rtl8852-eco4-dkms

LOW

maintainer q234rty 0 votes scanned 2026-09-06 11:12:46.148428

View on AUR

Why flagged

Downloads a Lenovo firmware installer from Lenovo's official domain (download.lenovo.com) with a pinned SHA256 checksum, extracts a firmware blob (non-executed data) using innoextract, and installs a DKMS kernel module from the project's own GitHub repo; no obfuscation, no untrusted hosts, no credential exfiltration.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a Lenovo firmware installer from Lenovo's official domain (download.lenovo.com) with a pinned SHA256 checksum, extracts a firmware blob (non-executed data) using innoextract, and installs a DKMS kernel module from the project's own GitHub repo; no obfuscation, no untrusted hosts, no credential exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 https://download.lenovo.com/consumer/mobiles/50s5010fpm3t3cj0.exe)

PKGBUILD

1 offending line(s) highlighted

      1_pkgbase=rtl8852-eco4
    
      2pkgname=rtl8852-eco4-dkms
    
      3pkgver=7.2
    
      4pkgrel=2
    
      5pkgdesc="Bluetooth driver for RTL8852 ECO Version 4 (DKMS)"
    
      6arch=('x86_64')
    
      7url="https://github.com/q234rty/rtl8852be-eco4-dkms"
    
      8license=('GPL-2.0-only' 'LicenseRef-Lenovo')
    
      9depends=('dkms')
    
      10makedepends=('git' 'innoextract')
    
      11source=("${_pkgbase}::git+https://github.com/q234rty/rtl8852be-eco4-dkms.git#tag=$pkgver"
    
      12        https://download.lenovo.com/consumer/mobiles/50s5010fpm3t3cj0.exe)
    
      13sha256sums=('d8eeee2ad06f4113025192adbe27c487197704e70c9859d5e7fd593918037310'
    
      14            '1cbafaf1e2b224271ad05aacd0229929a2aadfb996a5e3ee6e1649d8a24a4c1e')
    
      15
    
      16prepare() {
    
      17  innoextract 50s5010fpm3t3cj0.exe
    
      18}
    
      19package() {
    
      20  install -dm755 "${pkgdir}"/usr/src/${_pkgbase}-${pkgver}/
    
      21  install -dm755 "${pkgdir}"/usr/lib/firmware/rtl_bt
    
      22  install -m644 'code$GetExtractPath$'/rtl8852bd_mp_chip_new.dat "${pkgdir}"/usr/lib/firmware/rtl_bt/rtl8852bu_fw.bin
    
      23  cp -r ${_pkgbase}/* "${pkgdir}"/usr/src/${_pkgbase}-${pkgver}/
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-06 11:12:46	Low	3
2026-09-06 11:10:51	Medium	3