microchip-libraries-for-applications
maintainer mawe
· 5 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a legitimate Microchip installer from the official microchip.com domain, which is plausibly the project's own source; despite the static analyzer flag for a non-standard host, the host is authentic and the installer is used in a controlled, scripted manner without executing arbitrary remote code.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a legitimate Microchip installer from the official microchip.com domain, which is plausibly the project's own source; despite the static analyzer flag for a non-standard host, the host is authentic and the installer is used in a controlled, scripted manner without executing arbitrary remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=(http://ww1.microchip.com/downloads/en/softwarelibrary/$_installer
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Markus Heidelberg <markus dot heidelberg at web dot de>
2
3
pkgname=microchip-libraries-for-applications
4
pkgver=v2018_11_26
5
pkgrel=1
6
pkgdesc="Microchip Libraries for Applications (Current)"
7
arch=('i686' 'x86_64')
8
url="http://www.microchip.com/MLA"
9
license=('custom')
10
optdepends=('java-runtime: Graphics and TCP/IP utilities support')
11
makedepends=('fakechroot')
12
makedepends_x86_64=('lib32-fakechroot' 'lib32-fakeroot')
13
depends_x86_64=('lib32-glibc')
14
options=(!strip libtool staticlibs emptydirs !zipman)
15
install=$pkgname.install
16
_instdir=/opt/microchip/mla
17
_installer=mla_${pkgver}_linux_installer.run
18
source=(http://ww1.microchip.com/downloads/en/softwarelibrary/$_installer
19
LICENSE)
20
21
md5sums=('03e25f57d341bc7cd1b843d416aab12c'
22
'a79e3095ffcc446517b27707c8a60d7b')
23
24
package() {
25
cd "$srcdir"
26
27
mkdir -p "$pkgdir"/{bin,etc,usr/{bin,lib,local/lib},tmp}
28
29
ln -s /bin/bash "$pkgdir/bin/"
30
31
echo "root:x:0:0:root:/root:/bin/bash" > "$pkgdir/etc/passwd"
32
echo "root:x:0:root" > "$pkgdir/etc/group"
33
34
cp "$srcdir/$_installer" "$pkgdir/"
35
chmod 0755 "$pkgdir/$_installer"
36
37
# 10x enter: read license
38
# 1x y + enter: accept license [y/n]
39
# 1x enter: accept installation directory
40
# 10x enter: select components [Y/n]
41
# 1x enter: confirm selection [Y/n]
42
# 1x enter: start installation [Y/n]
43
# 1x enter: continue
44
# 1x n + enter: download JRE [Y/n]
45
# 1x n + enter: open ReadMe [Y/n]
46
echo -e "\n\n\n\n\n\n\n\n\n\ny\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nn\nn" > "$pkgdir/inst_input"
47
48
# do not use $pkgdir$_instdir as installation directory because of the fakechroot environment
49
echo "#!/bin/bash
50
./$_installer --prefix "$_instdir" --mode text < inst_input &> /dev/null || true"> "$pkgdir/chroot_input.sh"
51
chmod 0755 "$pkgdir/chroot_input.sh"
52
53
echo -e "Creating the Package\n Please wait..."
54
55
fakechroot chroot "$pkgdir" ./chroot_input.sh
56
57
rm "$pkgdir"/{chroot_input.sh,inst_input,$_installer,etc/{group,passwd}}
58
rm -r "$pkgdir"/{bin,tmp}
59
60
# remove unwanted files created by the installer, already available in package "microchip-mplabx-bin"
61
rm -r "$pkgdir"/{etc,usr/{bin,lib,local}}
62
rm "$pkgdir$_instdir"/uninstall*
63
64
# fix totally messed up file permissions
65
find "$pkgdir$_instdir" -type d -exec chmod 0755 '{}' \;
66
find "$pkgdir$_instdir" -type f -exec chmod 0644 '{}' \;
67
68
install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
69
70
# executable files
71
install -d "$pkgdir/usr/bin"
72
73
# Graphics Resource Converter
74
cat << EOF > "$pkgdir/usr/bin/grc-current"
75
#!/bin/sh
76
java -jar "$_instdir/framework/gfx/utilities/grc/grc.jar" "\$@"
77
EOF
78
chmod 755 "$pkgdir/usr/bin/grc-current"
79
80
# External Memory Programmer
81
cat << EOF > "$pkgdir/usr/bin/memory_programmer-current"
82
#!/bin/sh
83
java -jar "$_instdir/framework/gfx/utilities/memory_programmer/memory_programmer.jar" "\$@"
84
EOF
85
chmod 755 "$pkgdir/usr/bin/memory_programmer-current"
86
87
# Microchip MPFS Generator
88
cat << EOF > "$pkgdir/usr/bin/mpfs2-current"
89
#!/bin/sh
90
java -jar "$_instdir/framework/tcpip/utilities/mpfs2/mpfs2.jar" "\$@"
91
EOF
92
chmod 755 "$pkgdir/usr/bin/mpfs2-current"
93
94
# Microchip TCPIP Discoverer
95
cat << EOF > "$pkgdir/usr/bin/tcpip_discoverer-current"
96
#!/bin/sh
97
java -jar "$_instdir/framework/tcpip/utilities/tcpip_discoverer/tcpip_discoverer.jar"
98
EOF
99
chmod 755 "$pkgdir/usr/bin/tcpip_discoverer-current"
100
}
101
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |