microchip-libraries-for-applications-legacy
LOW
maintainer mawe
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a legitimate Microchip installer from the official microchip.com domain, which is plausibly the project's own source; despite the static analyzer flag for a non-standard host, the installer is a vendor-provided binary used to build the package, and no untrusted or obfuscated code is executed.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a legitimate Microchip installer from the official microchip.com domain, which is plausibly the project's own source; despite the static analyzer flag for a non-standard host, the installer is a vendor-provided binary used to build the package, and no untrusted or obfuscated code is executed.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=(http://ww1.microchip.com/downloads/en/softwarelibrary/$_installer
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Markus Heidelberg <markus dot heidelberg at web dot de>
2
3
pkgname=microchip-libraries-for-applications-legacy
4
pkgver=v2013_06_15
5
pkgrel=4
6
pkgdesc="Microchip Libraries for Applications (Legacy)"
7
arch=('i686' 'x86_64')
8
url="http://www.microchip.com/MLA"
9
license=('custom')
10
optdepends=('java-runtime: Graphics and TCP/IP utilities support')
11
makedepends=('fakechroot')
12
makedepends_x86_64=('lib32-fakechroot' 'lib32-fakeroot')
13
depends_x86_64=('lib32-glibc')
14
options=(!strip libtool staticlibs emptydirs !zipman)
15
install=$pkgname.install
16
_instdir=/opt/microchip_solutions
17
_installer=${pkgname//-legacy/}-${pkgver//_/-}-linux-installer.run
18
source=(http://ww1.microchip.com/downloads/en/softwarelibrary/$_installer
19
LICENSE)
20
21
md5sums=('d3d6597c7aebe122325dd491b41022d6'
22
'dd2eec20ed33d2924fa301cea78467fa')
23
24
package() {
25
cd "$srcdir"
26
27
mkdir -p "$pkgdir"/{bin,etc,usr/{bin,lib,local/lib},tmp}
28
29
ln -s /bin/bash "$pkgdir/bin/"
30
31
echo "root:x:0:0:root:/root:/bin/bash" > "$pkgdir/etc/passwd"
32
echo "root:x:0:root" > "$pkgdir/etc/group"
33
34
cp "$srcdir/$_installer" "$pkgdir/"
35
chmod 0755 "$pkgdir/$_installer"
36
37
# 10x enter: read license
38
# 1x y + enter: accept license [y/n]
39
# 1x enter: accept installation directory
40
# 13x enter: select components [Y/n]
41
# 1x enter: confirm selection [Y/n]
42
# 1x enter: start installation [Y/n]
43
# 1x enter: continue
44
# 1x n + enter: download JRE [Y/n]
45
# 1x n + enter: open ReadMe [Y/n]
46
echo -e "\n\n\n\n\n\n\n\n\n\ny\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nn\nn" > "$pkgdir/inst_input"
47
48
# do not use $pkgdir$_instdir as installation directory because of the fakechroot environment
49
echo "#!/bin/bash
50
./$_installer --prefix "$_instdir" --mode text < inst_input &> /dev/null || true"> "$pkgdir/chroot_input.sh"
51
chmod 0755 "$pkgdir/chroot_input.sh"
52
53
echo -e "Creating the Package\n Please wait..."
54
55
fakechroot chroot "$pkgdir" ./chroot_input.sh
56
57
rm "$pkgdir"/{chroot_input.sh,inst_input,$_installer,etc/{group,passwd}}
58
rm -r "$pkgdir"/{bin,tmp}
59
60
# remove unwanted files created by the installer, already available in package "microchip-mplabx-bin"
61
rm -r "$pkgdir"/{etc,usr/{bin,lib,local}}
62
rm "$pkgdir$_instdir"/Uninstall*
63
64
# fix totally messed up file permissions
65
find "$pkgdir$_instdir" -type d -exec chmod 0755 '{}' \; -exec chmod ug-s '{}' \;
66
find "$pkgdir$_instdir" -type f -exec chmod 0644 '{}' \;
67
68
install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
69
70
# executable files
71
install -d "$pkgdir/usr/bin"
72
73
# Graphics Resource Converter
74
cat << EOF > "$pkgdir/usr/bin/grc-legacy"
75
#!/bin/sh
76
java -jar "$_instdir/Microchip/Graphics/bin/grc/grc.jar" "\$@"
77
EOF
78
chmod 755 "$pkgdir/usr/bin/grc-legacy"
79
80
# External Memory Programmer
81
cat << EOF > "$pkgdir/usr/bin/memory_programmer-legacy"
82
#!/bin/sh
83
java -jar "$_instdir/Microchip/Graphics/bin/memory_programmer/memory_programmer.jar" "\$@"
84
EOF
85
chmod 755 "$pkgdir/usr/bin/memory_programmer-legacy"
86
87
# Microchip 2 Binary Information Base
88
cat << EOF > "$pkgdir/usr/bin/mib2bib"
89
#!/bin/sh
90
java -jar "$_instdir/Microchip/TCPIP Stack/Utilities/mib2bib.jar" "\$@"
91
EOF
92
chmod 755 "$pkgdir/usr/bin/mib2bib"
93
94
# Microchip MPFS Generator
95
cat << EOF > "$pkgdir/usr/bin/mpfs2"
96
#!/bin/sh
97
java -jar "$_instdir/Microchip/TCPIP Stack/Utilities/MPFS2.jar" "\$@"
98
EOF
99
chmod 755 "$pkgdir/usr/bin/mpfs2"
100
101
# Microchip Hash Table Filter Entry Calculator"
102
cat << EOF > "$pkgdir/usr/bin/hash_calculator"
103
#!/bin/sh
104
java -jar "$_instdir/Microchip/TCPIP Stack/Utilities/Hash Calculator.jar"
105
EOF
106
chmod 755 "$pkgdir/usr/bin/hash_calculator"
107
108
# Microchip TCPIP Discoverer
109
cat << EOF > "$pkgdir/usr/bin/tcpip_discoverer"
110
#!/bin/sh
111
java -jar "$_instdir/Microchip/TCPIP Stack/Utilities/TCPIP Discoverer.jar"
112
EOF
113
chmod 755 "$pkgdir/usr/bin/tcpip_discoverer"
114
}
115
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |