microchip-mplabxc8-bin

maintainer rexploits · 20 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a setuid binary (xclm) which can elevate privileges, flagged as a potential security risk during installation.

Triggered rules

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:55 chmod u+s "${pkgdir}/${_instdir}/bin/xclm"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a setuid binary (xclm) which can elevate privileges, flagged as a potential security risk during installation.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rex McKinnon <0xFF at rexploits dot com>
    
      2# Contributor: xiota
    
      3# Contributor: Grey Christoforo <first name at last name dot net>
    
      4# Contributer: mickael9 <mickael9 at gmail dot com>
    
      5
    
      6_number_of_bits=8
    
      7pkgname=microchip-mplabxc${_number_of_bits}-bin
    
      8pkgver=3.10
    
      9pkgrel=1
    
      10pkgdesc="Microchip's MPLAB XC${_number_of_bits} C compiler toolchain for their PIC10/12/16/18 microcontroller families and their PIC14000 device"
    
      11url="https://www.microchip.com/mplab/compilers"
    
      12license=('LicenseRef-MPLAB-XC-Unified')
    
      13arch=('x86_64')
    
      14
    
      15depends=(gcc-libs)
    
      16makedepends=(bitrock-unpacker tclkit)
    
      17
    
      18conflicts=(lib32-tclkit)
    
      19
    
      20install=$pkgname.install
    
      21
    
      22options=(!strip docs libtool emptydirs !zipman staticlibs)
    
      23
    
      24_dl_url="https://ww1.microchip.com"
    
      25_dl_path="downloads/aemDocuments/documents/DEV/ProductDocuments/SoftwareTools"
    
      26_dl_file="xc${_number_of_bits}-v${pkgver}-full-install-linux-x64-installer.run"
    
      27
    
      28source=("$_dl_file"::"$_dl_url/$_dl_path/$_dl_file")
    
      29sha256sums=('628803b96f468a5981d6bc1d0a5e6c7fa809e4d87e3cca961805e2a857f5846e')
    
      30
    
      31_instdir="opt/microchip/xc${_number_of_bits}/v${pkgver}"
    
      32
    
      33build() {
    
      34  echo "Unpacking files from installer"
    
      35  bitrock-unpacker "./$_dl_file" ./unpacked.vfs
    
      36}
    
      37
    
      38package() {
    
      39  mkdir -p "${pkgdir}/${_instdir}"
    
      40  mkdir -p "${pkgdir}/${_instdir}/etc"
    
      41  mv unpacked.vfs/compiler/programfiles*/* "${pkgdir}/${_instdir}"
    
      42  mv unpacked.vfs/licensecomponent/LinuxLMBin/bin/{roam.lic,xclm} "${pkgdir}/${_instdir}/bin"
    
      43  sed -i "s/<xclm>/<xclm>\n\t<xclm:LicenseDirectory xclm:path=\"\/opt\/microchip\/xclm\/license\/\" \/>/" \
    
      44    unpacked.vfs/licensecomponent/LinuxLMBin/etc/xclm.conf
    
      45  mv unpacked.vfs/licensecomponent/LinuxLMBin/etc/xclm.conf "${pkgdir}/${_instdir}/etc"
    
      46  mv "${pkgdir}/${_instdir}"/*License.txt "${pkgdir}/${_instdir}/docs" 2> /dev/null || true
    
      47
    
      48  mkdir -p "${pkgdir}/etc/profile.d"
    
      49  echo "export PATH=\"\$PATH\":'/${_instdir}/bin'" > "${pkgdir}/etc/profile.d/${pkgname}.sh"
    
      50  echo "export XC${_number_of_bits}_TOOLCHAIN_ROOT='/${_instdir}'" >> "${pkgdir}/etc/profile.d/${pkgname}.sh"
    
      51
    
      52  mkdir -p "${pkgdir}/usr/share/licenses/${pkgname}"
    
      53  ln -s "/${_instdir}/docs/$(basename "${pkgdir}/${_instdir}/docs"/*[Ll]icense.txt)" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      54
    
      55  chmod u+s "${pkgdir}/${_instdir}/bin/xclm"
    
      56  chmod +x "${pkgdir}/${_instdir}/pic/bin/clang"
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 21:52:49	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0