wch-bleuart-guide
LOW
maintainer taotieren
0 votes
base
wch-bleuart
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads official vendor files (ZIP archives, PDFs, and a .deb) from the legitimate domain file.wch.cn, which is plausibly owned by the hardware manufacturer WCH; the files are extracted and installed without executing remote code, and the checksums are provided, making it a standard AUR package with a non-whitelisted but trusted source.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official vendor files (ZIP archives, PDFs, and a .deb) from the legitimate domain file.wch.cn, which is plausibly owned by the hardware manufacturer WCH; the files are extracted and installed without executing remote code, and the checksums are provided, making it a standard AUR package with a non-whitelisted but trusted source.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:27
"wch-ble-lib-${pkgver}.zip::https://file.wch.cn/download/file?id=346"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: taotieren <admin@taotieren.com>
2
3
pkgbase=wch-bleuart
4
pkgname=($pkgbase wch-bleuart-app wch-ble-lib wch-bleuart-guide)
5
pkgver=1.4
6
pkgrel=1
7
arch=('x86_64')
8
url='http://www.mounriver.com/'
9
license=('GPL-2.0-or-later')
10
provides=()
11
conflicts=()
12
depends=(
13
bash
14
freetype2
15
fontconfig
16
glib2
17
glibc
18
libgcc
19
libgpg-error
20
libstdc++
21
java-runtime
22
zlib
23
)
24
makedepends=('libarchive' 'unarchiver')
25
optdepends=('mounriver-studio-toolchain-bin: This MRS Toolchain includes the tool chain for RISC-V kernel chip under Linux x64 and the debug download tool OpenOCD.')
26
source=(
27
"wch-ble-lib-${pkgver}.zip::https://file.wch.cn/download/file?id=346"
28
"wch-bleuart-app-${pkgver}.zip::https://file.wch.cn/download/file?id=347"
29
"CH9143DS1-${pkgver}.pdf::https://file.wch.cn/download/file?id=274"
30
"CH9140DS1-${pkgver}.pdf::https://file.wch.cn/download/file?id=331"
31
"CH9141DS1-${pkgver}.pdf::https://file.wch.cn/download/file?id=332"
32
33
)
34
35
sha256sums=('9f9326c81fdf2d1e88e621a628f1c5d64c55d07fd2dab67c5362a3c9b1a3282d'
36
'155facfb45e0bc3e8af3b9de2b6af1fd12a1a85f0770e71857ddc7b426b7dc18'
37
'95dac832cb5168d4388192baa16e84baf38672b39420fdd7bcd793c3784a2fd3'
38
'4013a01ef7a7928e3232b0aed9a4622ad4a9c4ac3481900c6ff895250de690ef'
39
'7d31eb1b4fede49c7f6786c072a6a4d61329dad797b1ad72e5060ac24f33456b')
40
41
noextract=(wch-bleuart-app-${pkgver}.zip wch-ble-lib-${pkgver}.zip)
42
43
package_wch-bleuart() {
44
pkgdesc="Wch-bleuart contains all related software packages of BleUart."
45
depends=(wch-bleuart-app wch-ble-lib wch-bleuart-guide)
46
}
47
48
package_wch-bleuart-app() {
49
pkgdesc="The software is used for the CH914X chip module of CH914X low-power Bluetooth to serial port."
50
51
install -dm0755 "${pkgdir}/opt/wch/${pkgname}"
52
53
unar -e GBK "${srcdir}/${pkgname}-${pkgver}.zip" -o "${srcdir}"
54
bsdtar xf "${srcdir}/BleUartApp/Linux/bleuart_1.0_amd64.deb"
55
bsdtar xf "${srcdir}/data.tar.xz" --strip-components=3 -C "${pkgdir}/opt/wch/${pkgname}"
56
cp -r "${srcdir}"/BleUartApp/*.pdf "${pkgdir}/opt/wch/${pkgname}"
57
58
install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/bleuart" <<EOF
59
#!/bin/env bash
60
61
cd /opt/wch/${pkgname}
62
exec ./BleUart "\$@"
63
64
EOF
65
install -Dm0644 /dev/stdin "${pkgdir}/usr/share/applications/bleuart.desktop" <<EOF
66
[Desktop Entry]
67
Type=Application
68
Name=BleUart
69
Exec=bleuart
70
Icon=/opt/wch/${pkgname}/BleUart.ico
71
Comment=BleUart, V1.0 南京沁恒微电子股份有限公司 版权所有(C) WCH 2021
72
Terminal=false
73
Type=Application
74
Encoding=UTF-8
75
76
EOF
77
}
78
79
package_wch-ble-lib() {
80
pkgdesc="WCH BleLib Multi-system platform low Power Bluetooth Development Interface Library."
81
provides=('CH914X-lib' 'CH57X-lib' 'CH9140-lib' 'CH9141-lib' 'CH9143-lib' 'CH579-lib' 'CH578-lib' 'CH573-lib')
82
depends=()
83
install -dm0755 "${pkgdir}/opt/wch/${pkgname}"
84
85
unar -e GBK "${srcdir}/${pkgname}-${pkgver}.zip"
86
cp -r "${srcdir}"/BleUartLib/* "${pkgdir}/opt/wch/${pkgname}"
87
88
install -Dm0755 /dev/stdin "${pkgdir}/etc/profile.d/${pkgname}.sh" <<EOF
89
#!/bin/sh
90
[ -d /opt/wch/${pkgname}/Linux/LIB ] && append_path '/opt/wch/${pkgname}/Linux/LIB'
91
92
export PATH
93
EOF
94
}
95
96
package_wch-bleuart-guide() {
97
pkgdesc="Introduction to CH9140 CH9141 CH9143."
98
depends=()
99
install -dm0755 "${pkgdir}/opt/wch/${pkgname}"
100
provides=('CH914X-guide' 'CH9140-guide' 'CH9141-guide' 'CH9143-guide')
101
cp -r "${srcdir}"/*.pdf "${pkgdir}/opt/wch/${pkgname}"
102
}
103
# vim: ts=4 sw=4 et
104
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |