xp-pen-tablet

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:15 source=("XPPenLinux${pkgver}-${_vendor_rel}.deb::https://download01.xp-pen.com/file/2026/04/XPPenLinux${pkgver}-${_vendor_rel}.deb")

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb package from download01.xp-pen.com, which is the official XP-Pen vendor download server (consistent with their official download page at xp-pen.com/download). The package extracts and installs proprietary closed-source binaries and shared libraries directly into the system. The sha512sum is present and pins the specific binary, which mitigates silent substitution risk somewhat. However, the core concern remains: this is a closed-source, prebuilt binary blob from a vendor CDN host — if that host were compromised or the binary were backdoored, the checksum would not help (it only verifies the file hasn't changed in transit, not that the binary is safe). The package installs executables, .so libraries, a shell wrapper (PenTablet.sh), udev rules, systemd user services, and tmpfiles.d config — a broad attack surface if the binary were malicious. The sed modification to PenTablet.sh is benign (adds TMPDIR logic). The chown/chmod operations are reasonable hardening. This is a standard pattern for proprietary hardware driver packaging in the AUR (similar to wacom, huion, etc.), and download01.xp-pen.com is a known official XP-Pen distribution endpoint. The medium rating is appropriate: not clearly malicious, but installing unauditable closed-source binaries from a vendor CDN is an inherent supply-chain risk that cannot be fully mitigated.