mounriverstudio-bin

MEDIUM

maintainer taotieren 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary from a dynamically generated URL obtained via an API call to api.mounriver.com, which is not in the source array and uses a non-standard host, creating a supply-chain risk if the API or download URL is compromised.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:74 local _info_json=$(curl -s "https://api.mounriver.com/mountriver/api/version/fetchRecent2?swType=2&osType=LINUX&lang=en")
PKGBUILD:88 local _dl_json=$(curl -s "https://api.mounriver.com/mountriver/api/version/getDownloadUrl?resourceId=${_soft_id}")

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:67 source=('https://ipfs.io/ipfs/QmbFMke1KXqnYyBBWxB74N4c5SBnJMVAiMNRcGu6x1AwQH')

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary from a dynamically generated URL obtained via an API call to api.mounriver.com, which is not in the source array and uses a non-standard host, creating a supply-chain risk if the API or download URL is compromised.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2# Contributor: t3u <t3u@t3u.uk>
    
      3
    
      4pkgbase=mounriverstudio-bin
    
      5pkgname=(${pkgbase})
    
      6pkgdesc="MounRiver Studio Ⅱ(MRS2)为MounRiver Studio的换代版本，从V2.1.0开始，框架更换至更现代的VSCode，并深度定制开发。在工程管理、代码编辑、编译、调试等方面均兼容之前版本，并在效率和功能等方面进行提升，着力将MRS打造为更加轻量化、智能化、高效化的RISC-V IDE。同时，提供Windows/Linux/macOS 以及国产操作系统版本"
    
      7pkgver=250
    
      8pkgrel=1
    
      9arch=('x86_64')
    
      10url='http://www.mounriver.com/'
    
      11license=('LicenseRef-commercial')
    
      12provides=('MounRiverStudio-Linux' ${pkgname%-bin})
    
      13conflicts=(${pkgname%-bin})
    
      14depends=(
    
      15    alsa-lib
    
      16    at-spi2-core
    
      17    bash
    
      18    cairo
    
      19    dbus
    
      20    expat
    
      21    gcc-libs
    
      22    glib2
    
      23    glibc
    
      24    gtk3
    
      25    hidapi
    
      26    libcups
    
      27    libdrm
    
      28    libjaylink
    
      29    libsecret
    
      30    libusb
    
      31    libx11
    
      32    libxcb
    
      33    libxcomposite
    
      34    libxdamage
    
      35    libxext
    
      36    libxfixes
    
      37    libxkbcommon
    
      38    libxkbfile
    
      39    libxrandr
    
      40    libudev.so
    
      41    nspr
    
      42    nss
    
      43    mesa
    
      44    pango
    
      45    python
    
      46    python-pygments
    
      47    # AUR
    
      48    #     ncurses5-compat-libs
    
      49)
    
      50makedepends=('tar' 'jq' 'curl')
    
      51optdepends=('ch34x-dkms-git: CH341SER driver with fixed bug'
    
      52    'i2c-ch341-dkms: CH341 USB-I2C adapter driver'
    
      53    'spi-ch341-usb-dkms: SPI/GPIO driver for CH341'
    
      54    'ch341eepromtool: An i2c serial EEPROM programming tool for the WCH CH341A'
    
      55    'ch341prog-git: A simple command line tool (programmer) interfacing with ch341a'
    
      56    'ch341eeprom-git: A libusb based programming tool for 24xx I²C EEPROMs using the WCH CH341A'
    
      57    'ch343ser-dkms: USB serial driver for ch342/ch343/ch344/ch347/ch347f/ch9101/ch9102/ch9103/ch9104, etc (dkms).'
    
      58    'wchisp: WCH ISP Tool in Rust'
    
      59    "ezp-chip-data-editor: QT based editor chip database for EZP2019, EZP2019+, EZP2020, EZP2023, EZP2025, MinPro programmer devices"
    
      60    "imsprog: MSProg - software for CH341A-based programmers to work with I2C, SPI and MicroWire EEPROM/Flash chips"
    
      61    "sfp-master: SFP-module programmer for CH341a devices"
    
      62)
    
      63
    
      64# empty dummy file hosted on IPFS to satisfy updpkgsums/lilac checks
    
      65# the content hash is guaranteed to be immutable
    
      66# the real source file is downloaded dynamically in prepare() due to short-lived URL signatures
    
      67source=('https://ipfs.io/ipfs/QmbFMke1KXqnYyBBWxB74N4c5SBnJMVAiMNRcGu6x1AwQH')
    
      68sha256sums=('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')
    
      69options=('!strip' '!debug')
    
      70
    
      71# automatic version detection & download via MounRiver API
    
      72prepare() {
    
      73    msg "Querying MounRiver API for the latest Linux version..."
    
      74    local _info_json=$(curl -s "https://api.mounriver.com/mountriver/api/version/fetchRecent2?swType=2&osType=LINUX&lang=en")
    
      75
    
      76    local _soft_id=$(echo "${_info_json}" | jq -r '.result[0].upgradeRelationBoList[] | select(.softFileType == 1) | .softReId')
    
      77    local _filename=$(echo "${_info_json}" | jq -r '.result[0].upgradeRelationBoList[] | select(.softFileType == 1) | .softFileName')
    
      78    local _api_version=$(echo "${_info_json}" | jq -r '.result[0].version')
    
      79
    
      80    if [[ "${_soft_id}" == "null" || -z "${_soft_id}" ]]; then
    
      81        error "Failed to retrieve software ID from API."
    
      82        return 1
    
      83    fi
    
      84
    
      85    msg "Found Version: ${_api_version} (File: ${_filename}, ID: ${_soft_id})"
    
      86
    
      87    msg "Fetching dynamic download link..."
    
      88    local _dl_json=$(curl -s "https://api.mounriver.com/mountriver/api/version/getDownloadUrl?resourceId=${_soft_id}")
    
      89    local _dl_url=$(echo "${_dl_json}" | jq -r '.data // .result')
    
      90
    
      91    if [[ "${_dl_url}" == "null" || -z "${_dl_url}" || "${_dl_url}" != http* ]]; then
    
      92        error "Failed to retrieve valid download URL."
    
      93        return 1
    
      94    fi
    
      95
    
      96    if [ ! -f "${_filename}" ]; then
    
      97        msg "Downloading ${_filename}..."
    
      98        curl -L -o "${_filename}" "${_dl_url}"
    
      99    else
    
      100        msg "File ${_filename} already exists, skipping download."
    
      101    fi
    
      102
    
      103    # Cleanup old extraction
    
      104    local _old_dir=$(find . -maxdepth 1 -mindepth 1 -type d -print -quit)
    
      105    if [ -n "$_old_dir" ]; then
    
      106        rm -rf "$_old_dir"
    
      107    fi
    
      108
    
      109    msg "Extracting ${_filename}..."
    
      110    tar -xf "${_filename}"
    
      111}
    
      112
    
      113package() {
    
      114    cd "${srcdir}/"
    
      115
    
      116    local _extracted_dir=$(find . -maxdepth 1 -mindepth 1 -type d -print -quit)
    
      117    if [[ -z "${_extracted_dir}" ]]; then
    
      118        error "Extracted directory not found!"
    
      119        return 1
    
      120    fi
    
      121
    
      122    msg "Installing from: ${_extracted_dir}"
    
      123
    
      124    mkdir -p "${pkgdir}/usr/share"
    
      125    cp -r "${_extracted_dir}" "${pkgdir}/usr/share/MRS2"
    
      126
    
      127    msg "Fixing permissions..."
    
      128    find "${pkgdir}/usr/share/MRS2" -type d -exec chmod 755 {} \;
    
      129    find "${pkgdir}/usr/share/MRS2" -perm 600 -exec chmod 644 {} \;
    
      130
    
      131    cd "${pkgdir}/usr/share/MRS2"
    
      132    if [ -d "beforeinstall" ]; then
    
      133        msg "Installing udev rules..."
    
