rtl8761usb-dkms

maintainer MattKC · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source tarball is hosted on archive.org, which is a legitimate public archive used as a fallback mirror when the original vendor host (mpow.s3-us-west-1.amazonaws.com, commented out) is unavailable. The sha256sum is hardcoded and verified, which mitigates the risk of the archive being swapped silently. The content is a Realtek Bluetooth driver source tarball (not a pre-built binary blob) that is then patched and installed via DKMS for compilation on the target system. The firmware files copied are standard Realtek firmware blobs, consistent with what is distributed by the vendor. While archive.org is not the official vendor host, it is a well-known, reputable archival service, and the checksum pinning provides integrity assurance. This is a common pattern in AUR packages where upstream vendor links go stale. The risk is low rather than medium: the sha256 pin prevents silent substitution, and the driver source is compiled locally via DKMS rather than executing a pre-built binary from the archive.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The source tarball is hosted on archive.org, which is a legitimate public archive used as a fallback mirror when the original vendor host (mpow.s3-us-west-1.amazonaws.com, commented out) is unavailable. The sha256sum is hardcoded and verified, which mitigates the risk of the archive being swapped silently. The content is a Realtek Bluetooth driver source tarball (not a pre-built binary blob) that is then patched and installed via DKMS for compilation on the target system. The firmware files copied are standard Realtek firmware blobs, consistent with what is distributed by the vendor. While archive.org is not the official vendor host, it is a well-known, reputable archival service, and the checksum pinning provides integrity assurance. This is a common pattern in AUR packages where upstream vendor links go stale. The risk is low rather than medium: the sha256 pin prevents silent substitution, and the driver source is compiled locally via DKMS rather than executing a pre-built binary from the archive.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://archive.org/download/mpow_mpbh456ab_driverforlinux/mpow_MPBH456AB_driver%2Bfor%2BLinux.tgz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yarema aka Knedlyk <yupadmin@gmail.com>
    
      2
    
      3_pkgname=rtl8761usb
    
      4pkgname="${_pkgname}-dkms"
    
      5pkgver=20200610
    
      6pkgrel=3
    
      7pkgdesc="Realtek bluetooth modules for RTL8761 usb based devices (DKMS)"
    
      8arch=('i686' 'x86_64' 'armv6h' 'armv7h')
    
      9url="https://www.xmpow.com/pages/download"
    
      10license=('unknown')
    
      11depends=('dkms' 'bc') #'linux-headers'
    
      12conflicts=("${_pkgname}" 'rtl8761b-fw')
    
      13#source=("https://mpow.s3-us-west-1.amazonaws.com/${pkgver}_mpow_BH456A_driver+for+Linux.7z"
    
      14source=("https://archive.org/download/mpow_mpbh456ab_driverforlinux/mpow_MPBH456AB_driver%2Bfor%2BLinux.tgz"
    
      15    "rtl8761usb.conf"
    
      16    "dkms.conf"
    
      17    "Makefile.patch"
    
      18    "rtk_bt.patch"
    
      19    "rtk_coex.patch"
    
      20    "rtk_misc.patch"
    
      21    )
    
      22
    
      23package() {
    
      24  cd ${srcdir}
    
      25
    
      26  local install_dir="${pkgdir}/usr/src/${_pkgname}-${pkgver}"
    
      27  # Copy dkms.conf
    
      28  install -Dm644 "${srcdir}/dkms.conf" "${install_dir}/dkms.conf"
    
      29
    
      30  # Blacklist btusb
    
      31  install -Dm644 "${srcdir}/rtl8761usb.conf" "${pkgdir}/etc/modprobe.d/rtl8761usb.conf"
    
      32
    
      33  # Copy firmware
    
      34  cd ${srcdir}/${pkgver}_LINUX_BT_DRIVER/rtkbt-firmware/
    
      35  for d in $(find . -type d);do install -dm755 "${pkgdir}/usr/$d";done
    
      36  for f in $(find . -type f);do install -m644 "$f" "${pkgdir}/usr/$f";done
    
      37
    
      38  # Set name and version
    
      39  sed -e "s/@PACKAGE_NAME@/${_pkgname}/" -e "s/@PACKAGE_VERSION@/${pkgver}/"  -i "${install_dir}/dkms.conf"
    
      40  # Copy sources
    
      41
    
      42#  cd "${_pkgname}-${pkgver}"
    
      43  cd ${srcdir}/${pkgver}_LINUX_BT_DRIVER/usb/bluetooth_usb_driver
    
      44#  sed -i 's/rtk_btusb/rtl8761usb/g'  Makefile
    
      45  patch --strip=0 < ${srcdir}/Makefile.patch
    
      46  patch --strip=0 < ${srcdir}/rtk_bt.patch
    
      47  patch --strip=0 < ${srcdir}/rtk_coex.patch
    
      48  patch --strip=0 < ${srcdir}/rtk_misc.patch
    
      49  for d in $(find . -type d);do install -dm755 "${install_dir}/$d";done
    
      50  for f in $(find . -type f);do install -m644 "$f" "${install_dir}/$f";done
    
      51}
    
      52sha256sums=('74001cd412363485751a8e11dda7de54919de51a74d7f060ce489d0a9291040b'
    
      53            '49fd7d83509ce7ec6797b987719ddbbc9168656374a360a35fe8a1ef8b52cee5'
    
      54            '9ff12db0338709ac3b1f6c2c8e14a9e715f89283da716ff83e71012136820027'
    
      55            'cce5da3c3c05ccac84bda25246200a80747da3f8ec5fb15be860b79c22a6414c'
    
      56            'aaa1a9a2ebe89139457f667bb545667b5cba591fd3ae10b5ca5632fd7c84639e'
    
      57            '574683ca3961ef9be849d4b95c61cee2dbf8460a59bac1a62b4f7db3cf308d16'
    
      58            'c433e32b6d5f00e3e70ffaffc0347b60d7ffd1926b0c9218a3567cf4a69839f6')
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2