gobi-firmware-mc8355
LOW
maintainer swiftgeek
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a firmware installer from Lenovo's official support domain, extracts it, and installs non-executable firmware blobs (.mbn files) to the appropriate location; despite the non-whitelisted host, the source is legitimate and the installed files are not executable code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a firmware installer from Lenovo's official support domain, extracts it, and installs non-executable firmware blobs (.mbn files) to the appropriate location; despite the non-whitelisted host, the source is legitimate and the installed files are not executable code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
source=('https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/8awt16ww.exe')
PKGBUILD
1 offending line(s) highlighted
1
2
pkgname=gobi-firmware-mc8355
3
pkgver=1.0.45.0
4
pkgrel=1
5
pkgdesc="Firmware for Sierra Wireless MC8355 (Gobi 3000)"
6
arch=('any')
7
license=('custom')
8
optdepends=('gobi-loader: for automatic firmware loading')
9
makedepends=('innoextract' 'p7zip')
10
conflicts=('gobi-firmware')
11
url="http://support.lenovo.com/gb/en/downloads/migr-77035"
12
options=("!strip")
13
source=('https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/8awt16ww.exe')
14
sha256sums=('d5b4ba982f01cc72688723112fcaa68ed7708426f9f3b1e4af30ce08bdf49341')
15
16
# There are 3 sets of firmwares:
17
# • DPRImages/3000/ - Dynamic Power Reduction, probably requires OS cooperation
18
# • Images/3000/ - dunno
19
# • 3000/ - dunno
20
# In each set there are 9 different firmwares, each for
21
# specific carrier or generic (this is taken from ImageInfo.xml):
22
# • <dir> - Carrier - MCC MCN code (Mobile Country Code, Mobile Network Code)
23
# • 0 - Vodafone - 454006,454015,228001,505003,262002,602002,202005,216070,272001,278001,530001,222010,214001,268001,286002,234015,234015,276002,242001,226001
24
# • 1 - Verizon - 310012
25
# • 2 - AT&T - 310150,310170,310380,310410
26
# • 3 - Sprint - ANY
27
# • 4 - T-Mobile - 262001,219001,219013,216030
28
# • 5 - »Doesn't exist«
29
# • 6 - Generic UMTS - ANY
30
# • 7 - Telefonica - 214007,334003,730002,730002,214007
31
# • 8 - Telecom Italia - 334003,730002,214007
32
# • 9 - Orange - 310260,310270,310250,310200,310031,310220,310160,310660,310240,310230,310210,310026,234030,234031,234032
33
34
firmware_type="Images/3000" # Path
35
firmware_carrier_id=6 # From list above
36
37
package() {
38
cd $srcdir
39
innoextract -e 8awt16ww.exe -I LenovoGobi3kSetup.exe
40
cd app
41
7z x LenovoGobi3kSetup.exe "${firmware_type}/Generic/${firmware_carrier_id}/*.mbn" -aou
42
# Replace old files with newer ones
43
cd "${firmware_type}/Generic/${firmware_carrier_id}/"
44
for file in amss uqcn uqcn_nogps; do
45
[ -f "${file}_1.mbn" ] && [ "${file}_1.mbn" -nt "${file}.mbn" ] && mv "${file}_1.mbn" "${file}.mbn"
46
done
47
48
install -d -m755 "${pkgdir}/usr/lib/firmware/gobi"
49
install -m644 "amss.mbn" "${pkgdir}/usr/lib/firmware/gobi"
50
#install -m644 "apps.mbn" "${pkgdir}/usr/lib/firmware/gobi"
51
install -m644 "uqcn.mbn" "${pkgdir}/usr/lib/firmware/gobi" # Comment if you don't want GPS
52
#install -m644 "uqcn_nogps.mbn" "${pkgdir}/usr/lib/firmware/gobi/uqcn.mbn" # Uncomment if you don't want GPS
53
}
54
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |