lenovo-100-m1520-m1688-series

maintainer CYS · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source is a prebuilt binary driver archive (containing .so libraries, CUPS/SANE filter binaries, and executables) downloaded from lenovo-upload.oss-cn-beijing.aliyuncs.com, which is Alibaba Cloud OSS (aliyuncs.com) — a common CDN/storage backend used by Chinese vendors including Lenovo for distributing drivers in China. This is not Lenovo's primary international domain but is a plausible official distribution channel for Lenovo China. However, it is not a verifiable official Lenovo-controlled domain in the same way as lenovo.com, and the package installs precompiled shared libraries (.so files), CUPS filters, and SANE backends directly into the system without source compilation. The sha256 checksum provides integrity verification against the specific file, but does not establish authenticity of the origin. The combination of: (1) prebuilt binary blobs including .so libraries loaded into CUPS/SANE, (2) sourced from a third-party cloud storage bucket rather than a canonical vendor release page, and (3) no GPG signature verification, constitutes a genuine medium supply-chain risk. The cheaper model's assessment is correct here.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("${pkgname}-${_pkgver}.${_revision}.7z::https://lenovo-upload.oss-cn-beijing.aliyuncs.com/drivers/L100_Series_drivers_Lin_${_srcdate}.7z")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source is a prebuilt binary driver archive (containing .so libraries, CUPS/SANE filter binaries, and executables) downloaded from lenovo-upload.oss-cn-beijing.aliyuncs.com, which is Alibaba Cloud OSS (aliyuncs.com) — a common CDN/storage backend used by Chinese vendors including Lenovo for distributing drivers in China. This is not Lenovo's primary international domain but is a plausible official distribution channel for Lenovo China. However, it is not a verifiable official Lenovo-controlled domain in the same way as lenovo.com, and the package installs precompiled shared libraries (.so files), CUPS filters, and SANE backends directly into the system without source compilation. The sha256 checksum provides integrity verification against the specific file, but does not establish authenticity of the origin. The combination of: (1) prebuilt binary blobs including .so libraries loaded into CUPS/SANE, (2) sourced from a third-party cloud storage bucket rather than a canonical vendor release page, and (3) no GPG signature verification, constitutes a genuine medium supply-chain risk. The cheaper model's assessment is correct here.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yushun Cheng <chengys339@163.com>
    
      2
    
      3# name
    
      4pkgname=lenovo-100-m1520-m1688-series
    
      5# version
    
      6_srcdate=20210511095611
    
      7_pkgver=1.0
    
      8_revision=43
    
      9_pkgdate=20210420
    
      10pkgver=1.0.43
    
      11pkgrel=1
    
      12# generic
    
      13pkgdesc='Lenovo printer driver for 100, m1520, and m1688 series.'
    
      14arch=('x86_64')
    
      15url='https://www.lenovoimage.com/'
    
      16license=('custom:Lenovo')
    
      17# dependencies
    
      18depends=('cups' 'sane')
    
      19makedepends=('tar')
    
      20# source
    
      21source=("${pkgname}-${_pkgver}.${_revision}.7z::https://lenovo-upload.oss-cn-beijing.aliyuncs.com/drivers/L100_Series_drivers_Lin_${_srcdate}.7z")
    
      22# checks
    
      23sha256sums=('3ac923c20e25047edb12242ddbbcd626bc77990ec31332de2c84950dc9a1f386')
    
      24
    
      25pkgver() {
    
      26  echo "${_pkgver}.${_revision}"
    
      27}
    
      28
    
      29package() {
    
      30  # unzip tar
    
      31  tar -xf "${pkgname}-linux-installer_${_pkgver}-${_revision}_${_pkgdate}.tar.gz"
    
      32  # unzip deb
    
      33  cd "lenovo-100-m1520-m1688-series_${_pkgver}-${_revision}"/Installer
    
      34  ar x "lenovo-100-m1520-m1688-series_${_pkgver}-${_revision}_amd64.deb"
    
      35  # unzip data.tar.gz
    
      36  tar -xf data.tar.gz
    
      37
    
      38  # package
    
      39  mkdir $pkgdir/usr
    
      40  # bin
    
      41  mv usr/local/bin $pkgdir/usr/bin
    
      42  # lib
    
      43  mkdir $pkgdir/usr/lib
    
      44  mv usr/lib/cups usr/lib/sane usr/lib/*.so $pkgdir/usr/lib
    
      45  # share
    
      46  mv usr/share $pkgdir/usr
    
      47  # etc
    
      48  mv etc $pkgdir
    
      49  # license
    
      50  mkdir -p $pkgdir/usr/share/licenses
    
      51  mv License $pkgdir/usr/share/licenses/$pkgname
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2