mn88472-firmware

maintainer abouvier · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a Windows installer from Dropbox, which is non-standard but not inherently malicious. The PKGBUILD extracts firmware blobs (binary data files, not executed code) from a vendor driver package using 7z and tail/head byte offsets. The extracted .fw files are installed as firmware data under /usr/lib/firmware — they are loaded by the kernel driver, not executed as userspace code directly. The b2sums checksum pins the exact installer binary, and a check() function verifies the extracted firmware via md5sum. Dropbox is a swappable host in principle, but the b2sum makes substitution detectable. The firmware files themselves are data consumed by a kernel DVB demodulator driver (mn88472/mn88473), which is a well-known legitimate pattern for proprietary DVB firmware packaging in the AUR. The main concern is that Dropbox links can be deleted/replaced, but the checksum mitigates this. This is sloppy (non-official host) but not a genuine supply-chain threat given the pinned hash. Rating: low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The source is a Windows installer from Dropbox, which is non-standard but not inherently malicious. The PKGBUILD extracts firmware blobs (binary data files, not executed code) from a vendor driver package using 7z and tail/head byte offsets. The extracted .fw files are installed as firmware data under /usr/lib/firmware — they are loaded by the kernel driver, not executed as userspace code directly. The b2sums checksum pins the exact installer binary, and a check() function verifies the extracted firmware via md5sum. Dropbox is a swappable host in principle, but the b2sum makes substitution detectable. The firmware files themselves are data consumed by a kernel DVB demodulator driver (mn88472/mn88473), which is a well-known legitimate pattern for proprietary DVB firmware packaging in the AUR. The main concern is that Dropbox links can be deleted/replaced, but the checksum mitigates this. This is sloppy (non-official host) but not a genuine supply-chain threat given the pinned hash. Rating: low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://dl.dropbox.com/s/ffckhetzp3vmjio/AMDVBT2_Setup_$_pkgver.exe")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alexandre Bouvier <contact@amb.tf>
    
      2pkgname=(mn8847{2,3}-firmware)
    
      3_pkgver=170427
    
      4pkgver=6.427.2017
    
      5pkgrel=2
    
      6arch=('any')
    
      7url="http://www.astrometa.com.tw/"
    
      8license=('LicenseRef-proprietary')
    
      9groups=('dvb-firmware')
    
      10makedepends=('p7zip' 'zstd')
    
      11source=("https://dl.dropbox.com/s/ffckhetzp3vmjio/AMDVBT2_Setup_$_pkgver.exe")
    
      12b2sums=('b8027cd4715b3c9c08827dd30e99b69b6b2b8cd45ccd35ac01bac527eaa5cbf09219dc4b2515b1635ada690d4b845db0b12d12aaf1be57117b6a8222f81464c1')
    
      13
    
      14prepare() {
    
      15	7z x AMDVBT2_Setup_$_pkgver.exe
    
      16	tail -c +220369 X64/AMDVBT2BDA.sys | head -c 2005 > dvb-demod-mn88472-02.fw
    
      17	tail -c +222385 X64/AMDVBT2BDA.sys | head -c 2271 > dvb-demod-mn88473-01.fw
    
      18	zstd -19 -- *.fw
    
      19}
    
      20
    
      21check() {
    
      22	echo 088b891ac9273ff8c6818fca27b24d81 dvb-demod-mn88472-02.fw | md5sum -c
    
      23	echo bdb15b2311581db4c8411fca5e4ce3ce dvb-demod-mn88473-01.fw | md5sum -c
    
      24}
    
      25
    
      26package_mn88472-firmware() {
    
      27	pkgdesc="Firmware for Panasonic MN88472 DVB-T/T2/C demodulator"
    
      28
    
      29	# shellcheck disable=SC2154
    
      30	install -Dm644 -t "$pkgdir"/usr/lib/firmware dvb-demod-mn88472-02.fw.zst
    
      31}
    
      32
    
      33package_mn88473-firmware() {
    
      34	pkgdesc="Firmware for Panasonic MN88473 DVB-T/T2/C demodulator"
    
      35
    
      36	install -Dm644 -t "$pkgdir"/usr/lib/firmware dvb-demod-mn88473-01.fw.zst
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2