sw4stm32

maintainer orphaned · 10 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt .run installer from ac6-tools.com (the official AC6/Ac6 vendor site for System Workbench for STM32, which is a legitimate embedded IDE vendor) and executes it via 'java -jar'. The checksum is SKIP'd, meaning there is no integrity verification of the downloaded binary. While ac6-tools.com is the actual upstream vendor host for this tool (not a random personal host), the SKIP checksum means any MITM or server-side substitution would go undetected. The .run file is executed directly during the package() phase, giving it full access to the build environment. This is a real supply-chain concern: an executed binary installer with no integrity check, even from a nominally legitimate vendor. The medium rating is appropriate — it's not clearly malicious, but the lack of checksum on an executed binary is a genuine risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "http://www.ac6-tools.com/downloads/SW4STM32/install_sw4stm32_linux_64bits-v$pkgver.run"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt .run installer from ac6-tools.com (the official AC6/Ac6 vendor site for System Workbench for STM32, which is a legitimate embedded IDE vendor) and executes it via 'java -jar'. The checksum is SKIP'd, meaning there is no integrity verification of the downloaded binary. While ac6-tools.com is the actual upstream vendor host for this tool (not a random personal host), the SKIP checksum means any MITM or server-side substitution would go undetected. The .run file is executed directly during the package() phase, giving it full access to the build environment. This is a real supply-chain concern: an executed binary installer with no integrity check, even from a nominally legitimate vendor. The medium rating is appropriate — it's not clearly malicious, but the lack of checksum on an executed binary is a genuine risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: robertfoster
    
      2# Contributor: Marcin Kornat <rarvolt@rarvolt.net>
    
      3# Contributor: Romain Porte <microjoe@microjoe.org>
    
      4
    
      5pkgname=sw4stm32
    
      6pkgver=2.9
    
      7pkgrel=1
    
      8pkgdesc="SystemWorkbench for STM32"
    
      9arch=('x86_64')
    
      10url="http://www.openstm32.org/System+Workbench+for+STM32"
    
      11license=('CUSTOM')
    
      12depends=("java-environment=8")
    
      13options=(!emptydirs !strip)
    
      14source=( 
    
      15  "http://www.ac6-tools.com/downloads/SW4STM32/install_sw4stm32_linux_64bits-v$pkgver.run"
    
      16  $pkgname
    
      17  $pkgname.png
    
      18  $pkgname.desktop
    
      19  auto-install.xml)
    
      20noextract=(install_sw4stm32_linux_64bits-v$pkgver.run)
    
      21optdepends=('arm-none-eabi-gcc: ARM compiler'
    
      22  'arm-none-eabi-gdb: ARM GDB'
    
      23  'arm-none-eabi-newlib: ARM bare metal files'
    
      24  'arm-none-eabi-binutils: ARM binutils'
    
      25  'openocd: firmware flashing tool')
    
      26
    
      27package() {
    
      28  HOME="$pkgdir/usr/lib/sw4stm32"
    
      29  sed "s|@HOME@|$HOME|g" auto-install.xml >unattended.xml
    
      30
    
      31  cd $srcdir
    
      32  chmod +x install_sw4stm32_linux_64bits-v$pkgver.run
    
      33
    
      34  java -jar install_sw4stm32_linux_64bits-v$pkgver.run unattended.xml
    
      35
    
      36  # Copy icon and desktop
    
      37  install -Dm644 "sw4stm32.png" "${pkgdir}/usr/share/pixmaps/sw4stm32.png"
    
      38  install -Dm644 "sw4stm32.desktop" "${pkgdir}/usr/share/applications/sw4stm32.desktop"
    
      39
    
      40  # Copy bash executable to path
    
      41  install -Dm755 sw4stm32 "$pkgdir/usr/bin/sw4stm32"
    
      42
    
      43  # Copy udev rule manually
    
      44  #for i in $(seq 1 3); do
    
      45  #	install -Dm644 "$HOME/.installation/49-stlinkv$i.rules" \
    
      46  #		"$pkgdir/etc/udev/rules.d/49-stlinkv$i.rules"
    
      47  #done
    
      48
    
      49  # Extracting arm cross-compiler
    
      50  CROSSPATH="$HOME/plugins/fr.ac6.mcu.externaltools.arm-none.linux64_1.17.0.201812190825/tools/st-gnu-arm-gcc-7-2018-q2-update_gdb-5_4-2016q3-linux.tar.bz2"
    
      51  CROSSDEST=$(dirname $CROSSPATH)
    
      52  tar -xf $CROSSPATH -C $(dirname $CROSSPATH)
    
      53  rm $CROSSPATH
    
      54  chmod 755 -R $CROSSDEST
    
      55
    
      56  # Clean the fakeroot
    
      57  rm -rf $HOME/{.installation,stlinkserver/st-stlink*,.desktop_shortcut.sh,uninstall.jar}
    
      58
    
      59  # Change configuration folder
    
      60  echo "-Dosgi.configuration.area=@user.home/.sw4stm32" >>$HOME/eclipse.bin.ini
    
      61}
    
      62
    
      63sha256sums=('SKIP'
    
      64            'b2fe312a41c77ab68bcbc0287998a32c66a72ca3a479d21e1ce563b05be9f781'
    
      65            '91b0300e815029c7f3fbb9ba5641804a140623865c21cfa703451697fd877076'
    
      66            'df786691de3e76d0ae66a74727ba3022c2bce76e8cfcb651418a1ae9e233c919'
    
      67            'f421475096cd4e1191b19c59f183776874379d7b73c8a399996c7a8a130d32f8')
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2