mn88472-firmware

LOW

maintainer abouvier 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a Windows installer from Dropbox, which is non-standard but not inherently malicious. The PKGBUILD extracts firmware blobs (binary data files, not executed code) from a vendor driver package using 7z and tail/head byte offsets. The extracted .fw files are installed as firmware data under /usr/lib/firmware — they are loaded by the kernel driver, not executed as userspace code directly. The b2sums checksum pins the exact installer binary, and a check() function verifies the extracted firmware via md5sum. Dropbox is a swappable host in principle, but the b2sum makes substitution detectable. The firmware files themselves are data consumed by a kernel DVB demodulator driver (mn88472/mn88473), which is a well-known legitimate pattern for proprietary DVB firmware packaging in the AUR. The main concern is that Dropbox links can be deleted/replaced, but the checksum mitigates this. This is sloppy (non-official host) but not a genuine supply-chain threat given the pinned hash. Rating: low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The source is a Windows installer from Dropbox, which is non-standard but not inherently malicious. The PKGBUILD extracts firmware blobs (binary data files, not executed code) from a vendor driver package using 7z and tail/head byte offsets. The extracted .fw files are installed as firmware data under /usr/lib/firmware — they are loaded by the kernel driver, not executed as userspace code directly. The b2sums checksum pins the exact installer binary, and a check() function verifies the extracted firmware via md5sum. Dropbox is a swappable host in principle, but the b2sum makes substitution detectable. The firmware files themselves are data consumed by a kernel DVB demodulator driver (mn88472/mn88473), which is a well-known legitimate pattern for proprietary DVB firmware packaging in the AUR. The main concern is that Dropbox links can be deleted/replaced, but the checksum mitigates this. This is sloppy (non-official host) but not a genuine supply-chain threat given the pinned hash. Rating: low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://dl.dropbox.com/s/ffckhetzp3vmjio/AMDVBT2_Setup_$_pkgver.exe")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alexandre Bouvier <contact@amb.tf>
    
      2pkgname=(mn8847{2,3}-firmware)
    
      3_pkgver=170427
    
      4pkgver=6.427.2017
    
      5pkgrel=2
    
      6arch=('any')
    
      7url="http://www.astrometa.com.tw/"
    
      8license=('LicenseRef-proprietary')
    
      9groups=('dvb-firmware')
    
      10makedepends=('p7zip' 'zstd')
    
      11source=("https://dl.dropbox.com/s/ffckhetzp3vmjio/AMDVBT2_Setup_$_pkgver.exe")
    
      12b2sums=('b8027cd4715b3c9c08827dd30e99b69b6b2b8cd45ccd35ac01bac527eaa5cbf09219dc4b2515b1635ada690d4b845db0b12d12aaf1be57117b6a8222f81464c1')
    
      13
    
      14prepare() {
    
      15	7z x AMDVBT2_Setup_$_pkgver.exe
    
      16	tail -c +220369 X64/AMDVBT2BDA.sys | head -c 2005 > dvb-demod-mn88472-02.fw
    
      17	tail -c +222385 X64/AMDVBT2BDA.sys | head -c 2271 > dvb-demod-mn88473-01.fw
    
      18	zstd -19 -- *.fw
    
      19}
    
      20
    
      21check() {
    
      22	echo 088b891ac9273ff8c6818fca27b24d81 dvb-demod-mn88472-02.fw | md5sum -c
    
      23	echo bdb15b2311581db4c8411fca5e4ce3ce dvb-demod-mn88473-01.fw | md5sum -c
    
      24}
    
      25
    
      26package_mn88472-firmware() {
    
      27	pkgdesc="Firmware for Panasonic MN88472 DVB-T/T2/C demodulator"
    
      28
    
      29	# shellcheck disable=SC2154
    
      30	install -Dm644 -t "$pkgdir"/usr/lib/firmware dvb-demod-mn88472-02.fw.zst
    
      31}
    
      32
    
      33package_mn88473-firmware() {
    
      34	pkgdesc="Firmware for Panasonic MN88473 DVB-T/T2/C demodulator"
    
      35
    
      36	install -Dm644 -t "$pkgdir"/usr/lib/firmware dvb-demod-mn88473-01.fw.zst
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2