      134        sed -i 's|plugdev|uucp|g' beforeinstall/50-wch.rules
    
      135        sed -i 's|plugdev|uucp|g' beforeinstall/60-openocd.rules
    
      136        install -Dm0644 "beforeinstall/50-wch.rules" "${pkgdir}/usr/lib/udev/rules.d/50-mrs2.rules"
    
      137        install -Dm0644 "beforeinstall/60-openocd.rules" "${pkgdir}/usr/lib/udev/rules.d/60-openocd-mrs2.rules"
    
      138
    
      139        install -Dm0755 "beforeinstall/load.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      140
    
      141        msg "Cleaning up beforeinstall directory..."
    
      142        rm -rf "beforeinstall"
    
      143    fi
    
      144
    
      145    local _res_path="MRS-linux-x64/resources/app/resources/linux/components/WCH/Others/CommunicationLib/default"
    
      146    if [ -d "${_res_path}" ]; then
    
      147        sed -i 's|plugdev|uucp|g' ${_res_path}/50-wch.rules
    
      148        sed -i 's|plugdev|uucp|g' ${_res_path}/60-openocd.rules
    
      149    fi
    
      150
    
      151    msg "Generating Desktop Entry..."
    
      152    local _icon_src="MRS-linux-x64/resources/app/resources/linux/code.png"
    
      153    if [ -f "${_icon_src}" ]; then
    
      154        install -Dm644 "${_icon_src}" "${pkgdir}/usr/share/pixmaps/MounRiverStudio2.png"
    
      155    fi
    
      156
    
      157    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/mounriverstudio.desktop" <<EOF
    
      158[Desktop Entry]
    
      159Type=Application
    
      160Name=MounRiver Studio Ⅱ
    
      161Exec=/usr/bin/${pkgname%-bin} %F
    
      162Icon=MounRiverStudio2
    
      163MimeType=application/x-mrs-project;
    
      164Comment=MounRiver Stduio Ⅱ is a free integrated development environment for embedded MCU.
    
      165Categories=TextEditor;Development;IDE;
    
      166EOF
    
      167
    
      168    msg "Creating OpenOCD wrappers..."
    
      169    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/openocd-mrs2-arm" <<EOF
    
      170#!/bin/env bash
    
      171exec /usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/OpenOCD/OpenOCD/bin/openocd -f /usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/OpenOCD/OpenOCD/bin/wch-arm.cfg "\$@"
    
      172
    
      173EOF
    
      174
    
      175    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/openocd-mrs2-riscv" <<EOF
    
      176#!/bin/env bash
    
      177exec /usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/OpenOCD/OpenOCD/bin/openocd -f /usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/OpenOCD/OpenOCD/bin/wch-riscv.cfg "\$@"
    
      178
    
      179EOF
    
      180
    
      181    install -Dm0644 /dev/stdin "${pkgdir}/etc/profile.d/${pkgname%-bin}.sh" <<EOF
    
      182#!/bin/sh
    
      183[ -d '/usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/Toolchain/RISC-V Embedded GCC12/bin/' ] && append_path '/usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/Toolchain/RISC-V Embedded GCC12/bin/'
    
      184
    
      185[ -d '/usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/Toolchain/RISC-V Embedded GCC/bin/' ] && append_path '/usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/Toolchain/RISC-V Embedded GCC/bin/'
    
      186
    
      187export PATH
    
      188EOF
    
      189}
    
      190
    
      191# vim: ts=4 sw=4 et
    
      192

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	3
2026-09-16 00:03:17	Medium	3
2026-09-15 00:25:31	Medium	3
2026-09-14 00:27:57	Medium	3
2026-09-13 00:19:54	Medium	3
2026-09-12 00:25:17	Medium	3
2026-09-11 00:19:22	Medium	3
2026-09-10 00:22:44	Medium	3
2026-09-09 00:04:09	Medium	3
2026-09-08 00:18:08	Medium	3
2026-09-07 00:30:15	Medium	3
2026-09-06 00:17:06	Medium	3
2026-09-05 00:16:27	Medium	3
2026-09-04 00:03:13	Medium	3
2026-09-03 00:15:47	Medium	3
2026-09-02 00:02:31	Medium	3
2026-09-01 00:11:19	Medium	3
2026-08-31 00:19:57	Medium	3
2026-08-30 00:04:14	Medium	3
2026-08-29 00:29:17	Medium	3