8188eu-dkms

maintainer julieiversen · 26 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The primary source tarball is fetched from a personal Dropbox account rather than an official Realtek or GitHub/GitLab mirror. Dropbox links are user-controlled and can be silently replaced at any time by whoever controls that account — the URL is not tied to a specific content hash in the URL itself, only to an md5sum in the PKGBUILD. MD5 is cryptographically weak and trivially collisible, providing weaker integrity guarantees than SHA-256/SHA-512. The tarball contains kernel driver source code that is compiled and loaded as a kernel module via DKMS, meaning any compromise of the tarball leads directly to kernel-level code execution. This is a genuine supply-chain concern: unofficial hosting of compiled/compiled-source artifacts on a swappable personal host with only MD5 verification. The patches and config files are local to the AUR git repo and are less concerning. The risk is real but not evidence of active malice, placing this squarely at medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://www.dropbox.com/s/afs5d2yfgwurqm2/${_pkgname}-${pkgver}.tar.xz?dl=1"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The primary source tarball is fetched from a personal Dropbox account rather than an official Realtek or GitHub/GitLab mirror. Dropbox links are user-controlled and can be silently replaced at any time by whoever controls that account — the URL is not tied to a specific content hash in the URL itself, only to an md5sum in the PKGBUILD. MD5 is cryptographically weak and trivially collisible, providing weaker integrity guarantees than SHA-256/SHA-512. The tarball contains kernel driver source code that is compiled and loaded as a kernel module via DKMS, meaning any compromise of the tarball leads directly to kernel-level code execution. This is a genuine supply-chain concern: unofficial hosting of compiled/compiled-source artifacts on a swappable personal host with only MD5 verification. The patches and config files are local to the AUR git repo and are less concerning. The risk is real but not evidence of active malice, placing this squarely at medium severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Arpan Kapoor <a at arpankapoor dot com>
    
      2
    
      3_pkgname=8188eu
    
      4pkgname="${_pkgname}-dkms"
    
      5pkgver=v4.3.0.8_13968
    
      6pkgrel=17
    
      7pkgdesc='Driver for Realtek RTL8188EUS (RTL8188EUS, RTL8188ETV) WLAN'
    
      8arch=('any')
    
      9url='http://www.realtek.com.tw/'
    
      10license=('GPL')
    
      11depends=('dkms')
    
      12source=("https://www.dropbox.com/s/afs5d2yfgwurqm2/${_pkgname}-${pkgver}.tar.xz?dl=1"
    
      blacklist-r8188eu.conf
    
      date_time_macro.patch
    
      dkms.conf
    
      led.patch
    
      linux-4.0.patch
    
      linux-4.2.patch
    
      linux-4.3.patch
    
      linux-4.6.patch
    
      linux-4.11.patch
    
      linux-4.15.patch
    
      linux-4.19.patch
    
      linux-5.0.patch
    
      linux-5.1.patch
    
      linux-5.2.patch
    
      linux-5.6.patch
    
      linux-5.8.patch
    
      linux-5.10.patch
    
      linux-5.15.patch
    
      linux-5.17.patch
    
      linux-6.1.patch
    
      no_debug.patch)
    
      34md5sums=('ca8736349079bc2bfedfb862d04a08bb'
    
       '8af5df9ed717b3bb48df59dac0c8a9c8'
    
       '699a2e12d0d9c7272612fe32a7c10810'
    
       'd973b02dadacb783eacdc1d715843de7'
    
       '26316154e211046f6f711efa2848281f'
    
       '2e3d4ac7b1b856f7d835731b5e5ebafc'
    
       'a0286c3541676f1f43cd02d5e1056bdd'
    
       '6015156964800281cbe4b580e427a117'
    
       'a7d7c79bb1a2a1905a4c1b4c184eed77'
    
       'af75f63a39d075f3e00edf34be5de708'
    
       'd7166ea97454fed40b2a7d5c6b3695b8'
    
       'b50c4d78fb03ab6af99f45d04b1890fd'
    
       'a540f87d5f8b08c732d594760696a97f'
    
       '4730b05761b7bc9b3e970a088fc81c8f'
    
       '0f23196d2f3be2aff32393c698c10d7a'
    
       'd3d112aec7a0cdccc7161ba1d66b8475'
    
       '96d4403315c7af254d2be5706b726317'
    
       '8906dbc463e885aa6aa95679e5c5f659'
    
       'd1a376d74a61f09b7333f40a2ac9c594'
    
       '7ae884b13d823469d7957a1a59dd2317'
    
       '468076c497b7225d60cf622482ca7759'
    
       '0b14ee4517f78ada4d471654afd82b79')
    
      56
    
      57prepare() {
    
cd "${_pkgname}-${pkgver}"
    
local i;for i in "${source[@]}";do
    
  case $i in
    
    *.patch)
    
      echo "Applying patch ${i}"
    
      patch -p1 -i "${srcdir}/${i}"
    
  esac
    
done
    
# Disable power saving
    
sed -i 's/^CONFIG_POWER_SAVING \= y/CONFIG_POWER_SAVING = n/' Makefile
    
      68}
    
      69
    
      70package() {
    
cd "${srcdir}"
    
local install_dir="${pkgdir}/usr/src/${_pkgname}-${pkgver}"
    
# Copy dkms.conf
    
install -Dm644 dkms.conf "${install_dir}/dkms.conf"
    
# Blacklist r8188eu
    
install -Dm644 blacklist-r8188eu.conf "${pkgdir}/etc/modprobe.d/r8188eu.conf"
    
# Set name and version
    
sed -e "s/@_PKGNAME@/${_pkgname}/" -e "s/@PKGVER@/${pkgver}/" -i "${install_dir}/dkms.conf"
    
# Copy sources
    
cd "${_pkgname}-${pkgver}"
    
for d in $(find . -type d);do install -dm755 "${install_dir}/$d";done
    
for f in $(find . -type f);do install -m644 "$f" "${install_dir}/$f";done
    
      83}
    
      84

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2