity checking (checksums) is completely bypassed. The downloaded file contains compiled binaries (huionCore, huiontablet, multiple .so libraries) that are directly installed and executed on the user's system. While driver.huion.cn is Huion's legitimate official driver distribution host, the absence of any checksum verification means: (1) if the remote file changes, no warning is given; (2) a MITM or server compromise would silently deliver malicious binaries. The caching check `if [ ! -f ... ]` also means a previously downloaded malicious file would be reused without re-verification. This is a genuine supply-chain concern — not because the host is suspicious, but because executed binaries are installed with zero integrity verification. This is a real medium-severity issue, not a false positive.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:23 curl -L -A "Mozilla/5.0" --referer "https://www.huion.cn/" \

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary .deb from driver.huion.cn (Huion's official Chinese driver CDN) outside of the source=() array, meaning makepkg's integrity checking (checksums) is completely bypassed. The downloaded file contains compiled binaries (huionCore, huiontablet, multiple .so libraries) that are directly installed and executed on the user's system. While driver.huion.cn is Huion's legitimate official driver distribution host, the absence of any checksum verification means: (1) if the remote file changes, no warning is given; (2) a MITM or server compromise would silently deliver malicious binaries. The caching check `if [ ! -f ... ]` also means a previously downloaded malicious file would be reused without re-verification. This is a genuine supply-chain concern — not because the host is suspicious, but because executed binaries are installed with zero integrity verification. This is a real medium-severity issue, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Morrowdust <morrowdust@qq.com>
    
      2
    
      3pkgname=huiontablet-frego
    
      4pkgver=15.0.0.C162
    
      5pkgrel=1
    
      6pkgdesc="Official Huion Tablet Frego Driver"
    
      7arch=('x86_64')
    
      8url="https://www.huion.com/download/"
    
      9license=('custom:LGPL')
    
      10depends=('libx11' 'libxext' 'libxrandr' 'libxtst' 'libxrender' 'libxkbcommon' 'libxcb' 'dbus' 'gcc-libs' 'xdotool')
    
      11options=('!strip' '!debug')
    
      12install=huiontablet-frego.install
    
      13
    
      14_debname="HuionTablet_LinuxDriver_v${pkgver}.${arch}.deb"
    
      15_deburl="https://driver.huion.cn/Driver/L310_L610_GS1333/${_debname}"
    
      16
    
      17prepare() {
    
      18    cd "$srcdir"
    
      19
    
      20    # Download deb package with required User-Agent and Referer headers
    
      21    if [ ! -f "$srcdir/${_debname}" ]; then
    
      22        msg2 "Downloading ${_debname}..."
    
      23        curl -L -A "Mozilla/5.0" --referer "https://www.huion.cn/" \
    
      24            -f -o "$srcdir/${_debname}" "${_deburl}"
    
      25    fi
    
      26
    
      27    # Extract the deb package
    
      28    if [ -f "$srcdir/${_debname}" ]; then
    
      29        msg2 "Extracting deb package..."
    
      30        bsdtar -xf "$srcdir/${_debname}" 2>/dev/null || true
    
      31
    
      32        # Extract the data tarball
    
      33        for tarball in data.tar.xz data.tar.gz data.tar.bz2; do
    
      34            if [ -f "$tarball" ]; then
    
      35                msg2 "Extracting $tarball..."
    
      36                bsdtar -xf "$tarball"
    
      37                break
    
      38            fi
    
      39        done
    
      40    fi
    
      41}
    
      42
    
      43package() {
    
      44    local src_data="$srcdir"
    
      45
    
      46    # Verify data directory exists
    
      47    if [ ! -d "$src_data/usr/lib/huiontablet" ]; then
    
      48        error "Huiontablet directory not found. Deb package extraction may have failed."
    
      49        return 1
    
      50    fi
    
      51
    
      52    # Install main application directory
    
      53    install -dm755 "$pkgdir/usr/lib/huiontablet"
    
      54    cp -a "$src_data/usr/lib/huiontablet/"* "$pkgdir/usr/lib/huiontablet/"
    
      55
    
      56    # Remove stale runtime PID and log files from the deb package
    
      57    rm -f "$pkgdir/usr/lib/huiontablet/.DriverUI.pid"
    
      58    rm -f "$pkgdir/usr/lib/huiontablet/.HuionCore.pid"
    
      59    rm -f "$pkgdir/usr/lib/huiontablet/.huion.log"
    
      60
    
      61    # Set executable permissions on binaries and scripts
    
      62    chmod 755 "$pkgdir/usr/lib/huiontablet/huionCore"
    
      63    chmod 755 "$pkgdir/usr/lib/huiontablet/huiontablet"
    
      64    chmod 755 "$pkgdir/usr/lib/huiontablet/huionCore.sh"
    
      65    chmod 755 "$pkgdir/usr/lib/huiontablet/huiontablet.sh"
    
      66    chmod 755 "$pkgdir/usr/lib/huiontablet/xdotool/xdotool"
    
      67
    
      68    # Set permissions on shared libraries
    
      69    find "$pkgdir/usr/lib/huiontablet/libs" -type f -name "*.so*" -exec chmod 755 {} \;
    
      70    find "$pkgdir/usr/lib/huiontablet/plugins" -type f -name "*.so" -exec chmod 755 {} \;
    
      71    find "$pkgdir/usr/lib/huiontablet/qml" -type f -name "*.so" -exec chmod 755 {} \;
    
      72
    
      73    # Install udev rules
    
      74    install -Dm644 "$src_data/usr/lib/udev/rules.d/20-huion.rules" \
    
      75        "$pkgdir/usr/lib/udev/rules.d/20-huion.rules"
    
      76
    
      77    # Install desktop entry
    
      78    install -Dm644 "$src_data/usr/share/applications/huiontablet.desktop" \
    
      79        "$pkgdir/usr/share/applications/huiontablet.desktop"
    
      80
    
      81    # Install icon
    
      82    install -Dm644 "$src_data/usr/share/icons/huiontablet.png" \
    
      83        "$pkgdir/usr/share/icons/huiontablet.png"
    
      84
    
      85    # Install autostart entry
    
      86    install -Dm644 "$src_data/etc/xdg/autostart/huiontablet.desktop" \
    
      87        "$pkgdir/etc/xdg/autostart/huiontablet.desktop"
    
      88
    
      89    # Install license
    
      90    install -Dm644 "$src_data/usr/lib/huiontablet/LGPL" \
    
      91        "$pkgdir/usr/share/licenses/huiontablet/LGPL"
    
      92}
    
      93

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2