mounriver-studio-toolchain-riscv-gcc15-bin

maintainer taotieren · 4 votes · base mounriver-studio-toolchain-bin · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD deliberately bypasses the standard Arch source/checksum mechanism by placing an empty dummy file (zero-byte, known SHA256 e3b0c44...) in source=() purely to satisfy tooling checks, while the actual toolchain tarball — containing compiled GCC toolchains and OpenOCD binaries that will be installed and executed — is fetched at build time via two unauthenticated HTTP/HTTPS calls to api.mounriver.com in prepare(). The downloaded binary is never checksummed or signature-verified. This is a genuine supply-chain concern: if the MounRiver API or download host is compromised or returns a different binary, users will silently install and execute malicious compiled toolchains. The API endpoint also uses plain HTTP for the first call (http://api.mounriver.com/...), making it trivially MITM-able on the network. The vendor (WCH/MounRiver) is a real Chinese embedded-tools company and the package is for a legitimate embedded development toolchain, so this is not clearly malicious, but the pattern of intentionally circumventing integrity checks to download and install executed binaries from a remote API is a textbook medium-severity supply-chain risk.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:45 local _info_json=$(curl -s "http://api.mounriver.com/mountriver/api/version/fetchRecentOpenOcd?osType=LINUX&lang=zh")
PKGBUILD:59 local _dl_json=$(curl -s "https://api.mounriver.com/mountriver/api/version/getDownloadUrl?resourceId=${_soft_id}")

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 source=('https://ipfs.io/ipfs/QmbFMke1KXqnYyBBWxB74N4c5SBnJMVAiMNRcGu6x1AwQH')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD deliberately bypasses the standard Arch source/checksum mechanism by placing an empty dummy file (zero-byte, known SHA256 e3b0c44...) in source=() purely to satisfy tooling checks, while the actual toolchain tarball — containing compiled GCC toolchains and OpenOCD binaries that will be installed and executed — is fetched at build time via two unauthenticated HTTP/HTTPS calls to api.mounriver.com in prepare(). The downloaded binary is never checksummed or signature-verified. This is a genuine supply-chain concern: if the MounRiver API or download host is compromised or returns a different binary, users will silently install and execute malicious compiled toolchains. The API endpoint also uses plain HTTP for the first call (http://api.mounriver.com/...), making it trivially MITM-able on the network. The vendor (WCH/MounRiver) is a real Chinese embedded-tools company and the package is for a legitimate embedded development toolchain, so this is not clearly malicious, but the pattern of intentionally circumventing integrity checks to download and install executed binaries from a remote API is a textbook medium-severity supply-chain risk.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2# Maintainer: yjun <jerrysteve1101 at gmail dot com>
    
      3
    
      4pkgbase=mounriver-studio-toolchain-bin
    
      5pkgname=($pkgbase
    
      6    mounriver-studio-toolchain-openocd-bin
    
      7    mounriver-studio-toolchain-arm-none-eabi-gcc-bin
    
      8    mounriver-studio-toolchain-riscv-gcc-bin
    
      9    mounriver-studio-toolchain-riscv-gcc12-bin
    
      10    mounriver-studio-toolchain-riscv-gcc15-bin)
    
      11pkgver=240
    
      12pkgrel=5
    
      13arch=('x86_64')
    
      14url='http://www.mounriver.com/'
    
      15license=('LicenseRef-custom')
    
      16provides=('MRS-Toolchain')
    
      17makedepends=('tar' 'jq' 'curl')
    
      18optdepends=(
    
      19    'ch34x-dkms-git: CH341SER driver with fixed bug'
    
      20    'i2c-ch341-dkms: CH341 USB-I2C adapter driver'
    
      21    'ch341eepromtool: An i2c serial EEPROM programming tool for the WCH CH341A'
    
      22    'ch341prog-git: A simple command line tool (programmer) interfacing with ch341a'
    
      23    'ch341eeprom-git: A libusb based programming tool for 24xx I²C EEPROMs using the WCH CH341A'
    
      24    'ch343ser-dkms: USB serial driver for ch342/ch343/ch344/ch347/ch347f/ch9101/ch9102/ch9103/ch9104, etc (dkms).'
    
      25    'wchisp: WCH ISP Tool in Rust'
    
      26    'imsprog: MSProg - software for CH341A-based programmers to work with I2C, SPI and MicroWire EEPROM/Flash chips'
    
      27    'sfp-master: SFP-module programmer for CH341a devices'
    
      28)
    
      29# empty dummy file hosted on IPFS to satisfy updpkgsums/lilac checks
    
      30# the content hash is guaranteed to be immutable
    
      31# the real source file is downloaded dynamically in prepare() due to short-lived URL signatures
    
      32source=('https://ipfs.io/ipfs/QmbFMke1KXqnYyBBWxB74N4c5SBnJMVAiMNRcGu6x1AwQH')
    
      33sha256sums=('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')
    
      34options=('!strip')
    
      35noextract=()
    
      36_pkgbase=MRS_Toolchain_Linux_X64_V${pkgver}
    
      37
    
      38_install() {
    
      39    find ${@:2} -type f -exec install -Dm$1 {} ${pkgdir}/opt/wch/${pkgname%-bin}/{} \;
    
      40}
    
      41
    
      42# automatic version detection & download via MounRiver API
    
      43prepare() {
    
      44    msg "Querying MounRiver API for the latest Linux version..."
    
      45    local _info_json=$(curl -s "http://api.mounriver.com/mountriver/api/version/fetchRecentOpenOcd?osType=LINUX&lang=zh")
    
      46
    
      47    local _soft_id=$(echo "${_info_json}" | jq -r '.result[0].softResId')
    
      48    local _filename=$(echo "${_info_json}" | jq -r '.result[0].fileName')
    
      49    local _api_version=$(echo "${_info_json}" | jq -r '.result[0].version')
    
      50
    
      51    if [[ "${_soft_id}" == "null" || -z "${_soft_id}" ]]; then
    
      52        error "Failed to retrieve software ID from API."
    
      53        return 1
    
      54    fi
    
      55
    
      56    msg "Found Version: ${_api_version} (File: ${_filename}, ID: ${_soft_id})"
    
      57
    
      58    msg "Fetching dynamic download link..."
    
      59    local _dl_json=$(curl -s "https://api.mounriver.com/mountriver/api/version/getDownloadUrl?resourceId=${_soft_id}")
    
      60    local _dl_url=$(echo "${_dl_json}" | jq -r '.data // .result')
    
      61
    
      62    if [[ "${_dl_url}" == "null" || -z "${_dl_url}" || "${_dl_url}" != http* ]]; then
    
      63        error "Failed to retrieve valid download URL."
    
      64        return 1
    
      65    fi
    
      66
    
      67    if [ ! -f "${_filename}" ]; then
    
      68        msg "Downloading ${_filename}..."
    
      69        curl -L -o "${_filename}" "${_dl_url}"
    
      70    else
    
      71        msg "File ${_filename} already exists, skipping download."
    
      72    fi
    
      73
    
      74    # Cleanup old extraction
    
      75    local _old_dir=$(find . -maxdepth 1 -mindepth 1 -type d -print -quit)
    
      76    if [ -n "$_old_dir" ]; then
    
      77        rm -rf "$_old_dir"
    
      78    fi
    
      79
    
      80    mkdir -pv ${srcdir}/${_pkgbase}
    
      81    msg "Extracting ${_filename}..."
    
      82    tar -xf "${_filename}" -C ${srcdir}/${_pkgbase}
    
      83}
    
      84
    
      85package_mounriver-studio-toolchain-bin() {
    
      86    pkgdesc="This MRS Toolchain includes the tool chain for RISC-V kernel chip under Linux x64 and the debug download tool OpenOCD."
    
      87    depends=(
    
      88        mounriver-studio-toolchain-openocd-bin
    
      89        mounriver-studio-toolchain-arm-none-eabi-gcc-bin
    
      90        mounriver-studio-toolchain-riscv-gcc-bin
    
      91        mounriver-studio-toolchain-riscv-gcc12-bin
    
      92        mounriver-studio-toolchain-riscv-gcc15-bin)
    
      93}
    
      94
    
      95package_mounriver-studio-toolchain-openocd-bin() {
    
      96    depends=('bash'
    
      97        'glibc'
    
      98        'libftdi-compat'
    
      99        'libusb'
    
      100        'hidapi'
    
      101        'libusb-compat'
    
      102        'libudev.so'
    
      103        'libjaylink.so')
    
      104
    
      105    pkgdesc="MRS Toolchain OpenOCD supports erasure, programming, verification and debugging of the chip."
    
      106
    
      107    cd "${srcdir}"/${_pkgbase}/OpenOCD/OpenOCD/
    
      108    _install 644 bin -name "*.cfg"
    
      109    _install 755 bin -name "openocd"
    
      110    _install 644 share
    
      111
    
      112    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/openocd-wch-arm" <<EOF
    
      113#!/bin/env bash
    
      114exec /opt/wch/${pkgname%-bin}/bin/openocd -f /opt/wch/${pkgname%-bin}/bin/wch-arm.cfg "\$@"
    
      115
    
      116EOF
    
      117
    
      118    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/openocd-wch-riscv" <<EOF
    
      119#!/bin/env bash
    
      120exec /opt/wch/${pkgname%-bin}/bin/openocd -f /opt/wch/${pkgname%-bin}/bin/wch-riscv.cfg "\$@"
    
      121
    
      122EOF
    
      123}
    
      124
    
      125package_mounriver-studio-toolchain-arm-none-eabi-gcc-bin() {
    
      126    pkgdesc="MRS Toolchain Support for RISC-V assembly and GNU C compilation, link operation."
    
      127    depends=(
    
      128        'bash'
    
      129        'glibc'
    
      130        'python'
    
      131    )
    
      132    install -dm0755 "${pkgdir}/opt/wch/${pkgname%-bin}"
    
      133    cd "${srcdir}/${_pkgbase}/Toolchain/arm-none-eabi-gcc/"
    
      134    cp -a * "${pkgdir}/opt/wch/${pkgname%-bin}"
    
      135
    
      136    install -Dm0644 /dev/stdin "${pkgdir}/etc/profile.d/${pkgname%-bin}.sh" <<EOF
    
      137#!/bin/sh
    
      138[ -d /opt/wch/${pkgname%-bin}/bin ] && append_path '/opt/wch/${pkgname%-bin}/bin'
    
      139
    
      140export PATH
    
      141EOF
    
      142}
    
      143
    
      144package_mounriver-studio-toolchain-riscv-gcc-bin() {
    
      145    pkgdesc="MRS Toolchain Support for RISC-V assembly and GNU C compilation, link operation."
    
      146    depends=('bash'
    
      147        'glibc'
    
      148        'python')
    
      149    install -dm0755 "${pkgdir}/opt/wch/${pkgname%-bin}"
    
      150    cd "${srcdir}/${_pkgbase}/Toolchain/RISC-V Embedded GCC/"
    
      151    cp -a * "${pkgdir}/opt/wch/${pkgname%-bin}"
    
      152
    
      153    install -Dm0644 /dev/stdin "${pkgdir}/etc/profile.d/${pkgname%-bin}.sh" <<EOF
    
      154#!/bin/sh
    
      155[ -d /opt/wch/${pkgname%-bin}/bin ] && append_path '/opt/wch/${pkgname%-bin}/bin'
    
      156
    
      157export PATH
    
      158EOF
    
      159}
    
      160
    
      161package_mounriver-studio-toolchain-riscv-gcc12-bin() {
    
      162    pkgdesc="MRS Toolchain Support for RISC-V assembly and GNU C compilation, link operation."
    
      163    depends=('bash'
    
      164        'glibc'
    
      165        'python')
    
      166    install -dm0755 "${pkgdir}/opt/wch/${pkgname%-bin}"
    
      167    cd "${srcdir}/${_pkgbase}/Toolchain/RISC-V Embedded GCC12/"
    
      168    cp -a * "${pkgdir}/opt/wch/${pkgname%-bin}"
    
      169
    
      170    install -Dm0644 /dev/stdin "${pkgdir}/etc/profile.d/${pkgname%-bin}.sh" <<EOF
    
      171#!/bin/sh
    
      172[ -d /opt/wch/${pkgname%-bin}/bin ] && append_path '/opt/wch/${pkgname%-bin}/bin'
    
      173
    
      174export PATH
    
      175EOF
    
      176}
    
      177
    
      178package_mounriver-studio-toolchain-riscv-gcc15-bin() {
    
      179    pkgdesc="MRS Toolchain Support for RISC-V assembly and GNU C compilation, link operation."
    
      180    depends=('bash'
    
      181        'glibc'
    
      182        'python')
    
      183    install -dm0755 "${pkgdir}/opt/wch/${pkgname%-bin}"
    
      184    cd "${srcdir}/${_pkgbase}/Toolchain/RISC-V Embedded GCC15/"
    
      185    cp -a * "${pkgdir}/opt/wch/${pkgname%-bin}"
    
      186
    
      187    install -Dm0644 /dev/stdin "${pkgdir}/etc/profile.d/${pkgname%-bin}.sh" <<EOF
    
      188#!/bin/sh
    
      189[ -d /opt/wch/${pkgname%-bin}/bin ] && append_path '/opt/wch/${pkgname%-bin}/bin'
    
      190
    
      191export PATH
    
      192EOF
    
      193}
    
      194# vim: ts=4 sw=4 et
    
      195

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3