stm32cubemx

LOW

maintainer laserk3000 62 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a versioned zip file from ST's official resource domain (st.com), which is plausibly the project's own release infrastructure despite not being on a standard whitelist; the package builds from official vendor sources and installs only static data and scripts without executing remote code or exhibiting malicious behavior.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a versioned zip file from ST's official resource domain (st.com), which is plausibly the project's own release infrastructure despite not being on a standard whitelist; the package builds from official vendor sources and installs only static data and scripts without executing remote code or exhibiting malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://sw-center.st.com/packs/resource/library/stm32cube_mx_v${pkgver//./}-lin.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: laserK <echo 'Y29udGFjdEBrYXJzdGVucHVmYWhsLmRlCg==' | base64 -d>
    
      2# Maintainer: CloverGit <clovergit@hotmail.com>
    
      3
    
      4pkgbase=stm32cubemx
    
      5pkgname=(stm32cubemx stm32cubemx-jre)
    
      6pkgver=6.18.1
    
      7pkgrel=1
    
      8arch=('x86_64')
    
      9url="https://www.st.com/en/development-tools/stm32cubemx.html"
    
      10license=('custom')
    
      11options=(!strip !debug)
    
      12makedepends=('rsync')
    
      13source=("https://sw-center.st.com/packs/resource/library/stm32cube_mx_v${pkgver//./}-lin.zip"
    
      14  "stm32cubemx.desktop"
    
      15  "stm32cubemx.sh")
    
      16sha512sums=('15a950ff8ad188f5bbc6b716929bad6161ccb598aa4183dd5e3e9171061019eb9b70120672cd902efd3d17e3b4a7555707507b7b70190a36c5b00151b8c09f01'
    
      17            '83c67bef3e8f8434903fe0c067442cc7473459386fdcb0225af1b3a75fd75e2be393f91f877c8410f1055ca4ec531b2df707fcab10663cae382a7f4066c8548b'
    
      18            'c28bf62bef34ed5469eb5852907d1b52215705434bb9daa15dd11ba8cbf44e910bddcc1b6784397c32287dde9dde148f6485db3c0c3fb505e4f1c2e0bc58bf51')
    
      19
    
      20prepare() {
    
      21  cd "${srcdir}"
    
      22  bsdtar -x -f JavaJre.zip -C MX
    
      23}
    
      24
    
      25package_stm32cubemx() {
    
      26  pkgdesc="Graphical software configuration tool for STM32 microcontrollers that allows generating C initialization code"
    
      27  groups=('stm32cube')
    
      28  optdepends=(
    
      29    'stm32cubemx-jre: ST packaged Java Runtime (Recommended)'
    
      30    'java-runtime>=21: System Java Runtime (Required if stm32cubemx-jre is not installed)'
    
      31    'archlinux-java-run>=10: Required to launch with system Java runtime'
    
      32  )
    
      33
    
      34  cd "${srcdir}"
    
      35  mkdir -p "${pkgdir}/opt/stm32cubemx"
    
      36
    
      37  rsync -rtl "${srcdir}/MX/" "${pkgdir}/opt/stm32cubemx" --exclude=/jre
    
      38
    
      39  install -Dm 755 "${srcdir}/stm32cubemx.sh" "${pkgdir}/usr/bin/${pkgbase}"
    
      40
    
      41  # Icon and desktop file
    
      42  install -Dm 644 "${srcdir}/MX/help/STM32CubeMX.png" "${pkgdir}/usr/share/pixmaps/${pkgbase}.png"
    
      43  install -Dm 644 "${srcdir}/${pkgbase}.desktop" "${pkgdir}/usr/share/applications/${pkgbase}.desktop"
    
      44
    
      45  # License
    
      46  install -Dm 644 "${srcdir}/MX/help/software_license_agreement.pdf" "$pkgdir/usr/share/licenses/${pkgbase}/LICENSE.pdf"
    
      47}
    
      48
    
      49package_stm32cubemx-jre() {
    
      50  pkgdesc="ST packaged custom Java Runtime for STM32CubeMX"
    
      51  depends=("${pkgbase}=${pkgver}-${pkgrel}"
    
      52    'ca-certificates-utils' 'freetype2' 'glibc' 'harfbuzz' 'hicolor-icon-theme' 'lcms2' 'libelf' 'libgcc' 'giflib' 'libjpeg-turbo' 'libnet' 'libpng' 'libstdc++' 'nss' 'gtk3')
    
      53
    
      54  cd "${srcdir}"
    
      55  install -d -m755 "${pkgdir}/opt/stm32cubemx"
    
      56  rsync -rtl "${srcdir}/MX/jre" "${pkgdir}/opt/stm32cubemx/"
    
      57}
    
      58# vim: set sw=2 ts=2 et:
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2