upd72020x-fw-bin

maintainer traudlnette · 11 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a firmware binary (.mem file) and a license from a maintainer-hosted tarball on a personal Gitea instance (disroot.org), which is non-official but plausibly the maintainer's own packaging repo; the firmware itself is pure data installed to /usr/lib/firmware and never executed directly by the build, and the checksums are provided, though the sha512sums array appears to have only 2 entries for 3 sources (missing one), which is a quality issue but not malicious.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The package installs a firmware binary (.mem file) and a license from a maintainer-hosted tarball on a personal Gitea instance (disroot.org), which is non-official but plausibly the maintainer's own packaging repo; the firmware itself is pure data installed to /usr/lib/firmware and never executed directly by the build, and the checksums are provided, though the sha512sums array appears to have only 2 entries for 3 sources (missing one), which is a quality issue but not malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "uPD72020x-Firmware-$_tarballver.tar.gz::https://git.disroot.org/glektarssza/aur-upd72020x-fw/releases/download/v1.0.0-3/uPD72020x-Firmware-$_tarballver.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: M. Damian "G'lek" Mulligan <glek (at) glektarssza (dot) com>
    
      2# Contributor: Jack Chen <redchenjs@live.com>
    
      3
    
      4pkgname=upd72020x-fw-bin
    
      5pkgver=1.1.0
    
      6pkgrel=2
    
      7epoch=1
    
      8pkgdesc="Renesas uPD720201 / uPD720202 USB 3.0 chipsets firmware"
    
      9arch=('any')
    
      10url="https://git.disroot.org/glektarssza/aur-upd72020x-fw"
    
      11license=('custom')
    
      12_tarballver=1.0.0
    
      13source=(
    
      14    "uPD72020x-Firmware-$_tarballver.tar.gz::https://git.disroot.org/glektarssza/aur-upd72020x-fw/releases/download/v1.0.0-3/uPD72020x-Firmware-$_tarballver.tar.gz"
    
      15    'validator'
    
      16    "remove.hook"
    
      17)
    
      18sha512sums=(
    
      19    '9d7e61c99a0f46d0ae96505317e763a468d3e8006f7398d10899ab78532b1ace608662b8a1b410a5577b268dc1f9275d1ebe3d03d209b85b2c4307ceb48dd261'
    
      20    '47aa4c4c3a0014df79b7a7998edfbc7b436ae6e966432f3787d9f1655c986591c73165de6fad52ebb5cefd4f8101b9b094d117f0508cd1f8f0d2c7396bbd3f91'
    
      21)
    
      22
    
      23package() {
    
      24    install -Dm644 "uPD72020x-Firmware-$_tarballver/UPDATE.mem" "$pkgdir/usr/lib/firmware/renesas_usb_fw.mem"
    
      25    install -Dm644 "uPD72020x-Firmware-$_tarballver/License.rtf" "$pkgdir/usr/share/licenses/upd72020x-fw-bin/LICENSE.rtf"
    
      26
    
      27    # firmware install & remove hooks
    
      28    install -Dm644 /dev/null "$pkgdir/usr/lib/initcpio/hooks/upd72020x-fw-bin"
    
      29    install -Dm644 remove.hook "$pkgdir/usr/share/libalpm/hooks/upd72020x-fw-bin.hook"
    
      30}
    
      31
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 11:24:03	LOW	3
2026-08-01 11:20:22	MEDIUM	2