xppenlinux-v3
maintainer labaman
· 9 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a tarball from the official vendor's domain (xp-pen.com), which is the project's legitimate release infrastructure; despite the non-standard URL format, this is a normal and expected source for an official driver, and the checksum is provided and matches, making the risk low.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official vendor's domain (xp-pen.com), which is the project's legitimate release infrastructure; despite the non-standard URL format, this is a normal and expected source for an official driver, and the checksum is provided and matches, making the risk low.
2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
source=("XPPenLinux${pkgver}-${_vendor_rel}.tar.gz::https://www.xp-pen.com/download/file/id/2901/pid/68/ext/gz.html")
MEDIUM
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:36
chmod 2775 "${pkgdir}/usr/lib/pentablet/conf/xppen"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Mikhail Velichko <efklid at gmail dot com>
2
# Contributor: Mikata Riko <sanbikappa at qq dot com>
3
4
pkgname=xppenlinux-v3
5
pkgver=3.4.9
6
_vendor_rel=240607
7
pkgrel=${_vendor_rel}.2
8
pkgdesc="XP-Pen (Official) Linux utility for legacy XPPen Tablets"
9
arch=('x86_64')
10
url='https://www.xp-pen.com/download/index.html'
11
license=('custom')
12
conflicts=('xp-pen-tablet' 'xppenlinux3')
13
source=("XPPenLinux${pkgver}-${_vendor_rel}.tar.gz::https://www.xp-pen.com/download/file/id/2901/pid/68/ext/gz.html")
14
install=${pkgname}.install
15
16
sha512sums=('40598c05d5ada0bd7a874b943e7819d6ffd0ef79d77e7433f814cfdc885846cc49276e1162e082bfe03f76b17f095323abfb8d5108f444cd30a685a0e0826ca4')
17
18
prepare() {
19
#https://wiki.archlinux.org/title/Users_and_groups#Pre-systemd_groups
20
#use udev uaccess for device permission
21
cat <<EOF >$srcdir/XPPenLinux${pkgver}-${_vendor_rel}/App/lib/udev/rules.d/10-xp-pen.rules
22
KERNEL=="uinput",SUBSYSTEMS=="misc",MODE="0660",TAG+="uaccess",OPTIONS+="static_node=uinput"
23
SUBSYSTEMS=="usb",ATTRS{idVendor}=="28bd",MODE="0660",TAG+="uaccess"
24
EOF
25
}
26
27
package() {
28
cp -r $srcdir/XPPenLinux${pkgver}-${_vendor_rel}/App/* $pkgdir
29
cp -r $pkgdir/lib/* $pkgdir/usr/lib
30
rm -r $pkgdir/lib
31
# per-user tempdir for manual launches (.desktop -> PenTablet.sh): keep Qt's
32
# single-instance socket+lockfile in /run/user/UID so parallel logins don't collide
33
# on a shared /tmp lockfile. The systemd service sets TMPDIR=%t; ${TMPDIR:-...} respects it.
34
sed -i '/export LD_LIBRARY_PATH/a if [ -n "$XDG_RUNTIME_DIR" ]; then export TMPDIR="${TMPDIR:-$XDG_RUNTIME_DIR}"; fi' "${pkgdir}/usr/lib/pentablet/PenTablet.sh"
35
chown root:users "${pkgdir}/usr/lib/pentablet/conf/xppen"
36
chmod 2775 "${pkgdir}/usr/lib/pentablet/conf/xppen"
37
chown root:users "${pkgdir}"/usr/lib/pentablet/conf/xppen/*
38
chmod 0664 "${pkgdir}"/usr/lib/pentablet/conf/xppen/*
39
chmod 0644 "${pkgdir}"/usr/lib/pentablet/lib/*.so.*
40
chmod 0644 "${pkgdir}/usr/lib/pentablet/platforms/libqxcb.so"
41
mkdir -p "${pkgdir}/usr/lib/tmpfiles.d"
42
cat <<EOF >"${pkgdir}/usr/lib/tmpfiles.d/xppenlinux-v3.conf"
43
d /usr/lib/pentablet/conf/xppen 2775 root users - -
44
EOF
45
#Licence information
46
install -Dm0644 $pkgdir/usr/lib/pentablet/doc/EULA $pkgdir/usr/share/licenses/${pkgname}/LICENSE
47
#Using systemd user service instead of mandatory autostart
48
rm -r $pkgdir/etc
49
mkdir -p $pkgdir/usr/lib/systemd/user
50
cat <<EOF >$pkgdir/usr/lib/systemd/user/xppentablet.service
51
[Unit]
52
Description=XPPen Driver
53
Requires=xdg-desktop-autostart.target
54
After=xdg-desktop-autostart.target
55
56
[Service]
57
Environment=QT_QPA_PLATFORM=xcb
58
# per-user tempdir (/run/user/UID): QtSingleApplication keeps its socket+lockfile here,
59
# so parallel logins don't collide on a shared /tmp lockfile (see qtsingleapp-* handling)
60
Environment=TMPDIR=%t
61
ExecStart=/usr/lib/pentablet/PenTablet.sh /mini
62
63
[Install]
64
WantedBy=xdg-desktop-autostart.target
65
EOF
66
}
67
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |
| 2026-07-15 00:09:25 | LOW | 3 |