mt7927-bt-firmware

LOW

maintainer maci 0 votes scanned 2026-08-28 09:36:42.922055

View on AUR

Why flagged

The PKGBUILD downloads a vendor driver ZIP from the official ASUS CDN (dlcdnta.asus.com) using a token API, verifies it with a hardcoded SHA-256 checksum, and extracts only a binary firmware blob that is installed as non-executed firmware data; the out-of-source=() download is explained by the signed-URL mechanism, and the integrity check mitigates swap risk, making this low-risk packaging of official vendor firmware.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The PKGBUILD downloads a vendor driver ZIP from the official ASUS CDN (dlcdnta.asus.com) using a token API, verifies it with a hardcoded SHA-256 checksum, and extracts only a binary firmware blob that is installed as non-executed firmware data; the out-of-source=() download is explained by the signed-URL mechanism, and the integrity check mitigates swap risk, making this low-risk packaging of official vendor firmware.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 token=$(curl -sf -X POST -H 'Origin: https://rog.asus.com' \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: maci <maci.stgn@gmail.com>
    
      2
    
      3pkgname=mt7927-bt-firmware
    
      4pkgver=20250606
    
      5pkgrel=1
    
      6pkgdesc="Bluetooth firmware for MediaTek MT7927 (MT6639), extracted from the ASUS Windows driver"
    
      7arch=('any')
    
      8url='https://github.com/openwrt/mt76/issues/927'
    
      9license=('LicenseRef-MediaTek-Firmware')
    
      10makedepends=('python' 'curl' 'libarchive')
    
      11conflicts=('mediatek-mt7927-dkms')
    
      12source=('extract-bt-firmware.py')
    
      13sha256sums=('013dff1981e158f28ef3db56775ad119bbefd8942d6c9387edfabf057f1fe6c6')
    
      14
    
      15_firmware='BT_RAM_CODE_MT6639_2_1_hdr.bin'
    
      16_driver_zip='DRV_WiFi_MTK_MT7925_MT7927_TP_W11_64_V5603998_20250709R.zip'
    
      17_driver_sha256='b377fffa28208bb1671a0eb219c84c62fba4cd6f92161b74e4b0909476307cc8'
    
      18_cdn='https://dlcdnta.asus.com/pub/ASUS/mb/08WIRELESS'
    
      19_model='ROG%20CROSSHAIR%20X870E%20HERO'
    
      20
    
      21# linux-firmware ships only the WiFi blobs for mt7927, so the Bluetooth one has
    
      22# to come out of the vendor driver. The ASUS CDN serves it behind a signed URL
    
      23# from its token API, so the ZIP cannot be a source() entry.
    
      24_download() {
    
      25  local token expires signature key_pair
    
      26  msg2 'Requesting a download token from the ASUS CDN...'
    
      27  token=$(curl -sf -X POST -H 'Origin: https://rog.asus.com' \
    
      28    "https://cdnta.asus.com/api/v1/TokenHQ?filePath=https:%2F%2Fdlcdnta.asus.com%2Fpub%2FASUS%2Fmb%2F08WIRELESS%2F${_driver_zip}%3Fmodel%3D${_model//%/%25}&systemCode=rog")
    
      29
    
      30  expires=${token#*\"expires\":\"};      expires=${expires%%\"*}
    
      31  signature=${token#*\"signature\":\"};  signature=${signature%%\"*}
    
      32  key_pair=${token#*\"keyPairId\":\"};   key_pair=${key_pair%%\"*}
    
      33
    
      34  msg2 "Downloading ${_driver_zip}..."
    
      35  curl -fL -o "$1" \
    
      36    "${_cdn}/${_driver_zip}?model=${_model}&Signature=${signature}&Expires=${expires}&Key-Pair-Id=${key_pair}"
    
      37}
    
      38
    
      39prepare() {
    
      40  local zip="${SRCDEST:-$startdir}/${_driver_zip}"
    
      41
    
      42  if [[ ! -f $zip ]] && ! _download "$zip"; then
    
      43    rm -f "$zip"
    
      44    error "Could not download ${_driver_zip} from the ASUS CDN."
    
      45    plain 'Fetch it manually from your board support page (WiFi & Bluetooth ->'
    
      46    plain "MediaTek MT7925/MT7927 WiFi driver), put it in ${SRCDEST:-$startdir}, and rebuild."
    
      47    return 1
    
      48  fi
    
      49
    
      50  echo "${_driver_sha256}  ${zip}" | sha256sum -c -
    
      51  bsdtar -xf "$zip" -C "$srcdir" mtkwlan.dat
    
      52}
    
      53
    
      54build() {
    
      55  python extract-bt-firmware.py mtkwlan.dat "$_firmware" "$_firmware"
    
      56}
    
      57
    
      58package() {
    
      59  install -Dm644 "$_firmware" "$pkgdir/usr/lib/firmware/mediatek/mt7927/$_firmware"
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-28 09:36:42	Low	3
2026-08-28 09:35:00	Medium	2