spacecontrol

maintainer lod · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer shell script (SpaceControl_Driver_293_LNX64_setup.sh) directly from spacecontrol.de, which is the vendor's own website for the SpaceControl 3D mouse product. The script is executed with --noexec --keep flags to extract its payload rather than run it as an installer, and the extracted binaries (sc_daemon, proc_observer, kill_processes, libspc_ctrl_64.so) are then installed. The b2sum for the installer script is provided, which mitigates substitution risk at download time. However, the core concern remains: prebuilt closed-source binaries (native executables and a shared library) are being pulled from a vendor host and installed directly — this is a legitimate medium-severity supply-chain concern because there is no way to verify the binaries' contents beyond the checksum, and the vendor host is not a widely-audited distribution channel. The SpaceBridge git source uses SKIP for its checksum, meaning any upstream change would go undetected. This is consistent with a MEDIUM rating: it is the vendor's own product distributed from their own domain (not a random personal host), but the use of opaque prebuilt binaries with no source build path is a real, if common, supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=(https://spacecontrol.de/download/drivers/SpaceControl_Driver_293_LNX64_setup.sh

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer shell script (SpaceControl_Driver_293_LNX64_setup.sh) directly from spacecontrol.de, which is the vendor's own website for the SpaceControl 3D mouse product. The script is executed with --noexec --keep flags to extract its payload rather than run it as an installer, and the extracted binaries (sc_daemon, proc_observer, kill_processes, libspc_ctrl_64.so) are then installed. The b2sum for the installer script is provided, which mitigates substitution risk at download time. However, the core concern remains: prebuilt closed-source binaries (native executables and a shared library) are being pulled from a vendor host and installed directly — this is a legitimate medium-severity supply-chain concern because there is no way to verify the binaries' contents beyond the checksum, and the vendor host is not a widely-audited distribution channel. The SpaceBridge git source uses SKIP for its checksum, meaning any upstream change would go undetected. This is consistent with a MEDIUM rating: it is the vendor's own product distributed from their own domain (not a random personal host), but the use of opaque prebuilt binaries with no source build path is a real, if common, supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lod <aur@cyber-anlage.de>
    
      2
    
      3pkgname=spacecontrol
    
      4pkgver=2.9.3
    
      5pkgrel=1
    
      6pkgdesc="SpaceControl 3D Mouse Driver for Linux, creates a virtual device compatible with spacenavd for broad system use."
    
      7arch=('x86_64')
    
      8url="https://spacecontrol.de"
    
      9license=('LicenseRef-SpaceControl-EULA')
    
      10depends=(bash gcc-libs glibc hicolor-icon-theme java-runtime libx11 libxtst python python-evdev sh spacenavd)
    
      11makedepends=(git)
    
      12options=('!debug' '!emptydirs')
    
      13source=(https://spacecontrol.de/download/drivers/SpaceControl_Driver_293_LNX64_setup.sh
    
      14        git+https://github.com/lodriguez/SpaceBridge.git
    
      15        99-spacecontrol-usb-ftdi-unbind.rules
    
      16        sc_gui.sh
    
      17        sc_daemon.sh
    
      18        SpaceControl-Panel.desktop
    
      19        sc-daemon.service)
    
      20b2sums=('8bdd596aa234ccc15569c0ba97c9801f3cb04c4111d889366b6eeec831f8c52162a4d83b378bb479ea8e8627ff2cf625eeb740d0fcf4307963a49cc1a1fd7862'
    
      21        'SKIP'
    
      22        'ded37e320d3afb49bb5705273e21d1d117e6ece1ed5b59d0245d0f95437e706f4de2b13ab2a1642b1e812a9db956403b43353f3e7b39d0206ef23e597466865b'
    
      23        'ed8929d44eecfbe62b0f5bfaf0911e919c920d8248b7c363fe18038fa320b540554ab78ed014c2477c0875908aa70b352036b61800385ab5711d531bcf28940a'
    
      24        'cf0b4c0538d0d8079936cca93262fecc3fe0d6c452cab422bf03988cc705ee63a8de84d0b7a888434813b17bb12aa670c9a61ac0aff4888e8287256ee83f13e1'
    
      25        'c097d1d8d4c0a5775e97259c7acbab8e6cb3f737995afc8da2b60247ae292aad48aea4eea9c2aafa8e88fbfcc014366624e0cca4c7ef44fc8ca91c0d1041043b'
    
      26        '8b978b7ec447ca8b0a3cfae70ef263e894740be16d082dba36b929050cc0ba28be1c95838d0105cc631c0a992a25c6492bd242b68c0e9bdcdc195c46b5c57e47')
    
      27
    
      28package() {
    
      29  sh SpaceControl_Driver_293_LNX64_setup.sh --target "$srcdir/$pkgname" --noexec --nox11 --keep --nodiskspace
    
      30  
    
      31  cd "$srcdir/$pkgname"
    
      32  
    
      33  install -d "$pkgdir/usr/lib/udev/rules.d/"
    
      34  install -d "$pkgdir/usr/bin/"
    
      35  install -d "$pkgdir/usr/lib/$pkgname/"
    
      36  install -d "$pkgdir/usr/share/doc/$pkgname/"
    
      37  install -d "$pkgdir/usr/share/applications/"
    
      38  
    
      39  install -Dm644 {SC_GUI.jar,vks.ini,buildno.txt,translations_de.txt,sc_logo_splash.png} "$pkgdir/usr/lib/$pkgname/"
    
      40  install -Dm755 {sc_daemon,proc_observer,kill_processes} "$pkgdir/usr/lib/$pkgname/"
    
      41
    
      42  install -Dm755 ../sc_daemon.sh "$pkgdir/usr/bin/sc_daemon"
    
      43  install -Dm755 ../sc_gui.sh "$pkgdir/usr/bin/sc_gui"
    
      44  
    
      45  cp -r {cfgs,lib} "$pkgdir/usr/lib/$pkgname/"
    
      46  
    
      47  cp -r doc/* "$pkgdir/usr/share/doc/$pkgname/"
    
      48  ln -s "../../share/doc/$pkgname" "$pkgdir/usr/lib/spacecontrol/doc"
    
      49
    
      50  install -Dm644 lib/libspc_ctrl_64.so.2.9.2 "$pkgdir/usr/lib/$pkgname/lib/libspc_ctrl.so"
    
      51  install -Dm644 ../99-spacecontrol-usb-ftdi-unbind.rules "$pkgdir/usr/lib/udev/rules.d/"
    
      52  install -Dm644 ../SpaceControl-Panel.desktop "$pkgdir/usr/share/applications/"
    
      53  install -Dm644 src/pics/sc512.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/spacecontrol.png"
    
      54  
    
      55  install -Dm644 doc/license_en.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE.en"
    
      56  install -Dm644 doc/license_de.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE.de"
    
      57  
    
      58  install -Dm644 ../sc-daemon.service "$pkgdir/usr/lib/systemd/user/sc-daemon.service"
    
      59  
    
      60  install -Dm755 ../SpaceBridge/SpaceBridge.py "$pkgdir/usr/lib/spacecontrol/spacebridge.py"
    
      61  install -Dm644 ../SpaceBridge/spacebridge.service "$pkgdir/usr/lib/systemd/user/spacebridge.service"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2