Converted .deb to Arch Package in AUR for Huion Pen Display

[zelmarose]

Hello.

I have a Huion Kamvas Pro 16 (2.5K) pen display and want to use it on Manjaro (using X11). I have found in the AUR a package download that has already been converted from .deb to Arch (June 8, 2026). I was curious if anyone has downloaded/used this package because I heard there have been some security issues with the AUR. I’m not sure it’s safe to download, and I’m not smart enough to fix my computer if something would go wrong. I’d appreciate any advice or recommendations to be able to use my pen display with Manjaro.

Thank you.

[Aragorn]

Welcome to the forum!

@zelmarose

I have found in the AUR a package download that has already been converted from .deb to Arch (June 8, 2026). I was curious if anyone has downloaded/used this package because I heard there have been some security issues with the AUR. I’m not sure it’s safe to download, and I’m not smart enough to fix my computer if something would go wrong.

Save the script below in your ~/.local/bin folder…

#!/usr/bin/env bash
#
# Pulls the live package list from the official Arch Linux HedgeDoc note.
LIST_URL="https://md.archlinux.org/s/SxbqukK6IA"

START_DATE=${START_DATE:-2026-01-01}
END_DATE=${END_DATE:-2026-06-12}
PACMAN_LOG_GLOB=${PACMAN_LOG_GLOB:-/var/log/pacman.log*}

CURRENT_FOUND=()
HISTORICAL_FOUND=()
LOG_WARNINGS=()

# ---------------------------------------------------------------------------
# 1. Fetch and parse the live infected package list
# ---------------------------------------------------------------------------
echo "Fetching infected package list from $LIST_URL..."

raw=$(curl -fsSL "$LIST_URL") || { echo "ERROR: failed to fetch $LIST_URL"; exit 1; }

mapfile -t INFECTED_PKGS < <(
    echo "$raw" \
    | sed 's/<[^>]*>//g' \
    | grep -E '^[a-z0-9][a-z0-9_.+\-]*[a-z0-9]$' \
    | sort -u
)

if [[ ${#INFECTED_PKGS[@]} -eq 0 ]]; then
    echo "ERROR: parsed 0 packages — something went wrong with the fetch/parse."
    exit 1
fi

# ---------------------------------------------------------------------------
# Helper functions
# ---------------------------------------------------------------------------
date_in_window() {
  local date_value=$1
  [[ "$date_value" < "$START_DATE" ]] && return 1
  [[ "$date_value" > "$END_DATE" ]] && return 1
  return 0
}

install_date_in_window() {
  local raw_date=$1 normalized_date

  normalized_date=$(LC_ALL=C date -d "$raw_date" +%F 2>/dev/null) || return 1
  date_in_window "$normalized_date"
}

read_pacman_log_file() {
  local file=$1

  case "$file" in
    *.gz)
      if command -v gzip >/dev/null 2>&1; then
        gzip -cd -- "$file"
      else
        LOG_WARNINGS+=("Skipped $file: gzip is not installed")
      fi
      ;;
    *.xz)
      if command -v xz >/dev/null 2>&1; then
        xz -cd -- "$file"
      else
        LOG_WARNINGS+=("Skipped $file: xz is not installed")
      fi
      ;;
    *.zst)
      if command -v zstdcat >/dev/null 2>&1; then
        zstdcat -- "$file"
      else
        LOG_WARNINGS+=("Skipped $file: zstdcat is not installed")
      fi
      ;;
    *.bz2)
      if command -v bzip2 >/dev/null 2>&1; then
        bzip2 -cd -- "$file"
      else
        LOG_WARNINGS+=("Skipped $file: bzip2 is not installed")
      fi
      ;;
    *)
      cat -- "$file"
      ;;
  esac
}

scan_pacman_logs() {
  local file
  local log_files=()

  for file in $PACMAN_LOG_GLOB; do
    [[ -e "$file" ]] && log_files+=("$file")
  done

  if [[ ${#log_files[@]} -eq 0 ]]; then
    LOG_WARNINGS+=("No pacman log files matched: $PACMAN_LOG_GLOB")
    return 0
  fi

  {
    printf 'PKG\t%s\n' "${INFECTED_PKGS[@]}"
    for file in "${log_files[@]}"; do
      [[ -r "$file" ]] || { LOG_WARNINGS+=("Skipped $file: not readable"); continue; }
      read_pacman_log_file "$file" | sed $'s/^/LOG\t/'
    done
  } | awk -v start="$START_DATE" -v end="$END_DATE" -F '\t' '
    $1 == "PKG" {
      infected[$2] = 1
      next
    }

    $1 == "LOG" {
      line = $2
      date = substr(line, 2, 10)
      if (date < start || date > end) next

      msg = line
      sub(/^\[[^]]+\] \[ALPM\] /, "", msg)
      split(msg, fields, " ")
      action = fields[1]
      pkg = fields[2]

      if ((action == "installed" || action == "upgraded" || action == "reinstalled") && infected[pkg]) {
        key = pkg SUBSEP date SUBSEP action SUBSEP line
        if (!seen[key]++) {
          printf "%s\t%s\t%s\t%s\n", pkg, date, action, line
        }
      }
    }
  ' | sort -u
}

print_pkg_list() {
  local -n arr=$1
  local pkg

  for pkg in "${arr[@]}"; do
    echo "  - $pkg"
  done
}

# ---------------------------------------------------------------------------
# 2. Checks
# ---------------------------------------------------------------------------
echo
echo "Checking for infected AUR packages (${#INFECTED_PKGS[@]} total)..."
echo "Campaign window: $START_DATE through $END_DATE"
echo

echo "Checking currently installed foreign packages..."
while IFS= read -r pkg; do
  install_date=$(LC_ALL=C pacman -Qi -- "$pkg" 2>/dev/null | awk -F ': ' '/^Install Date/ { print $2; exit }')
  if [[ -n "$install_date" ]] && install_date_in_window "$install_date"; then
    CURRENT_FOUND+=("$pkg (Install Date: $install_date)")
  fi
done < <(pacman -Qmq "${INFECTED_PKGS[@]}" 2>/dev/null)

if [[ ${#CURRENT_FOUND[@]} -eq 0 ]]; then
  echo "  Clean: no currently installed known infected package has an install date in the campaign window."
else
  echo "  WARNING: ${#CURRENT_FOUND[@]} currently installed possibly infected package(s):"
  print_pkg_list CURRENT_FOUND
fi

echo
echo "Checking historical pacman logs..."
while IFS=$'\t' read -r pkg date action line; do
  HISTORICAL_FOUND+=("$pkg ($action on $date) :: $line")
done < <(scan_pacman_logs)

if [[ ${#HISTORICAL_FOUND[@]} -eq 0 ]]; then
  echo "  Clean: no known infected package install/upgrade/reinstall events found in pacman logs during the campaign window."
else
  echo "  WARNING: ${#HISTORICAL_FOUND[@]} historical pacman log event(s) matched:"
  print_pkg_list HISTORICAL_FOUND
fi

if [[ ${#LOG_WARNINGS[@]} -gt 0 ]]; then
  echo
  echo "Log scan notes:"
  print_pkg_list LOG_WARNINGS
fi

echo
if [[ ${#CURRENT_FOUND[@]} -eq 0 && ${#HISTORICAL_FOUND[@]} -eq 0 ]]; then
  echo "Clean: no matches found by current-package or historical-log checks."
else
  echo "WARNING: matches were found. Review the package build files/cache and consider incident-response steps."
fi
echo

… and give it execute permission. On my system, I’ve named it aur-malware-check.

chmod 700 .local/bin/aur-malware-check

Then execute the script from your regular user account…

aur-malware-check

This will tell you whether anything you have or recently had installed was in the list of infected PKGBUILDs on the AUR.

[Teo]

@Aragorn

https://md.archlinux.org/s/SxbqukK6IA

It wasn’t and the current pkgbuild looks perfectly safe to me. I think you are good to go in this case.

[Yochanan]

Many binary AUR packages are unpacked from a .deb, .rpm or .AppImage. Perfectly normal.

[zelmarose]

@Teo @Yochanan
Thank you all for your replies. I’m going to download it now.
I saved the script too, thank you. And thanks for the welcome!