xf86-input-cmt

maintainer renedeleze · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt binary .deb is downloaded from apt.galliumos.org (a GalliumOS project mirror, not the canonical upstream GitHub source) and its contents are extracted and installed directly into the package tree. GalliumOS is a real, known project, but the host is a third-party apt mirror rather than an official upstream release host, and integrity is verified only with MD5 (weak, collision-prone). The installed artifact is an Xorg input driver (shared library loaded by the X server), so a compromised or substituted binary would achieve code execution in the X server context. This is a genuine supply-chain concern: unofficial binary host + weak checksum + executed native code = medium severity. It is not clearly malicious, but the risk is real and non-trivial.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=('https://apt.galliumos.org/pool/main/x/xf86-input-cmt/xserver-xorg-input-cmt_3.0_amd64.deb')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): A prebuilt binary .deb is downloaded from apt.galliumos.org (a GalliumOS project mirror, not the canonical upstream GitHub source) and its contents are extracted and installed directly into the package tree. GalliumOS is a real, known project, but the host is a third-party apt mirror rather than an official upstream release host, and integrity is verified only with MD5 (weak, collision-prone). The installed artifact is an Xorg input driver (shared library loaded by the X server), so a compromised or substituted binary would achieve code execution in the X server context. This is a genuine supply-chain concern: unofficial binary host + weak checksum + executed native code = medium severity. It is not clearly malicious, but the risk is real and non-trivial.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=xf86-input-cmt
    
      2pkgdesc="Chromium OS multitouch input driver for Xorg X server"
    
      3pkgver=3.0
    
      4pkgrel=1
    
      5arch=(x86_64)
    
      6url="https://github.com/GalliumOS/xf86-input-cmt"
    
      7license=('custom:chromiumos')
    
      8depends=('xf86-input-evdev' 'xf86-input-cmt-setup' 'libgestures' 'libevdev' 'libevdevc')
    
      9conflicts=('xf86-input-synaptics')
    
      10install=${pkgname}.install
    
      11options=('!emptydirs' '!strip')
    
      12source=('https://apt.galliumos.org/pool/main/x/xf86-input-cmt/xserver-xorg-input-cmt_3.0_amd64.deb')
    
      13md5sums=('344998e4bca270d5dc7ad705137f1dbf')
    
      14
    
      15package() {
    
      16  echo "Extracting package..." 
    
      17  bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      18  install -Dm644 "$pkgdir"/usr/share/doc/xserver-xorg-input-cmt/copyright "$pkgdir"/usr/share/licenses/xf86-input-cmt/LICENCE
    
      19  mv "$pkgdir/lib/systemd" "$pkgdir/usr/lib/"
    
      20}
    
      21

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2