volterra-firmware

maintainer clover · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Several prebuilt binary firmware blobs (.mbn, .bin) are downloaded from a personal/unofficial host (files.ironrobin.net) rather than any official Microsoft or upstream firmware repository; while checksums are provided and the files are installed as firmware data (not executed directly by the build), these are unverifiable proprietary binaries from a swappable third-party host with no official provenance.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://files.ironrobin.net/microsoft/blackrock/qcadsp8280.mbn"

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 60%): Several prebuilt binary firmware blobs (.mbn, .bin) are downloaded from a personal/unofficial host (files.ironrobin.net) rather than any official Microsoft or upstream firmware repository; while checksums are provided and the files are installed as firmware data (not executed directly by the build), these are unverifiable proprietary binaries from a swappable third-party host with no official provenance.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=volterra-firmware
    
      2pkgdesc="Microsoft Dev Kit 2023 (Project Volterra) firmware"
    
      3pkgver=0.1.0
    
      4pkgrel=1
    
      5arch=('any')
    
      6license=('LicenseRef-proprietary')
    
      7makedepends=('zstd')
    
      8depends=(
    
      9  'linux-firmware-atheros'
    
      10  'linux-firmware-qcom'
    
      11)
    
      12options=(!strip)
    
      13
    
      14source=("https://files.ironrobin.net/microsoft/blackrock/qcadsp8280.mbn"
    
      15        "https://files.ironrobin.net/microsoft/blackrock/qccdsp8280.mbn"
    
      16        "qcdxkmsuc8280.mbn"
    
      17        "https://files.ironrobin.net/microsoft/blackrock/qcvss8280.mbn"
    
      18        "adspr.jsn"
    
      19        "adspua.jsn"
    
      20        "battmgr.jsn"
    
      21        "cdspr.jsn"
    
      22        "https://files.ironrobin.net/microsoft/blackrock/board-2.bin"
    
      23)
    
      24sha256sums=('bb8a55650bceaec09edadfde4bee54563f03fb072fa9807d91857e0a96b33310'
    
      25            '5da3feeb5ca7231c14a3dcfa1a137644f2955dca46909897334bb4012df06320'
    
      26            '38012c7a55da315f5ae345170da035be90d48b49d81eef9cdb982f5bcbce8e43'
    
      27            '3f4975f9f074707fbd702cc3998d09568cdfd1008c5c2f7877f91137c38c9ed9'
    
      28            '4b9566fcfdc1656c38d8158d79db6964e9c4b57a6e42b46241e8d63aabc42d8d'
    
      29            'd65dc1aedce2c1131da8ffaed7dcffc05cc9c58da491e0c39acb2ac5b3f4bc1d'
    
      30            'b8aad1d149128f414eb1fd6fcbb6e0a5b7dabcd2cba001599e1ce9a0e2e291a4'
    
      31            '7e46c515ab1bb012768be6e961eca69b1c8aad9af1cbac886b3b5ae8d4228f64'
    
      32            '736544b268c43181df3529ad0d8978a2c25bc5744d1bbcfae8bc4b0feb13687a')
    
      33
    
      34package() {
    
      35  local _qcom_dir="${pkgdir}/usr/lib/firmware/updates/qcom/sc8280xp/microsoft/blackrock"
    
      36  install -dm755 "${_qcom_dir}"
    
      37  install -m644 adspr.jsn adspua.jsn battmgr.jsn cdspr.jsn "${_qcom_dir}"
    
      38
    
      39  zstd -19 -k -f qcadsp8280.mbn
    
      40  zstd -19 -k -f qccdsp8280.mbn
    
      41  zstd -19 -k -f qcdxkmsuc8280.mbn
    
      42  zstd -19 -k -f qcvss8280.mbn
    
      43  install -m644 qcadsp8280.mbn.zst qccdsp8280.mbn.zst qcdxkmsuc8280.mbn.zst qcvss8280.mbn.zst "${_qcom_dir}"
    
      44
    
      45  # Override the distro-provided ath11k board file without conflicting with
    
      46  # linux-firmware-atheros, which owns the regular ath11k firmware tree.
    
      47  local _ath11k_dir="${pkgdir}/usr/lib/firmware/updates/ath11k/WCN6855"
    
      48  zstd -19 -k -f board-2.bin
    
      49  install -Dm644 board-2.bin.zst "${_ath11k_dir}/hw2.0/board-2.bin.zst"
    
      50
    
      51  # Volterra's WiFi card identifies itself as hw2.1 but uses the hw2.0 data.
    
      52  install -dm755 "${_ath11k_dir}/hw2.1"
    
      53  ln -s ../hw2.0/board-2.bin.zst "${_ath11k_dir}/hw2.1/board-2.bin.zst"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 21:57:21	MEDIUM	3
2026-07-17 21:55:56	MEDIUM	3