xlibre-input-void-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:13 source=(https://x11libre.net/repo/arch_based/x86_64/xlibre-input-void-1.4.2.3-1-x86_64.pkg.tar.zst)

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from x11libre.net, which is a third-party host not affiliated with the official X.Org or Arch Linux infrastructure. The binary is an X input driver (xf86-input-void) that will be installed into the system and loaded by the X server, meaning any malicious code in it would execute with X server privileges. XLibre is a real fork of X.Org that exists, but x11libre.net is not an established, widely-trusted distribution channel — it's a personal/project host with no independent verification beyond the single SHA256 checksum provided in the PKGBUILD itself. The checksum only protects against accidental corruption or a one-time substitution check at review time; if the host is compromised or the file is silently replaced, future installs would fetch whatever is there. The package also uses noextract and manually tars out only the 'usr' directory, bypassing pacman's normal package verification. This is a genuine supply-chain concern: an executed binary (X driver) from an unofficial third-party host with no GPG signature verification, no reproducible build, and no tie to a trusted mirror network.