mounriverstudio-bin

MEDIUM

maintainer taotieren 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt binary from a dynamically generated URL obtained via an API call to api.mounriver.com, which is not in the source array and has a SKIP'd checksum, creating a supply-chain risk if the download endpoint is compromised.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:81 local _info_json=$(curl -s "https://api.mounriver.com/mountriver/api/version/fetchRecent2?swType=2&osType=LINUX&lang=en")
PKGBUILD:95 local _dl_json=$(curl -s "https://api.mounriver.com/mountriver/api/version/getDownloadUrl?resourceId=${_soft_id}")

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:74 source=('https://ipfs.io/ipfs/QmbFMke1KXqnYyBBWxB74N4c5SBnJMVAiMNRcGu6x1AwQH')

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary from a dynamically generated URL obtained via an API call to api.mounriver.com, which is not in the source array and has a SKIP'd checksum, creating a supply-chain risk if the download endpoint is compromised.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2# Contributor: t3u <t3u@t3u.uk>
    
      3
    
      4pkgbase=mounriverstudio-bin
    
      5pkgname=(${pkgbase})
    
      6pkgdesc="MounRiver Studio Ⅱ(MRS2)为MounRiver Studio的换代版本，从V2.1.0开始，框架更换至更现代的VSCode，并深度定制开发。在工程管理、代码编辑、编译、调试等方面均兼容之前版本，并在效率和功能等方面进行提升，着力将MRS打造为更加轻量化、智能化、高效化的RISC-V IDE。同时，提供Windows/Linux/macOS 以及国产操作系统版本"
    
      7pkgver=250
    
      8pkgrel=3
    
      9arch=('x86_64')
    
      10url='http://www.mounriver.com/'
    
      11license=('LicenseRef-commercial')
    
      12provides=('MounRiverStudio-Linux' ${pkgname%-bin})
    
      13conflicts=(${pkgname%-bin})
    
      14depends=(
    
      15    alsa-lib
    
      16    at-spi2-core
    
      17    bash
    
      18    bzip2
    
      19    cairo
    
      20    dbus
    
      21    expat
    
      22    glib2
    
      23    glibc
    
      24    gmp
    
      25    gtk3
    
      26    hidapi
    
      27    libcups
    
      28    libdrm
    
      29    libgcc
    
      30    libjaylink
    
      31    libsecret
    
      32    libstdc++
    
      33    libusb
    
      34    libx11
    
      35    libxcb
    
      36    libxcomposite
    
      37    libxdamage
    
      38    libxext
    
      39    libxfixes
    
      40    libxkbcommon
    
      41    libxkbfile
    
      42    libxrandr
    
      43    libudev.so
    
      44    java-runtime
    
      45    ncurses
    
      46    mpfr
    
      47    nspr
    
      48    nss
    
      49    mesa
    
      50    pango
    
      51    perl
    
      52    python
    
      53    python-pygments
    
      54    xz
    
      55    zlib
    
      56)
    
      57makedepends=('tar' 'jq' 'curl')
    
      58optdepends=('ch34x-dkms-git: CH341SER driver with fixed bug'
    
      59    'i2c-ch341-dkms: CH341 USB-I2C adapter driver'
    
      60    'spi-ch341-usb-dkms: SPI/GPIO driver for CH341'
    
      61    'ch341eepromtool: An i2c serial EEPROM programming tool for the WCH CH341A'
    
      62    'ch341prog-git: A simple command line tool (programmer) interfacing with ch341a'
    
      63    'ch341eeprom-git: A libusb based programming tool for 24xx I²C EEPROMs using the WCH CH341A'
    
      64    'ch343ser-dkms: USB serial driver for ch342/ch343/ch344/ch347/ch347f/ch9101/ch9102/ch9103/ch9104, etc (dkms).'
    
      65    'wchisp: WCH ISP Tool in Rust'
    
      66    "ezp-chip-data-editor: QT based editor chip database for EZP2019, EZP2019+, EZP2020, EZP2023, EZP2025, MinPro programmer devices"
    
      67    "imsprog: MSProg - software for CH341A-based programmers to work with I2C, SPI and MicroWire EEPROM/Flash chips"
    
      68    "sfp-master: SFP-module programmer for CH341a devices"
    
      69)
    
      70
    
      71# empty dummy file hosted on IPFS to satisfy updpkgsums/lilac checks
    
      72# the content hash is guaranteed to be immutable
    
      73# the real source file is downloaded dynamically in prepare() due to short-lived URL signatures
    
      74source=('https://ipfs.io/ipfs/QmbFMke1KXqnYyBBWxB74N4c5SBnJMVAiMNRcGu6x1AwQH')
    
      75sha256sums=('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')
    
      76options=('!strip' '!debug')
    
      77
    
      78# automatic version detection & download via MounRiver API
    
      79prepare() {
    
      80    msg "Querying MounRiver API for the latest Linux version..."
    
      81    local _info_json=$(curl -s "https://api.mounriver.com/mountriver/api/version/fetchRecent2?swType=2&osType=LINUX&lang=en")
    
      82
    
      83    local _soft_id=$(echo "${_info_json}" | jq -r '.result[0].upgradeRelationBoList[] | select(.softFileType == 1) | .softReId')
    
      84    local _filename=$(echo "${_info_json}" | jq -r '.result[0].upgradeRelationBoList[] | select(.softFileType == 1) | .softFileName')
    
      85    local _api_version=$(echo "${_info_json}" | jq -r '.result[0].version')
    
      86
    
      87    if [[ "${_soft_id}" == "null" || -z "${_soft_id}" ]]; then
    
      88        error "Failed to retrieve software ID from API."
    
      89        return 1
    
      90    fi
    
      91
    
      92    msg "Found Version: ${_api_version} (File: ${_filename}, ID: ${_soft_id})"
    
      93
    
      94    msg "Fetching dynamic download link..."
    
      95    local _dl_json=$(curl -s "https://api.mounriver.com/mountriver/api/version/getDownloadUrl?resourceId=${_soft_id}")
    
      96    local _dl_url=$(echo "${_dl_json}" | jq -r '.data // .result')
    
      97
    
      98    if [[ "${_dl_url}" == "null" || -z "${_dl_url}" || "${_dl_url}" != http* ]]; then
    
      99        error "Failed to retrieve valid download URL."
    
      100        return 1
    
      101    fi
    
      102
    
      103    if [ ! -f "${_filename}" ]; then
    
      104        msg "Downloading ${_filename}..."
    
      105        curl -L -o "${_filename}" "${_dl_url}"
    
      106    else
    
      107        msg "File ${_filename} already exists, skipping download."
    
      108    fi
    
      109
    
      110    # Cleanup old extraction
    
      111    local _old_dir=$(find . -maxdepth 1 -mindepth 1 -type d -print -quit)
    
      112    if [ -n "$_old_dir" ]; then
    
      113        rm -rf "$_old_dir"
    
      114    fi
    
      115
    
      116    msg "Extracting ${_filename}..."
    
      117    tar -xf "${_filename}"
    
      118}
    
      119
    
      120package() {
    
      121    cd "${srcdir}/"
    
      122
    
      123    local _extracted_dir=$(find . -maxdepth 1 -mindepth 1 -type d -print -quit)
    
      124    if [[ -z "${_extracted_dir}" ]]; then
    
      125        error "Extracted directory not found!"
    
      126        return 1
    
      127    fi
    
      128
    
      129    msg "Installing from: ${_extracted_dir}"
    
      130
    
      131    mkdir -p "${pkgdir}/usr/share"
    
      132    cp -r "${_extracted_dir}" "${pkgdir}/usr/share/MRS2"
    
      133
    
      134    msg "Fixing permissions..."
    
      135    find "${pkgdir}/usr/share/MRS2" -type d -exec chmod 755 {} \;
    
      136    find "${pkgdir}/usr/share/MRS2" -perm 600 -exec chmod 644 {} \;
    
      137
    
      138    cd "${pkgdir}/usr/share/MRS2"
    
      139    if [ -d "beforeinstall" ]; then
    
      140        msg "Installing udev rules..."
    
      141        sed -i 's|plugdev|uucp|g' beforeinstall/50-wch.rules
    
      142        sed -i 's|plugdev|uucp|g' beforeinstall/60-openocd.rules
    
      143        install -Dm0644 "beforeinstall/50-wch.rules" "${pkgdir}/usr/lib/udev/rules.d/50-mrs2.rules"
    
      144        install -Dm0644 "beforeinstall/60-openocd.rules" "${pkgdir}/usr/lib/udev/rules.d/60-openocd-mrs2.rules"
    
      145
    
      146        install -Dm0755 "beforeinstall/load.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      147
    
      148        msg "Cleaning up beforeinstall directory..."
    
      149        rm -rf "beforeinstall"
    
      150    fi
    
      151
    
      152    local _res_path="MRS-linux-x64/resources/app/resources/linux/components/WCH/Others/CommunicationLib/default"
    
      153    if [ -d "${_res_path}" ]; then
    
      154        sed -i 's|plugdev|uucp|g' ${_res_path}/50-wch.rules
    
      155        sed -i 's|plugdev|uucp|g' ${_res_path}/60-openocd.rules
    
      156    fi
    
      157
    
      158    msg "Generating Desktop Entry..."
    
      159    local _icon_src="MRS-linux-x64/resources/app/resources/linux/code.png"
    
      160    if [ -f "${_icon_src}" ]; then
    
      161        install -Dm644 "${_icon_src}" "${pkgdir}/usr/share/pixmaps/MounRiverStudio2.png"
    
      162    fi
    
      163
    
      164    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/mounriverstudio.desktop" <<EOF
    
      165[Desktop Entry]
    
      166Type=Application
    
      167Name=MounRiver Studio Ⅱ
    
      168Exec=/usr/bin/${pkgname%-bin} %F
    
      169Icon=MounRiverStudio2
    
      170MimeType=application/x-mrs-project;
    
      171Comment=MounRiver Stduio Ⅱ is a free integrated development environment for embedded MCU.
    
      172Categories=TextEditor;Development;IDE;
    
      173EOF
    
      174
    
      175    msg "Creating OpenOCD wrappers..."
    
      176    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/openocd-mrs2-arm" <<EOF
    
      177#!/bin/env bash
    
      178exec /usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/OpenOCD/OpenOCD/bin/openocd -f /usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/OpenOCD/OpenOCD/bin/wch-arm.cfg "\$@"
    
      179
    
      180EOF
    
      181
    
      182    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/openocd-mrs2-riscv" <<EOF
    
      183#!/bin/env bash
    
      184exec /usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/OpenOCD/OpenOCD/bin/openocd -f /usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/OpenOCD/OpenOCD/bin/wch-riscv.cfg "\$@"
    
      185
    
      186EOF
    
      187
    
      188    install -Dm0644 /dev/stdin "${pkgdir}/etc/profile.d/${pkgname%-bin}.sh" <<EOF
    
      189#!/bin/sh
    
      190[ -d '/usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/Toolchain/RISC-V Embedded GCC12/bin/' ] && append_path '/usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/Toolchain/RISC-V Embedded GCC12/bin/'
    
      191
    
      192[ -d '/usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/Toolchain/RISC-V Embedded GCC/bin/' ] && append_path '/usr/share/MRS2/MRS-linux-x64/resources/app/resources/linux/components/WCH/Toolchain/RISC-V Embedded GCC/bin/'
    
      193
    
      194export PATH
    
      195EOF
    
      196}
    
      197
    
      198# vim: ts=4 sw=4 et
    
      199

Changes since previous scan

--- PKGBUILD @ 2026-10-31 00:07
+++ PKGBUILD @ 2026-11-01 00:21
@@ -5,7 +5,7 @@
 pkgname=(${pkgbase})
 pkgdesc="MounRiver Studio Ⅱ(MRS2)为MounRiver Studio的换代版本，从V2.1.0开始，框架更换至更现代的VSCode，并深度定制开发。在工程管理、代码编辑、编译、调试等方面均兼容之前版本，并在效率和功能等方面进行提升，着力将MRS打造为更加轻量化、智能化、高效化的RISC-V IDE。同时，提供Windows/Linux/macOS 以及国产操作系统版本"
 pkgver=250
-pkgrel=1
+pkgrel=3
 arch=('x86_64')
 url='http://www.mounriver.com/'
 license=('LicenseRef-commercial')
@@ -15,18 +15,21 @@
     alsa-lib
     at-spi2-core
     bash
+    bzip2
     cairo
     dbus
     expat
-    gcc-libs
     glib2
     glibc
+    gmp
     gtk3
     hidapi
     libcups
     libdrm
+    libgcc
     libjaylink
     libsecret
+    libstdc++
     libusb
     libx11
     libxcb
@@ -38,14 +41,18 @@
     libxkbfile
     libxrandr
     libudev.so
+    java-runtime
+    ncurses
+    mpfr
     nspr
     nss
     mesa
     pango
+    perl
     python
     python-pygments
-    # AUR
-    #     ncurses5-compat-libs
+    xz
+    zlib
 )
 makedepends=('tar' 'jq' 'curl')
 optdepends=('ch34x-dkms-git: CH341SER driver with fixed bug'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	3
2026-10-31 05:57:59	Medium	3
2026-10-31 00:07:41	Medium	3
2026-10-30 00:29:30	Medium	3
2026-10-29 00:13:55	Medium	3
2026-10-28 00:06:54	Medium	3
2026-10-27 00:23:28	Medium	3
2026-10-26 00:12:40	Medium	3
2026-10-25 00:20:48	Medium	3
2026-10-24 00:14:55	Medium	3
2026-10-23 00:02:19	Medium	3
2026-10-22 00:13:10	Medium	3
2026-10-21 00:12:50	Medium	3
2026-10-20 00:10:31	Medium	3
2026-10-19 00:03:55	Medium	3
2026-10-18 00:06:55	Medium	3
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 00:06:47	Medium	3