xone-dongle-firmware
maintainer xiota
· 28 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads firmware CAB files from Microsoft's official update catalog domain, which is a legitimate source for this type of data; the files are verified with sha256sums and installed as firmware, not executed, making the risk low despite the non-whitelisted host.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads firmware CAB files from Microsoft's official update catalog domain, which is a legitimate source for this type of data; the files are verified with sha256sums and installed as firmware, not executed, making the risk low despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:37
"$_pkgsrc_1.$_pkgext"::"https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2017/03/2ea9591b-f751-442c-80ce-8f4692cdc67b_6b555a3a288153cf04aec6e03cba360afe2fce34.cab"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: xiota
2
# Contributor: Michał Kopeć <michal (at) nozomi.space>
3
# Contributor: Tomasz Pakuła <tomasz.pakula.oficjalny (at) gmail.com>
4
5
# https://www.catalog.update.microsoft.com/Search.aspx?q=xbox+adapter
6
# https://github.com/dlundqvist/xone/blob/master/install/firmware.sh
7
8
: ${_build_license:=true}
9
10
pkgname=xone-dongle-firmware
11
pkgver=2.0.0
12
pkgrel=1
13
pkgdesc="Xbox Wireless Controller Adapter firmware"
14
url="https://support.xbox.com/en-US/help/hardware-network/browse"
15
license=('LicenseRef-Microsoft')
16
arch=('any')
17
18
makedepends=(
19
'html-xml-utils'
20
'w3m'
21
)
22
23
_pkgsrc_1="xone_dongle_02e6"
24
_pkgsrc_2="xone_dongle_02fe"
25
_pkgsrc_3="xone_dongle_02f9"
26
_pkgsrc_4="xone_dongle_091e"
27
_pkgext="cab"
28
29
noextract=(
30
"$_pkgsrc_1.$_pkgext"
31
"$_pkgsrc_2.$_pkgext"
32
"$_pkgsrc_3.$_pkgext"
33
"$_pkgsrc_4.$_pkgext"
34
)
35
36
source=(
37
"$_pkgsrc_1.$_pkgext"::"https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2017/03/2ea9591b-f751-442c-80ce-8f4692cdc67b_6b555a3a288153cf04aec6e03cba360afe2fce34.cab"
38
"$_pkgsrc_2.$_pkgext"::"https://catalog.s.download.windowsupdate.com/c/msdownload/update/driver/drvs/2017/07/1cd6a87c-623f-4407-a52d-c31be49e925c_e19f60808bdcbfbd3c3df6be3e71ffc52e43261e.cab"
39
"$_pkgsrc_3.$_pkgext"::"https://catalog.s.download.windowsupdate.com/c/msdownload/update/driver/drvs/2017/06/1dbd7cb4-53bc-4857-a5b0-5955c8acaf71_9081931e7d664429a93ffda0db41b7545b7ac257.cab"
40
"$_pkgsrc_4.$_pkgext"::"https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2017/08/aeff215c-3bc4-4d36-a3ea-e14bfa8fa9d2_e58550c4f74a27e51e5cb6868b10ff633fa77164.cab"
41
)
42
sha256sums=('d89a72e8dc10b7c4f16d5c887fe7f54c34c22005ac1f360704d5d9462258ef32'
43
'65736a84ff4036645b8f8ec602bed91ab6353019c9cb3233decab9feec0f6f04'
44
'90dd91fb67460d387407fd8109c0e7d0f18f4b659be0f62db858a1849ead2ee0'
45
'5a8fbad9521e58cc697a8734720ca497673098022d61d91a88be433002ccd8f2')
46
47
_terms_of_use="terms_of_use"
48
_terms_of_use_url="https://www.microsoft.com/en-us/legal/terms-of-use"
49
50
prepare() {
51
# extract files
52
for i in "${noextract[@]}"; do
53
mkdir -p "${i%.*}"
54
bsdtar -C "${i%.*}" -xf "$i"
55
done
56
57
# terms of use
58
if [[ "${_build_license::1}" == "t" ]]; then
59
curl -L --max-redirs 3 --no-progress-meter \
60
-o "$_terms_of_use-1.html" \
61
"$_terms_of_use_url"
62
63
hxnormalize -x "$_terms_of_use-1.html" \
64
| hxselect .row,.container \
65
| hxremove script \
66
1> "$_terms_of_use-2.html" \
67
2> /dev/null
68
69
w3m -O UTF-8 -cols 80 -dump "$_terms_of_use-2.html" > "$_terms_of_use.txt"
70
fi
71
}
72
73
check() {
74
sha256sum -c /dev/stdin << END
75
080ce4091e53a4ef3e5fe29939f51fd91f46d6a88be6d67eb6e99a5723b3a223 $_pkgsrc_1/FW_ACC_00U.bin
76
48084d9fa53b9bb04358f3bb127b7495dc8f7bb0b3ca1437bd24ef2b6eabdf66 $_pkgsrc_2/FW_ACC_00U.bin
77
0023a7bae02974834500c665a281e25b1ba52c9226c84989f9084fa5ce591d9b $_pkgsrc_3/FW_ACC_CL.bin
78
e2710daf81e7b36d35985348f68a81d18bc537a2b0c508ffdfde6ac3eae1bad7 $_pkgsrc_4/FW_ACC_BR.bin
79
END
80
}
81
82
package() {
83
install -Dm644 "$_pkgsrc_1/FW_ACC_00U.bin" "$pkgdir/usr/lib/firmware/xone_dongle_02e6.bin"
84
install -Dm644 "$_pkgsrc_2/FW_ACC_00U.bin" "$pkgdir/usr/lib/firmware/xone_dongle_02fe.bin"
85
install -Dm644 "$_pkgsrc_3/FW_ACC_CL.bin" "$pkgdir/usr/lib/firmware/xone_dongle_02f9.bin"
86
install -Dm644 "$_pkgsrc_4/FW_ACC_BR.bin" "$pkgdir/usr/lib/firmware/xone_dongle_091e.bin"
87
88
if [[ "${_build_license::1}" == "t" ]]; then
89
install -Dm644 "$_terms_of_use.txt" -t "$pkgdir/usr/share/licenses/$pkgname/"
90
fi
91
}
92
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |