stmcufinder
LOW
maintainer kumen
4 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from a locally provided source file that must be manually downloaded from the official vendor's website, which is a normal practice for proprietary software; the non-whitelisted URLs are license documents, not executable code, and pose no execution risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a locally provided source file that must be manually downloaded from the official vendor's website, which is a normal practice for proprietary software; the non-whitelisted URLs are license documents, not executable code, and pose no execution risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:38
"https://www.st.com/resource/en/license_agreement/dm00218346.pdf"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: kumen
2
3
pkgname="stmcufinder"
4
pkgver=6.1.0
5
_pkg_file_name=en.st-mcu-finderlin-v6-1-0.zip
6
pkgrel=5
7
pkgdesc="STM32 and STM8 product finder for desktops"
8
arch=("x86_64")
9
makedepends=('imagemagick')
10
depends=()
11
optdepends=("stm32cubemx")
12
conflicts=()
13
url="https://www.st.com/en/development-tools/st-mcu-finder-pc.html"
14
license=('Commercial')
15
options=(!strip)
16
17
if [ ! -f ${PWD}/${_pkg_file_name} ]; then
18
msg2 ""
19
msg2 "Package not found!"
20
msg2 "The ${pkgname} can be downloaded here: ${url}"
21
msg2 "Please remember to put a downloaded package ${_pkg_file_name} into the build directory (${PWD}) before build."
22
msg2 ""
23
fi
24
25
# Download cookies
26
curl -s --compressed --cookie-jar "${srcdir}http_cookies" -H "@${srcdir}http_headers" "$url" > /dev/null
27
28
DLAGENTS=("https::/usr/bin/curl \
29
-gqb '' --retry 3 --retry-delay 3 \
30
--cookie "${srcdir}http_cookies" \
31
-H "@${srcdir}http_headers" \
32
-o %o --compressed %u")
33
34
source=("local://${_pkg_file_name}"
35
"http_headers"
36
"stmcufinder.desktop"
37
"stmcufinder"
38
"https://www.st.com/resource/en/license_agreement/dm00218346.pdf"
39
"https://www.st.com/resource/en/additional_license_terms/additional-license-tadditional-license-terms-for-st-mcu-finder-pc-v${pkgver//./-}.html") # fix needed
40
sha256sums=('0d0602f3a52526e395d5bc59c074cc35e9740bd83e3cccf2a25723a8c952f0ee'
41
'e512e091ce9677a97228389c30286a8bb07abaf798026f676d5d4b7dce199410'
42
'c8fe5f9dd6f44612c4015815201746d6a9df7fd912a4dbb864cd98d3fb570faf'
43
'dfc273dbd33c2db31feb4be198f8753cee3f23e57566829f6f53263b19f9f9ad'
44
'SKIP'
45
'SKIP')
46
prepare(){
47
install -Dm 644 /dev/stdin "${srcdir}/auto-install.xml" <<END
48
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
49
<AutomatedInstallation langpack="eng">
50
<com.izforge.izpack.panels.checkedhello.CheckedHelloPanel id="checkedhello.panel"/>
51
<com.izforge.izpack.panels.licence.LicencePanel id="licence.panel"/>
52
<com.st.microxplorer.install.FinderTargetPanel id="target.panel">
53
<installpath>${pkgdir}/opt/${pkgname}</installpath>
54
</com.st.microxplorer.install.FinderTargetPanel>
55
<com.st.microxplorer.install.MXShortcutPanel id="shortcut.panel"/>
56
<com.st.microxplorer.install.MXInstallPanel id="install.panel"/>
57
<com.st.microxplorer.install.FinderFinishPanel id="finish.panel"/>
58
</AutomatedInstallation>
59
END
60
}
61
62
package() {
63
cd "$srcdir"
64
mkdir -p "${pkgdir}/opt/${pkgname}"
65
./SetupSTMCUFinder-${pkgver} "${srcdir}/auto-install.xml"
66
67
rm ${pkgdir}/opt/${pkgname}/.installationinformation
68
69
msg2 'Installing desktop shortcut and icon'
70
magick "${pkgdir}/opt/${pkgname}/util/STMCUFinder.ico" "${srcdir}/${pkgname}.png"
71
install -dm 755 "${pkgdir}/usr/share/pixmaps/"
72
install -dm 755 "${pkgdir}/usr/share/applications/"
73
install -Dm 644 "${srcdir}/${pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
74
install -Dm 644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
75
76
msg2 'Installation of binary files'
77
install -dm 755 "${pkgdir}/usr/bin/"
78
install -Dm 755 "${srcdir}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
79
install -Dm 755 "${srcdir}/${pkgname}" "${pkgdir}/usr/bin/STMCUFinder"
80
81
msg2 'Installation of license files'
82
install -dm 755 "${pkgdir}/usr/share/licenses/${pkgname}/"
83
install -Dm 644 -o root -g root "${srcdir}/dm00218346.pdf" "${pkgdir}/usr/share/licenses/${pkgname}/"
84
install -Dm 644 -o root -g root "${srcdir}/additional-license-tadditional-license-terms-for-st-mcu-finder-pc-v${pkgver//./-}.html" "${pkgdir}/usr/share/licenses/${pkgname}/"
85
86
msg2 'Fix folder permissions'
87
chmod 755 "${pkgdir}/opt/${pkgname}/jre"
88
}
89
90
#
91
# makepkg --printsrcinfo > .SRCINFO
92
#
93
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |