xlibre-input-vmmouse-bin

maintainer xlibre · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from x11libre.net, which is a third-party host rather than the upstream GitHub repository (github.com/X11Libre) or an official Arch mirror. The binary is then extracted and installed directly into the package directory. While a sha256sum is provided, the trust anchor is the x11libre.net host itself — if that host is compromised or the binary is swapped, the checksum in the PKGBUILD would need to be updated to match, but users relying on cached PKGBUILDs would not notice. The core concern is that this installs an unverified prebuilt binary (an X input driver, which runs with elevated privileges in the X server) from a non-canonical host with no reproducibility guarantee or source build. XLibre is a real fork of X.Org, but distributing prebuilt binaries via a personal/project website rather than building from source is a genuine supply-chain risk pattern. This is a textbook medium: not clearly malicious, but a real concern due to executed binary from an unofficial host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://x11libre.net/repo/arch_based/x86_64/${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from x11libre.net, which is a third-party host rather than the upstream GitHub repository (github.com/X11Libre) or an official Arch mirror. The binary is then extracted and installed directly into the package directory. While a sha256sum is provided, the trust anchor is the x11libre.net host itself — if that host is compromised or the binary is swapped, the checksum in the PKGBUILD would need to be updated to match, but users relying on cached PKGBUILDs would not notice. The core concern is that this installs an unverified prebuilt binary (an X input driver, which runs with elevated privileges in the X server) from a non-canonical host with no reproducibility guarantee or source build. XLibre is a real fork of X.Org, but distributing prebuilt binaries via a personal/project website rather than building from source is a genuine supply-chain risk pattern. This is a textbook medium: not clearly malicious, but a real concern due to executed binary from an unofficial host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: artist for XLibre <artist4xlibre@proton.me>
    
      2
    
      3pkgname=xlibre-input-vmmouse-bin
    
      4_pkgname=xlibre-xf86-input-vmmouse
    
      5pkgver=13.2.0.3
    
      6pkgrel=1
    
      7pkgdesc="XLibre Official Easy Install Drop in Replacement fork of X.Org VMWare Mouse input driver (binary release)"
    
      8arch=(x86_64)
    
      9url="https://github.com/X11Libre"
    
      10license=('custom')
    
      11groups=('xlibre-drivers')
    
      12options=(!strip)
    
      13source=("https://x11libre.net/repo/arch_based/x86_64/${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
    
      14noextract=("${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
    
      15provides=('xlibre-input-vmmouse' 'xlibre-input-vmmouse')
    
      16conflicts=('xlibre-input-vmmouse' 'xlibre-input-vmmouse' 'xorg-server<21.1.1' 'X-ABI-XINPUT_VERSION<26' 'X-ABI-XINPUT_VERSION>=27')
    
      17
    
      18sha256sums=('2681ad462f63fa64f8b951747ff4b53c7118731768013c19f559d3ae04f5cac0')
    
      19
    
      20package() {
    
      21  tar -xf "${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst" -C "${pkgdir}" usr
    
      22}
    
      23
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2