wch-bleuart-app
LOW
maintainer taotieren
0 votes
base
wch-bleuart
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads official vendor files from the company's own API domain (api.wch.cn), which is plausibly legitimate; the files include a prebuilt .deb and libraries, but given the vendor context and verifiable checksums, the risk is low despite the non-standard URL format.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official vendor files from the company's own API domain (api.wch.cn), which is plausibly legitimate; the files include a prebuilt .deb and libraries, but given the vendor context and verifiable checksums, the risk is low despite the non-standard URL format.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
"wch-ble-lib-${pkgver}.zip::https://api.wch.cn/api/official/website/common/downloadFile?fileName=BleUartLib.ZIP"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: taotieren <admin@taotieren.com>
2
3
pkgbase=wch-bleuart
4
pkgname=($pkgbase wch-bleuart-app wch-ble-lib wch-bleuart-guide)
5
pkgver=1.3
6
pkgrel=1
7
arch=('x86_64')
8
url='http://www.mounriver.com/'
9
license=('GPL-2.0-or-later')
10
provides=()
11
conflicts=()
12
depends=(
13
bash
14
gcc-libs
15
glib2
16
glibc
17
libgpg-error
18
java-runtime
19
zlib
20
)
21
makedepends=('libarchive' 'unarchiver')
22
optdepends=('mounriver-studio-toolchain-bin: This MRS Toolchain includes the tool chain for RISC-V kernel chip under Linux x64 and the debug download tool OpenOCD.')
23
source=(
24
"wch-ble-lib-${pkgver}.zip::https://api.wch.cn/api/official/website/common/downloadFile?fileName=BleUartLib.ZIP"
25
"wch-bleuart-app-${pkgver}.zip::https://api.wch.cn/api/official/website/common/downloadFile?fileName=BleUartApp.ZIP"
26
"CH9143DS1-${pkgver}.pdf::https://api.wch.cn/api/official/website/common/downloadFile?fileName=CH9143DS1.PDF"
27
"CH9140DS1-${pkgver}.pdf::https://api.wch.cn/api/official/website/common/downloadFile?fileName=CH9140DS1.PDF"
28
"CH9141DS1-${pkgver}.pdf::https://api.wch.cn/api/official/website/common/downloadFile?fileName=CH9141DS1.PDF"
29
30
)
31
32
sha256sums=('9f9326c81fdf2d1e88e621a628f1c5d64c55d07fd2dab67c5362a3c9b1a3282d'
33
'85cd9431265bb728d5f89bb72947b6deb62338689c8be647027b07314dbeed48'
34
'7d31eb1b4fede49c7f6786c072a6a4d61329dad797b1ad72e5060ac24f33456b'
35
'4013a01ef7a7928e3232b0aed9a4622ad4a9c4ac3481900c6ff895250de690ef'
36
'95dac832cb5168d4388192baa16e84baf38672b39420fdd7bcd793c3784a2fd3')
37
38
noextract=(wch-bleuart-app-${pkgver}.zip wch-ble-lib-${pkgver}.zip)
39
40
package_wch-bleuart() {
41
pkgdesc="Wch-bleuart contains all related software packages of BleUart."
42
depends=(wch-bleuart-app wch-ble-lib wch-bleuart-guide)
43
}
44
45
package_wch-bleuart-app() {
46
pkgdesc="The software is used for the CH914X chip module of CH914X low-power Bluetooth to serial port."
47
48
install -dm0755 "${pkgdir}/opt/wch/${pkgname}"
49
50
unar -e GBK "${srcdir}/${pkgname}-${pkgver}.zip" -o "${srcdir}"
51
bsdtar xf "${srcdir}/BleUartApp/Linux/bleuart_1.0_amd64.deb"
52
bsdtar xf "${srcdir}/data.tar.xz" --strip-components=3 -C "${pkgdir}/opt/wch/${pkgname}"
53
cp -r "${srcdir}"/BleUartApp/*.pdf "${pkgdir}/opt/wch/${pkgname}"
54
55
install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/bleuart" <<EOF
56
#!/bin/env bash
57
58
cd /opt/wch/${pkgname}
59
exec ./BleUart "\$@"
60
61
EOF
62
install -Dm0644 /dev/stdin "${pkgdir}/usr/share/applications/bleuart.desktop" <<EOF
63
[Desktop Entry]
64
Type=Application
65
Name=BleUart
66
Exec=bleuart
67
Icon=/opt/wch/${pkgname}/BleUart.ico
68
Comment=BleUart, V1.0 南京沁恒微电子股份有限公司 版权所有(C) WCH 2021
69
Terminal=false
70
Type=Application
71
Encoding=UTF-8
72
73
EOF
74
}
75
76
package_wch-ble-lib() {
77
pkgdesc="WCH BleLib Multi-system platform low Power Bluetooth Development Interface Library."
78
provides=('CH914X-lib' 'CH57X-lib' 'CH9140-lib' 'CH9141-lib' 'CH9143-lib' 'CH579-lib' 'CH578-lib' 'CH573-lib')
79
install -dm0755 "${pkgdir}/opt/wch/${pkgname}"
80
81
unar -e GBK "${srcdir}/${pkgname}-${pkgver}.zip"
82
cp -r "${srcdir}"/BleUartLib/* "${pkgdir}/opt/wch/${pkgname}"
83
84
install -Dm0755 /dev/stdin "${pkgdir}/etc/profile.d/${pkgname}.sh" <<EOF
85
#!/bin/sh
86
[ -d /opt/wch/${pkgname}/Linux/LIB ] && append_path '/opt/wch/${pkgname}/Linux/LIB'
87
88
export PATH
89
EOF
90
}
91
92
package_wch-bleuart-guide() {
93
pkgdesc="Introduction to CH9140 CH9141 CH9143."
94
install -dm0755 "${pkgdir}/opt/wch/${pkgname}"
95
provides=('CH914X-guide' 'CH9140-guide' 'CH9141-guide' 'CH9143-guide')
96
cp -r "${srcdir}"/*.pdf "${pkgdir}/opt/wch/${pkgname}"
97
}
98
# vim: ts=4 sw=4 et
99
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |