xkeyboard-config-adnw

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD pulls a tarball (AdNW-xkc.tar.xz) from a personal domain (509.ch) with a non-SKIP checksum (sha512 is provided for it), so the content is at least pinned. However, 509.ch is not an official upstream host — it's a personal/unofficial server. The tarball's contents are then extracted directly into the package installation tree via 'tar xpf ... -C pkgdir/usr/share/X11/' which installs keyboard layout files (XKB data) into a system directory. XKB files are data files (text-based keyboard layout definitions), not compiled binaries or executed code, so the direct execution risk is low. However, the source is unofficial and personal, the domain could change ownership or content, and the SKIP on the .sig file (not the tarball itself) is standard practice. The sha512 for the tarball is present and non-SKIP, which mitigates the swappability concern somewhat. Overall this is a legitimate supply-chain concern (unofficial host for installed system files) but not a clear attack — medium severity is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 http://509.ch/AdNW-xkc.tar.xz)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD pulls a tarball (AdNW-xkc.tar.xz) from a personal domain (509.ch) with a non-SKIP checksum (sha512 is provided for it), so the content is at least pinned. However, 509.ch is not an official upstream host — it's a personal/unofficial server. The tarball's contents are then extracted directly into the package installation tree via 'tar xpf ... -C pkgdir/usr/share/X11/' which installs keyboard layout files (XKB data) into a system directory. XKB files are data files (text-based keyboard layout definitions), not compiled binaries or executed code, so the direct execution risk is low. However, the source is unofficial and personal, the domain could change ownership or content, and the SKIP on the .sig file (not the tarball itself) is standard practice. The sha512 for the tarball is present and non-SKIP, which mitigates the swappability concern somewhat. Overall this is a legitimate supply-chain concern (unofficial host for installed system files) but not a clear attack — medium severity is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Marc Straube <email@marcstraube.de>
    
      2# Maintainer: Andreas Radke <andyrtr@archlinux.org>
    
      3# Maintainer: Jan de Groot <jgc@archlinux.org>
    
      4
    
      5pkgname=xkeyboard-config-adnw
    
      6_pkgbase=xkeyboard-config
    
      7pkgver=2.29
    
      8pkgrel=1
    
      9pkgdesc="X keyboard configuration files with AdNW, AdNWzj, BU-Teck, KOY keymap variants."
    
      10arch=(any)
    
      11license=('custom')
    
      12url="https://www.freedesktop.org/wiki/Software/XKeyboardConfig"
    
      13makedepends=('intltool' 'xorg-xkbcomp' 'libxslt' 'python')
    
      14provides=('xkbdata' 'xkeyboard-config')
    
      15replaces=('xkbdata')
    
      16conflicts=('xkbdata' 'xkeyboard-config')
    
      17source=(https://xorg.freedesktop.org/archive/individual/data/${_pkgbase}/${_pkgbase}-${pkgver}.tar.bz2{,.sig}
    
      18        http://509.ch/AdNW-xkc.tar.xz)
    
      19validpgpkeys=('FFB4CCD275AAA422F5F9808E0661D98FC933A145')
    
      20validpgpkeys+=('15CFA5C595041D2CCBEA155F1732AA424A0E86B4') # "Sergey Udaltsov (For GNOME-related tasks) <svu@gnome.org>"
    
      21sha512sums=('202255af097f3063d76341d1b4a7672662dc645f9bcd7afa87bc966a41db4c20fc6b8f4fbe2fcaec99b6bc458eac10129141a866a165857c46282f6705b78670'
    
      22            'SKIP'
    
      23            '7016b9eb32b777c556c9874c5bad0f04111761223dfd7ede539df751e398f1ebabaf6381062d83c8ad1bd9b237575394dbc1f032d4518187ca62a45a8684f784')
    
      24
    
      25build() {
    
      26  cd ${_pkgbase}-${pkgver}
    
      27  ./configure --prefix=/usr \
    
      28      --with-xkb-base=/usr/share/X11/xkb \
    
      29      --with-xkb-rules-symlink=xorg \
    
      30      --enable-compat-rules=yes
    
      31  make
    
      32 }
    
      33 
    
      34 package() { 
    
      35  cd ${_pkgbase}-${pkgver}
    
      36
    
      37  make DESTDIR="${pkgdir}" install
    
      38  rm -f "${pkgdir}/usr/share/X11/xkb/compiled"
    
      39
    
      40  install -m755 -d "${pkgdir}/var/lib/xkb"
    
      41  install -m755 -d "${pkgdir}/usr/share/licenses/${_pkgbase}"
    
      42  install -m644 COPYING "${pkgdir}/usr/share/licenses/${_pkgbase}/"
    
      43
    
      44  tar xpf "${srcdir}/AdNW-xkc/xkb.tar" -C "${pkgdir}/usr/share/X11/"
    
      45  install -m644 "${srcdir}/AdNW-xkc/xkeyboard-config.mo" "${pkgdir}/usr/share/locale/de/LC_MESSAGES/xkeyboard-config.mo"
    
      46  install -m644 "${srcdir}/AdNW-xkc/xkeyboard-config.7" "${pkgdir}/usr/share/man/man7/xkeyboard-config.7"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2