The tarball for CST is compressed by your webserver and served with "Content-Encoding: gzip". This is incorrect. It should be "Transfer-Encoding: gzip". The latter will cause the downloading browser to undo the outer layer of compression while the former causes the saved file to remain compressed twice. I suggest that you change the configuration of your webserver to stop compressing files with the extension .tgz. There is no point in compressing a compressed file.
Apart from that I would really like to have a way to download CST automatically, f.ex. from Yocto. With version 3.2.0 you have relicensed the source code unter BSD license. But although it is open source software now, one still has to login with an account to download the file. If this is done to "protect" the documentation, please omit the PDFs from future releases.
It costs us time an money to explain to our customers how they have to download CST while fixing it on your side would be so easy.
And while I'm at it:
Maybe it would be a good idea to point out in AN4581 section 3.3.2 that booting fails with 0x33 0x30 0xee 0x1d (returned on USB SDP boot, equals HAB_FAILURE HAB_ENG_FAIL HAB_CTX_EXIT HAB_ENG_CAAM) when the RNG trim fuses are not programmed and RNG instantiation is not skipped.