Please help us increase the security of the SilconLabs ecosystem

[ynezz]

Hello,

I would like to raise an important security concern regarding two critical tools used in firmware build pipelines:

• SimplicityCommander-Linux.zip
• slc_cli_linux.zip

Currently, these tools are only available as unversioned downloads that always provide the latest release. This creates several security and reproducibility issues:

1. No way to pin specific versions in build pipelines
2. Unable to implement proper integrity checking of downloaded tools
3. Cannot verify authenticity of the toolchain components
4. Impossible to achieve reproducible builds due to potentially different tool versions

This issue has been previously raised in the SiLabs Community (see: https://community.silabs.com/s/question/0D58Y00008rSY1pSAG/slc-cli-access-to-released-versions) but remains unaddressed.

Suggested improvements

1. Provide versioned releases of both tools (e.g., slc_cli_linux_v1.2.3.zip)
2. Include cryptographic signatures or checksums for package verification
3. Maintain an archive of previous versions for backwards compatibility

These changes would significantly improve the security posture of projects using SiLabs tools by enabling:

• Reproducible builds
• Supply chain security through package verification
• Controlled tool upgrades in production environments

We hope this can be prioritized as it impacts the security of the entire SiLabs ecosystem. Many organizations are moving towards more stringent supply chain security requirements, and having verifiable, versioned tooling is becoming increasingly critical.

Thank you for considering this security enhancement request.