rtl8852-eco4-dkms

MEDIUM

maintainer q234rty 0 votes scanned 2026-10-21 00:12:50.227280

View on AUR

Why flagged

The package downloads a Windows executable from Lenovo's official domain, which is not a standard source host for AUR packages; while Lenovo is a trusted vendor, the use of an unverifiable binary blob extracted via innoextract poses a supply-chain risk if the checksum were ever bypassed or compromised, warranting a medium severity due to the non-standard and unreviewable payload source.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 https://download.lenovo.com/consumer/mobiles/50s5010fpm3t3cj0.exe)

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a Windows executable from Lenovo's official domain, which is not a standard source host for AUR packages; while Lenovo is a trusted vendor, the use of an unverifiable binary blob extracted via innoextract poses a supply-chain risk if the checksum were ever bypassed or compromised, warranting a medium severity due to the non-standard and unreviewable payload source.

PKGBUILD

1 offending line(s) highlighted

      1_pkgbase=rtl8852-eco4
    
      2pkgname=rtl8852-eco4-dkms
    
      3pkgver=7.2.7
    
      4pkgrel=1
    
      5pkgdesc="Bluetooth driver for RTL8852 ECO Version 4 (DKMS)"
    
      6arch=('x86_64')
    
      7url="https://github.com/q234rty/rtl8852be-eco4-dkms"
    
      8license=('GPL-2.0-only' 'LicenseRef-Lenovo')
    
      9depends=('dkms')
    
      10makedepends=('git' 'innoextract')
    
      11source=("${_pkgbase}::git+https://github.com/q234rty/rtl8852be-eco4-dkms.git#tag=$pkgver"
    
      12        https://download.lenovo.com/consumer/mobiles/50s5010fpm3t3cj0.exe)
    
      13sha256sums=('2c9c0f75f5d9fcf06157f5ece97692c94a4cf7ddab850a478f3c86083ec72d6c'
    
      14            '1cbafaf1e2b224271ad05aacd0229929a2aadfb996a5e3ee6e1649d8a24a4c1e')
    
      15
    
      16prepare() {
    
      17  innoextract 50s5010fpm3t3cj0.exe
    
      18}
    
      19package() {
    
      20  install -dm755 "${pkgdir}"/usr/src/${_pkgbase}-${pkgver}/
    
      21  install -dm755 "${pkgdir}"/usr/lib/firmware/rtl_bt
    
      22  install -m644 'code$GetExtractPath$'/rtl8852bd_mp_chip_new.dat "${pkgdir}"/usr/lib/firmware/rtl_bt/rtl8852bu_fw.bin
    
      23  cp -r ${_pkgbase}/* "${pkgdir}"/usr/src/${_pkgbase}-${pkgver}/
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 00:18:51	Medium	2
2026-10-11 00:26:05	Medium	2
2026-10-10 00:11:52	Medium	2
2026-10-09 00:05:33	Medium	2
2026-10-08 00:28:03	Medium	2
2026-10-07 00:21:34	Medium	2
2026-10-06 00:13:36	Medium	2
2026-10-05 00:08:03	Medium	2
2026-10-04 00:18:08	Medium	2
2026-10-03 00:23:04	Medium	2
2026-10-02 00:00:32	Medium	2