xone-dongle-firmware-bin
maintainer viktororsos
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
Downloads firmware .cab files from Microsoft's official Windows Update CDN (catalog.s.download.windowsupdate.com) with SHA256 checksums and an additional check() step verifying the extracted .bin files; the only concern is a missing checksum for the 'compressor' local file and a runtime curl fetch of Microsoft's terms-of-use page, but no unreviewed code is executed and the installed payload is pure firmware data.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads firmware .cab files from Microsoft's official Windows Update CDN (catalog.s.download.windowsupdate.com) with SHA256 checksums and an additional check() step verifying the extracted .bin files; the only concern is a missing checksum for the 'compressor' local file and a runtime curl fetch of Microsoft's terms-of-use page, but no unreviewed code is executed and the installed payload is pure firmware data.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:37
"$_pkgsrc_1.$_pkgext"::"https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2017/03/2ea9591b-f751-442c-80ce-8f4692cdc67b_6b555a3a288153cf04aec6e03cba360afe2fce34.cab"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: xiota
2
# Contributor: Michał Kopeć <michal (at) nozomi.space>
3
# Contributor: Tomasz Pakuła <tomasz.pakula.oficjalny (at) gmail.com>
4
5
# https://www.catalog.update.microsoft.com/Search.aspx?q=xbox+adapter
6
# https://github.com/dlundqvist/xone/blob/master/install/firmware.sh
7
8
: ${_build_license:=true}
9
10
pkgname=xone-dongle-firmware-bin
11
pkgver=2.0.0
12
pkgrel=1
13
pkgdesc="Xbox Wireless Controller Adapter firmware"
14
url="https://support.xbox.com/en-US/help/hardware-network/browse"
15
license=('LicenseRef-Microsoft')
16
arch=('any')
17
18
makedepends=(
19
'html-xml-utils'
20
'w3m'
21
)
22
23
_pkgsrc_1="xone_dongle_02e6"
24
_pkgsrc_2="xone_dongle_02fe"
25
_pkgsrc_3="xone_dongle_02f9"
26
_pkgsrc_4="xone_dongle_091e"
27
_pkgext="cab"
28
29
noextract=(
30
"$_pkgsrc_1.$_pkgext"
31
"$_pkgsrc_2.$_pkgext"
32
"$_pkgsrc_3.$_pkgext"
33
"$_pkgsrc_4.$_pkgext"
34
)
35
36
source=(
37
"$_pkgsrc_1.$_pkgext"::"https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2017/03/2ea9591b-f751-442c-80ce-8f4692cdc67b_6b555a3a288153cf04aec6e03cba360afe2fce34.cab"
38
"$_pkgsrc_2.$_pkgext"::"https://catalog.s.download.windowsupdate.com/c/msdownload/update/driver/drvs/2017/07/1cd6a87c-623f-4407-a52d-c31be49e925c_e19f60808bdcbfbd3c3df6be3e71ffc52e43261e.cab"
39
"$_pkgsrc_3.$_pkgext"::"https://catalog.s.download.windowsupdate.com/c/msdownload/update/driver/drvs/2017/06/1dbd7cb4-53bc-4857-a5b0-5955c8acaf71_9081931e7d664429a93ffda0db41b7545b7ac257.cab"
40
'compressor'
41
"$_pkgsrc_4.$_pkgext"::"https://catalog.s.download.windowsupdate.com/d/msdownload/update/driver/drvs/2017/08/aeff215c-3bc4-4d36-a3ea-e14bfa8fa9d2_e58550c4f74a27e51e5cb6868b10ff633fa77164.cab"
42
)
43
sha256sums=('d89a72e8dc10b7c4f16d5c887fe7f54c34c22005ac1f360704d5d9462258ef32'
44
'65736a84ff4036645b8f8ec602bed91ab6353019c9cb3233decab9feec0f6f04'
45
'90dd91fb67460d387407fd8109c0e7d0f18f4b659be0f62db858a1849ead2ee0'
46
'5a8fbad9521e58cc697a8734720ca497673098022d61d91a88be433002ccd8f2')
47
48
_terms_of_use="terms_of_use"
49
_terms_of_use_url="https://www.microsoft.com/en-us/legal/terms-of-use"
50
51
prepare() {
52
# extract files
53
for i in "${noextract[@]}"; do
54
mkdir -p "${i%.*}"
55
bsdtar -C "${i%.*}" -xf "$i"
56
done
57
58
# terms of use
59
if [[ "${_build_license::1}" == "t" ]]; then
60
curl -L --max-redirs 3 --no-progress-meter \
61
-o "$_terms_of_use-1.html" \
62
"$_terms_of_use_url"
63
64
hxnormalize -x "$_terms_of_use-1.html" \
65
| hxselect .row,.container \
66
| hxremove script \
67
1> "$_terms_of_use-2.html" \
68
2> /dev/null
69
70
w3m -O UTF-8 -cols 80 -dump "$_terms_of_use-2.html" > "$_terms_of_use.txt"
71
fi
72
}
73
74
check() {
75
sha256sum -c /dev/stdin << END
76
080ce4091e53a4ef3e5fe29939f51fd91f46d6a88be6d67eb6e99a5723b3a223 $_pkgsrc_1/FW_ACC_00U.bin
77
48084d9fa53b9bb04358f3bb127b7495dc8f7bb0b3ca1437bd24ef2b6eabdf66 $_pkgsrc_2/FW_ACC_00U.bin
78
0023a7bae02974834500c665a281e25b1ba52c9226c84989f9084fa5ce591d9b $_pkgsrc_3/FW_ACC_CL.bin
79
e2710daf81e7b36d35985348f68a81d18bc537a2b0c508ffdfde6ac3eae1bad7 $_pkgsrc_4/FW_ACC_BR.bin
80
END
81
}
82
83
package() {
84
install -Dm644 "$_pkgsrc_1/FW_ACC_00U.bin" "$pkgdir/usr/lib/firmware/xone_dongle_02e6.bin"
85
install -Dm644 "$_pkgsrc_2/FW_ACC_00U.bin" "$pkgdir/usr/lib/firmware/xone_dongle_02fe.bin"
86
install -Dm644 "$_pkgsrc_3/FW_ACC_CL.bin" "$pkgdir/usr/lib/firmware/xone_dongle_02f9.bin"
87
install -Dm644 "$_pkgsrc_4/FW_ACC_BR.bin" "$pkgdir/usr/lib/firmware/xone_dongle_091e.bin"
88
89
if [[ "${_build_license::1}" == "t" ]]; then
90
install -Dm644 "$_terms_of_use.txt" -t "$pkgdir/usr/share/licenses/xone-dongle-firmware-bin/"
91
fi
92
}
93
94
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 13:24:03 | LOW | 3 |
| 2026-08-01 13:20:32 | MEDIUM | 2 |