intel-ethernet-722smc

maintainer k0ste · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary (nvmupdate64e, an NVM firmware update utility) from a personal S3 bucket (s3.e2e4.ru/k0ste/) that is not Intel's or Supermicro's official distribution infrastructure. The binary is then made executable and installed. While a sha256sum is provided (protecting against accidental corruption or CDN substitution), the hash only guarantees integrity against what the maintainer originally uploaded — it does not establish that the binary came from Intel or Supermicro. If the maintainer's S3 bucket were compromised or the binary were swapped at the source, users would execute arbitrary code with whatever privileges the NVM update tool requires. This is a textbook supply-chain concern: an executed binary from an unofficial personal host, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://s3.e2e4.ru/k0ste/rpm/${pkgname}-${pkgver}.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary (nvmupdate64e, an NVM firmware update utility) from a personal S3 bucket (s3.e2e4.ru/k0ste/) that is not Intel's or Supermicro's official distribution infrastructure. The binary is then made executable and installed. While a sha256sum is provided (protecting against accidental corruption or CDN substitution), the hash only guarantees integrity against what the maintainer originally uploaded — it does not establish that the binary came from Intel or Supermicro. If the maintainer's S3 bucket were compromised or the binary were swapped at the source, users would execute arbitrary code with whatever privileges the NVM update tool requires. This is a textbook supply-chain concern: an executed binary from an unofficial personal host, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Shalygin Konstantin <k0ste@k0ste.ru>
    
      2# Contributor: Shalygin Konstantin <k0ste@k0ste.ru>
    
      3
    
      4pkgname='intel-ethernet-722smc'
    
      5pkgver='5.50'
    
      6pkgrel='1'
    
      7pkgdesc='NVM Update Utility for Intel® Network Adapter X722 Series for Supermicro® X11 (DPi/DPi-NT)'
    
      8arch=('x86_64')
    
      9url='https://forum.proxmox.com/threads/supermicro-x11dpi-nt-nic-x722-firmware-nvm-update.121609/'
    
      10license=('Custom')
    
      11source=("https://s3.e2e4.ru/k0ste/rpm/${pkgname}-${pkgver}.zip")
    
      12sha256sums=('312a6c7c7d3efc6aaba6dbf9af8d55ccf88d806609548fddcc5b76847b69d06a')
    
      13
    
      14prepare() {
    
      15  chmod +x "${pkgver} DPINT3A1_NUP/nvmupdate64e"
    
      16}
    
      17
    
      18package() {
    
      19  mkdir "${pkgdir}/opt"
    
      20  cp -r "${pkgver} DPINT3A1_NUP" "${pkgdir}/opt/${pkgname}"
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2