pantum_driver

maintainer maxx1302 · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary driver bundle (a .deb containing compiled binaries/libraries for CUPS and SANE) from pantum.com (the official Pantum vendor website), extracts it, and installs the binaries directly into the system. The host is the official vendor's global website, not a personal or unofficial mirror, which reduces supply-chain risk compared to a random third-party host. However: (1) the checksum is SKIP'd, meaning there is no integrity verification whatsoever — if the upstream file is replaced or the download is intercepted, malicious binaries would be installed silently; (2) prebuilt proprietary binaries are being installed into /usr/lib without any source build, which is an inherent trust-the-vendor situation. The combination of SKIP'd checksum and executed prebuilt binaries from a vendor host is a real (if moderate) supply-chain concern — not clearly malicious, but not clean either. The medium rating from the cheaper model is appropriate here.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 "https://global.pantum.com/global/wp-content/uploads/2017/03/Pantum-Ubuntu-Driver-V1-1-5.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary driver bundle (a .deb containing compiled binaries/libraries for CUPS and SANE) from pantum.com (the official Pantum vendor website), extracts it, and installs the binaries directly into the system. The host is the official vendor's global website, not a personal or unofficial mirror, which reduces supply-chain risk compared to a random third-party host. However: (1) the checksum is SKIP'd, meaning there is no integrity verification whatsoever — if the upstream file is replaced or the download is intercepted, malicious binaries would be installed silently; (2) prebuilt proprietary binaries are being installed into /usr/lib without any source build, which is an inherent trust-the-vendor situation. The combination of SKIP'd checksum and executed prebuilt binaries from a vendor host is a real (if moderate) supply-chain concern — not clearly malicious, but not clean either. The medium rating from the cheaper model is appropriate here.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=pantum_driver
    
      2pkgver="1.1.5"
    
      3pkgrel="0.1"
    
      4pkgdesc="Pantum M6200-M6500-M6550-M6600-MS6000 Series LINUX Driver V1.1.5"
    
      5arch=('x86_64' 'x86' 'i686' 'i386' 'arm' "aarch64")
    
      6license=('proprietary')
    
      7depends=('sane' 'cups')
    
      8source=(
    
      9    "https://global.pantum.com/global/wp-content/uploads/2017/03/Pantum-Ubuntu-Driver-V1-1-5.tar.gz"
    
      10)
    
      11
    
      12md5sums=(
    
      13    'SKIP'
    
      14)
    
      15
    
      16#noextract=("aeskulap_0.2.2b1-11_amd64.deb" "libdcmtk2_3.6.0-12_amd64.deb" "libwrap0_7.6.q-25_amd64.deb")
    
      17
    
      18extract_deb()
    
      19{
    
      20	ar p $1 data.tar.xz | tar xJ
    
      21}
    
      22
    
      23build()
    
      24{
    
      25    # extract them all under the base /usr dir inside of the source folder
    
      26    #extract_deb "aeskulap_0.2.2b1-11_amd64.deb"
    
      27    #extract_deb "libdcmtk2_3.6.0-12_amd64.deb"
    
      28    #extract_deb "libwrap0_7.6.q-25_amd64.deb"
    
      29    cd "./Pantum Ubuntu Driver V$pkgver/Resources"
    
      30
    
      31    mkdir -p pkg
    
      32    cd ./pkg
    
      33    #extract_deb "../Pantum-M6500-Series-3.0.$arch.deb"
    
      34    extract_deb "../pantum-$pkgver-amd64.deb"
    
      35
    
      36
    
      37}
    
      38
    
      39package()
    
      40{
    
      41    # go into the package folder and copy the /usr into the root
    
      42    cd ${pkgdir}
    
      43    cp -r "${srcdir}/Pantum Ubuntu Driver V$pkgver/Resources/pkg/"* .
    
      44
    
      45
    
      46    # move this into that
    
      47    rm -r usr/lib64
    
      48    cd usr/lib
    
      49    #mv -u $arch-linux-gnu/* .
    
      50    cp -a $arch-linux-gnu/* . 
    
      51    rm -r *-linux-gnu*
    
      52}
    
      53
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2