xppenlinux-v3

LOW

maintainer labaman 9 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a tarball from the official vendor's domain (xp-pen.com), which is the project's legitimate release infrastructure; despite the non-standard URL format, this is a normal and expected source for an official driver, and the checksum is provided and matches, making the risk low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official vendor's domain (xp-pen.com), which is the project's legitimate release infrastructure; despite the non-standard URL format, this is a normal and expected source for an official driver, and the checksum is provided and matches, making the risk low.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("XPPenLinux${pkgver}-${_vendor_rel}.tar.gz::https://www.xp-pen.com/download/file/id/2901/pid/68/ext/gz.html")

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:36 chmod 2775 "${pkgdir}/usr/lib/pentablet/conf/xppen"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Mikhail Velichko <efklid at gmail dot com>
    
      2# Contributor: Mikata Riko <sanbikappa at qq dot com>
    
      3
    
      4pkgname=xppenlinux-v3
    
      5pkgver=3.4.9
    
      6_vendor_rel=240607
    
      7pkgrel=${_vendor_rel}.2
    
      8pkgdesc="XP-Pen (Official) Linux utility for legacy XPPen Tablets"
    
      9arch=('x86_64')
    
      10url='https://www.xp-pen.com/download/index.html'
    
      11license=('custom')
    
      12conflicts=('xp-pen-tablet' 'xppenlinux3')
    
      13source=("XPPenLinux${pkgver}-${_vendor_rel}.tar.gz::https://www.xp-pen.com/download/file/id/2901/pid/68/ext/gz.html")
    
      14install=${pkgname}.install
    
      15
    
      16sha512sums=('40598c05d5ada0bd7a874b943e7819d6ffd0ef79d77e7433f814cfdc885846cc49276e1162e082bfe03f76b17f095323abfb8d5108f444cd30a685a0e0826ca4')
    
      17
    
      18prepare() {
    
      19       #https://wiki.archlinux.org/title/Users_and_groups#Pre-systemd_groups
    
      20       #use udev uaccess for device permission
    
      21       cat <<EOF >$srcdir/XPPenLinux${pkgver}-${_vendor_rel}/App/lib/udev/rules.d/10-xp-pen.rules
    
      22KERNEL=="uinput",SUBSYSTEMS=="misc",MODE="0660",TAG+="uaccess",OPTIONS+="static_node=uinput"
    
      23SUBSYSTEMS=="usb",ATTRS{idVendor}=="28bd",MODE="0660",TAG+="uaccess"
    
      24EOF
    
      25}
    
      26
    
      27package() {
    
      28       cp -r $srcdir/XPPenLinux${pkgver}-${_vendor_rel}/App/* $pkgdir
    
      29       cp -r $pkgdir/lib/* $pkgdir/usr/lib
    
      30       rm -r $pkgdir/lib
    
      31       # per-user tempdir for manual launches (.desktop -> PenTablet.sh): keep Qt's
    
      32       # single-instance socket+lockfile in /run/user/UID so parallel logins don't collide
    
      33       # on a shared /tmp lockfile. The systemd service sets TMPDIR=%t; ${TMPDIR:-...} respects it.
    
      34       sed -i '/export LD_LIBRARY_PATH/a if [ -n "$XDG_RUNTIME_DIR" ]; then export TMPDIR="${TMPDIR:-$XDG_RUNTIME_DIR}"; fi' "${pkgdir}/usr/lib/pentablet/PenTablet.sh"
    
      35       chown root:users "${pkgdir}/usr/lib/pentablet/conf/xppen"
    
      36       chmod 2775 "${pkgdir}/usr/lib/pentablet/conf/xppen"
    
      37       chown root:users "${pkgdir}"/usr/lib/pentablet/conf/xppen/*
    
      38       chmod 0664 "${pkgdir}"/usr/lib/pentablet/conf/xppen/*
    
      39       chmod 0644 "${pkgdir}"/usr/lib/pentablet/lib/*.so.*
    
      40       chmod 0644 "${pkgdir}/usr/lib/pentablet/platforms/libqxcb.so"
    
      41       mkdir -p "${pkgdir}/usr/lib/tmpfiles.d"
    
      42       cat <<EOF >"${pkgdir}/usr/lib/tmpfiles.d/xppenlinux-v3.conf"
    
      43d /usr/lib/pentablet/conf/xppen 2775 root users - -
    
      44EOF
    
      45       #Licence  information
    
      46       install -Dm0644 $pkgdir/usr/lib/pentablet/doc/EULA $pkgdir/usr/share/licenses/${pkgname}/LICENSE
    
      47       #Using systemd user service instead of mandatory autostart
    
      48       rm -r $pkgdir/etc
    
      49       mkdir -p $pkgdir/usr/lib/systemd/user
    
      50       cat <<EOF >$pkgdir/usr/lib/systemd/user/xppentablet.service
    
      51[Unit]
    
      52Description=XPPen Driver
    
      53Requires=xdg-desktop-autostart.target
    
      54After=xdg-desktop-autostart.target
    
      55
    
      56[Service]
    
      57Environment=QT_QPA_PLATFORM=xcb
    
      58# per-user tempdir (/run/user/UID): QtSingleApplication keeps its socket+lockfile here,
    
      59# so parallel logins don't collide on a shared /tmp lockfile (see qtsingleapp-* handling)
    
      60Environment=TMPDIR=%t
    
      61ExecStart=/usr/lib/pentablet/PenTablet.sh /mini
    
      62
    
      63[Install]
    
      64WantedBy=xdg-desktop-autostart.target
    
      65EOF
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 00:19:22	Low	3
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 00:19:57	Low	3
2026-08-30 00:04:14	Low	3
2026-08-29 00:29:17	Low	3