stmcufinder

maintainer kumen · 4 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package builds from a locally provided source file that must be manually downloaded from the official vendor's website, which is a normal practice for proprietary software; the non-whitelisted URLs are license documents, not executable code, and pose no execution risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a locally provided source file that must be manually downloaded from the official vendor's website, which is a normal practice for proprietary software; the non-whitelisted URLs are license documents, not executable code, and pose no execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:38 "https://www.st.com/resource/en/license_agreement/dm00218346.pdf"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: kumen
2
3pkgname="stmcufinder"
4pkgver=6.1.0
5_pkg_file_name=en.st-mcu-finderlin-v6-1-0.zip
6pkgrel=5
7pkgdesc="STM32 and STM8 product finder for desktops"
8arch=("x86_64")
9makedepends=('imagemagick')
10depends=()
11optdepends=("stm32cubemx")
12conflicts=()
13url="https://www.st.com/en/development-tools/st-mcu-finder-pc.html"
14license=('Commercial')
15options=(!strip)
16
17if [ ! -f ${PWD}/${_pkg_file_name} ]; then
18 msg2 ""
19 msg2 "Package not found!"
20 msg2 "The ${pkgname} can be downloaded here: ${url}"
21 msg2 "Please remember to put a downloaded package ${_pkg_file_name} into the build directory (${PWD}) before build."
22 msg2 ""
23fi
24
25# Download cookies
26curl -s --compressed --cookie-jar "${srcdir}http_cookies" -H "@${srcdir}http_headers" "$url" > /dev/null
27
28DLAGENTS=("https::/usr/bin/curl \
29 -gqb '' --retry 3 --retry-delay 3 \
30 --cookie "${srcdir}http_cookies" \
31 -H "@${srcdir}http_headers" \
32 -o %o --compressed %u")
33
34source=("local://${_pkg_file_name}"
35 "http_headers"
36 "stmcufinder.desktop"
37 "stmcufinder"
38 "https://www.st.com/resource/en/license_agreement/dm00218346.pdf"
39 "https://www.st.com/resource/en/additional_license_terms/additional-license-tadditional-license-terms-for-st-mcu-finder-pc-v${pkgver//./-}.html") # fix needed
40sha256sums=('0d0602f3a52526e395d5bc59c074cc35e9740bd83e3cccf2a25723a8c952f0ee'
41 'e512e091ce9677a97228389c30286a8bb07abaf798026f676d5d4b7dce199410'
42 'c8fe5f9dd6f44612c4015815201746d6a9df7fd912a4dbb864cd98d3fb570faf'
43 'dfc273dbd33c2db31feb4be198f8753cee3f23e57566829f6f53263b19f9f9ad'
44 'SKIP'
45 'SKIP')
46prepare(){
47 install -Dm 644 /dev/stdin "${srcdir}/auto-install.xml" <<END
48<?xml version="1.0" encoding="UTF-8" standalone="no"?>
49<AutomatedInstallation langpack="eng">
50 <com.izforge.izpack.panels.checkedhello.CheckedHelloPanel id="checkedhello.panel"/>
51 <com.izforge.izpack.panels.licence.LicencePanel id="licence.panel"/>
52 <com.st.microxplorer.install.FinderTargetPanel id="target.panel">
53 <installpath>${pkgdir}/opt/${pkgname}</installpath>
54 </com.st.microxplorer.install.FinderTargetPanel>
55 <com.st.microxplorer.install.MXShortcutPanel id="shortcut.panel"/>
56 <com.st.microxplorer.install.MXInstallPanel id="install.panel"/>
57 <com.st.microxplorer.install.FinderFinishPanel id="finish.panel"/>
58</AutomatedInstallation>
59END
60}
61
62package() {
63 cd "$srcdir"
64 mkdir -p "${pkgdir}/opt/${pkgname}"
65 ./SetupSTMCUFinder-${pkgver} "${srcdir}/auto-install.xml"
66
67 rm ${pkgdir}/opt/${pkgname}/.installationinformation
68
69 msg2 'Installing desktop shortcut and icon'
70 magick "${pkgdir}/opt/${pkgname}/util/STMCUFinder.ico" "${srcdir}/${pkgname}.png"
71 install -dm 755 "${pkgdir}/usr/share/pixmaps/"
72 install -dm 755 "${pkgdir}/usr/share/applications/"
73 install -Dm 644 "${srcdir}/${pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
74 install -Dm 644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
75
76 msg2 'Installation of binary files'
77 install -dm 755 "${pkgdir}/usr/bin/"
78 install -Dm 755 "${srcdir}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
79 install -Dm 755 "${srcdir}/${pkgname}" "${pkgdir}/usr/bin/STMCUFinder"
80
81 msg2 'Installation of license files'
82 install -dm 755 "${pkgdir}/usr/share/licenses/${pkgname}/"
83 install -Dm 644 -o root -g root "${srcdir}/dm00218346.pdf" "${pkgdir}/usr/share/licenses/${pkgname}/"
84 install -Dm 644 -o root -g root "${srcdir}/additional-license-tadditional-license-terms-for-st-mcu-finder-pc-v${pkgver//./-}.html" "${pkgdir}/usr/share/licenses/${pkgname}/"
85
86 msg2 'Fix folder permissions'
87 chmod 755 "${pkgdir}/opt/${pkgname}/jre"
88}
89
90#
91# makepkg --printsrcinfo > .SRCINFO
92#
93

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion