stsw-link007

maintainer crux · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is fetched from st.com (the official STMicroelectronics vendor domain) using a cookie-based download mechanism that is common for ST's software distribution portal. The dynamic URL resolution happens at PKGBUILD parse time via curl, but the resolved URL is still on www.st.com. The downloaded ZIP has a pinned sha256sum ('cb3bc1a7397f13839347a989b8ea664aced4de86a1af73a2490b255b880406ee'), which provides integrity verification. The installed payload includes a JAR file and a native shared library (libSTLinkUSBDriver.so) from the official ST firmware upgrade tool — this is a legitimate embedded development utility. The cookie/header dance is ST's standard gating mechanism for software downloads. The license PDF uses SKIP for its checksum, which is sloppy but not a security concern. Overall this is an unusual but legitimate packaging pattern for a vendor-gated download; no unofficial or personal hosts are involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The source is fetched from st.com (the official STMicroelectronics vendor domain) using a cookie-based download mechanism that is common for ST's software distribution portal. The dynamic URL resolution happens at PKGBUILD parse time via curl, but the resolved URL is still on www.st.com. The downloaded ZIP has a pinned sha256sum ('cb3bc1a7397f13839347a989b8ea664aced4de86a1af73a2490b255b880406ee'), which provides integrity verification. The installed payload includes a JAR file and a native shared library (libSTLinkUSBDriver.so) from the official ST firmware upgrade tool — this is a legitimate embedded development utility. The cookie/header dance is ST's standard gating mechanism for software downloads. The license PDF uses SKIP for its checksum, which is sloppy but not a security concern. Overall this is an unusual but legitimate packaging pattern for a vendor-gated download; no unofficial or personal hosts are involved.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:50 "https://www.st.com/resource/en/license/${_pkg_license_name}")

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: yjun <jerrysteve1101 at gmail dot com>
    
      2
    
      3pkgname="stsw-link007"
    
      4_pkgname="STLinkUpgrade"
    
      5pkgver=3.15.7
    
      6pkgrel=2
    
      7_stlink_upgrade_ver=3.15.7
    
      8pkgdesc="The firmware upgrade application for ST-LINK, ST-LINK/V2, ST-LINK/V2-1, and STLINK-V3 boards through the USB port"
    
      9arch=('x86_64')
    
      10url="https://www.st.com/en/development-tools/stsw-link007.html"
    
      11license=('custom:SLA0048')
    
      12# depends comments
    
      13#
    
      14## java-runtime>=7 :
    
      15# The application requires the Java Runtime Environment 7u51 (or more recent) being installed.
    
      16## libusb :
    
      17# On Linux, the application relies on libusb-1.0, which must be installed separately.
    
      18## stlink (provides stlink udev rules) :
    
      19# On Linux, users must be granted with rights for accessing the ST-Link USB devices. To do that, it might be necessary to add rules into /etc/udev/rules.d.
    
      20# ---------------------------------------------
    
      21# src/stsw-link007/readme.txt
    
      22depends=('stlink'
    
      23         'libusb'
    
      24         'java-runtime>=7')
    
      25provides=("stlink-upgrade" "stlinkupgrade")
    
      26options=('!strip')
    
      27
    
      28# Non-uniform name conventions
    
      29_pkg_license_name="SLA0048_${pkgname^^}.pdf"
    
      30_pkg_zip_name="en.${pkgname}-v${pkgver//./-}.zip"
    
      31
    
      32# sync from stm32cubeide, thanks to @kumencz!
    
      33# Download file with list of URLs to files
    
      34_curl_req_url="https://www.st.com/content/st_com_cx/en/products/development-tools/software-development-tools/stm32-software-development-tools/stm32-utilities/stsw-link007/_jcr_content/get-software/getsw-table-nli.nocache.html/st-site-cx/components/containers/product/get-software-table-body.html"
    
      35_curl_req="$(curl -s --compressed --cookie-jar "${srcdir}http_cookies" -H "@${srcdir}http_headers" "${_curl_req_url}")"
    
      36
    
      37_pkg_url="$(grep -m 1 "${_pkg_zip_name}" <<<"${_curl_req}")"
    
      38_pkg_url="$(awk -F'"' '{print $4}' <<<"${_pkg_url}")"
    
      39_download_path="https://www.st.com""${_pkg_url}"
    
      40DLAGENTS=("https::/usr/bin/curl \
    
      41              -gqb '' --retry 3 --retry-delay 3 \
    
      42              --cookie "${srcdir}http_cookies" \
    
      43              -H "@${srcdir}http_headers" \
    
      44              -o %o --compressed %u")
    
      45
    
      46source=("${_pkg_zip_name}::$_download_path"
    
      47        "${pkgname}.sh"
    
      48        "${pkgname}.png"
    
      49        "http_headers"
    
      50        "https://www.st.com/resource/en/license/${_pkg_license_name}")
    
      51
    
      52sha256sums=('cb3bc1a7397f13839347a989b8ea664aced4de86a1af73a2490b255b880406ee'
    
      53            'ccf814ca4b768285e611c809be147be2b0df10d39ceedfafa7f901a56bd4fcd3'
    
      54            'a692a0956462419ba10a149c06e8be0f2e1a3e16dfb4b1ce06f9c612bf852d3c'
    
      55            '12e85339c74dc80c054062432dfc6f0eb1be3214fcb4f1fab427193f4e6f0d22'
    
      56            'SKIP')
    
      57
    
      58package() {
    
      59
    
      60  # wrapper
    
      61  install -Dm755 ${srcdir}/${pkgname}.sh ${pkgdir}/usr/bin/${_pkgname}
    
      62  
    
      63  # icon
    
      64  install -Dm644 ${srcdir}/${pkgname}.png -t ${pkgdir}/usr/share/pixmaps/
    
      65  
    
      66  # license
    
      67  install -Dm644 ${srcdir}/${_pkg_license_name} -t ${pkgdir}/usr/share/licenses/${pkgname}
    
      68
    
      69  # doc
    
      70  install -Dm644 ${srcdir}/${pkgname}/readme.txt -t ${pkgdir}/usr/share/doc/${pkgname}
    
      71
    
      72  # desktop enrty
    
      73  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/${_pkgname}.desktop" <<END
    
      74[Desktop Entry]
    
      75Comment=${_pkgname} ${_stlink_upgrade_ver}
    
      76Comment[en]=${_pkgname} ${_stlink_upgrade_ver}
    
      77Encoding=UTF-8
    
      78Exec=${_pkgname}
    
      79Icon=${pkgname}
    
      80Name=${_pkgname}
    
      81Name[en]=${_pkgname}
    
      82Type=Application
    
      83END
    
      84
    
      85  # ST-link upgrade 
    
      86  install -Dm644 ${srcdir}/${pkgname}/AllPlatforms/${_pkgname}.jar -t ${pkgdir}/usr/share/java/${pkgname}/
    
      87  install -Dm644 ${srcdir}/${pkgname}/AllPlatforms/native/linux_x64/libSTLinkUSBDriver.so -t ${pkgdir}/usr/share/java/${pkgname}/native/linux_x64/
    
      88}
    
      89# vim: set sw=2 ts=2 et:
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 21:12:02	MEDIUM	2
2026-07-19 15:11:12	MEDIUM	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2