stm32cubemx

maintainer laserk3000 · 62 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a versioned zip from ST's official resource domain (sw-center.st.com), which is plausibly the project's own release infrastructure; the package installs prebuilt binaries as expected for this software, but from a non-whitelisted host, resulting in low severity due to source origin ambiguity despite official appearance.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a versioned zip from ST's official resource domain (sw-center.st.com), which is plausibly the project's own release infrastructure; the package installs prebuilt binaries as expected for this software, but from a non-whitelisted host, resulting in low severity due to source origin ambiguity despite official appearance.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://sw-center.st.com/packs/resource/library/stm32cube_mx_v${pkgver//./}-lin.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: laserK <echo 'Y29udGFjdEBrYXJzdGVucHVmYWhsLmRlCg==' | base64 -d>
    
      2# Maintainer: CloverGit <clovergit@hotmail.com>
    
      3
    
      4pkgbase=stm32cubemx
    
      5pkgname=(stm32cubemx stm32cubemx-jre)
    
      6pkgver=6.17.0
    
      7pkgrel=4
    
      8arch=('x86_64')
    
      9url="https://www.st.com/en/development-tools/stm32cubemx.html"
    
      10license=('custom')
    
      11options=(!strip !debug)
    
      12makedepends=('rsync')
    
      13source=("https://sw-center.st.com/packs/resource/library/stm32cube_mx_v${pkgver//./}-lin.zip"
    
      14  "stm32cubemx.desktop"
    
      15  "stm32cubemx.sh")
    
      16sha512sums=('a4ea1f481b37afd68d4e4ef904224329972bd33f6038854009effc776f9a931c9ad057a9be927cb354fc4e99639804896553923c58f2c27c123c36b2af1cb60c'
    
      17  '83c67bef3e8f8434903fe0c067442cc7473459386fdcb0225af1b3a75fd75e2be393f91f877c8410f1055ca4ec531b2df707fcab10663cae382a7f4066c8548b'
    
      18  'c28bf62bef34ed5469eb5852907d1b52215705434bb9daa15dd11ba8cbf44e910bddcc1b6784397c32287dde9dde148f6485db3c0c3fb505e4f1c2e0bc58bf51')
    
      19
    
      20prepare() {
    
      21  cd "${srcdir}"
    
      22  bsdtar -x -f JavaJre.zip -C MX
    
      23}
    
      24
    
      25package_stm32cubemx() {
    
      26  pkgdesc="Graphical software configuration tool for STM32 microcontrollers that allows generating C initialization code"
    
      27  groups=('stm32cube')
    
      28  optdepends=(
    
      29    'stm32cubemx-jre: ST packaged Java Runtime (Recommended)'
    
      30    'java-runtime>=21: System Java Runtime (Required if stm32cubemx-jre is not installed)'
    
      31    'archlinux-java-run>=10: Required to launch with system Java runtime'
    
      32  )
    
      33
    
      34  cd "${srcdir}"
    
      35  mkdir -p "${pkgdir}/opt/stm32cubemx"
    
      36
    
      37  rsync -rtl "${srcdir}/MX/" "${pkgdir}/opt/stm32cubemx" --exclude=/jre
    
      38
    
      39  install -Dm 755 "${srcdir}/stm32cubemx.sh" "${pkgdir}/usr/bin/${pkgbase}"
    
      40
    
      41  # Icon and desktop file
    
      42  install -Dm 644 "${srcdir}/MX/help/STM32CubeMX.png" "${pkgdir}/usr/share/pixmaps/${pkgbase}.png"
    
      43  install -Dm 644 "${srcdir}/${pkgbase}.desktop" "${pkgdir}/usr/share/applications/${pkgbase}.desktop"
    
      44
    
      45  # License
    
      46  install -Dm 644 "${srcdir}/MX/help/software_license_agreement.pdf" "$pkgdir/usr/share/licenses/${pkgbase}/LICENSE.pdf"
    
      47}
    
      48
    
      49package_stm32cubemx-jre() {
    
      50  pkgdesc="ST packaged custom Java Runtime for STM32CubeMX"
    
      51  depends=("${pkgbase}=${pkgver}-${pkgrel}"
    
      52    'ca-certificates-utils' 'freetype2' 'glibc' 'harfbuzz' 'hicolor-icon-theme' 'lcms2' 'libelf' 'libgcc' 'giflib' 'libjpeg-turbo' 'libnet' 'libpng' 'libstdc++' 'nss' 'gtk3')
    
      53
    
      54  cd "${srcdir}"
    
      55  install -d -m755 "${pkgdir}/opt/stm32cubemx"
    
      56  rsync -rtl "${srcdir}/MX/jre" "${pkgdir}/opt/stm32cubemx/"
    
      57}
    
      58# vim: set sw=2 ts=2 et:
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2