android-aarch64-boost
LOW
maintainer Martchus
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a standard upstream tarball from a plausible project-owned host (archives.boost.io), building the project's own source for Android; the non-whitelisted host is not inherently dangerous as it hosts official Boost releases.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a standard upstream tarball from a plausible project-owned host (archives.boost.io), building the project's own source for Android; the non-whitelisted host is not inherently dangerous as it hosts official Boost releases.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source=("https://archives.boost.io/release/${pkgver}/source/${_srcname}.tar.bz2"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Martchus <martchus@gmx.net>
2
3
# All my PKGBUILDs are managed at https://github.com/Martchus/PKGBUILDs where
4
# you also find the URL of a binary repository.
5
6
_android_arch=aarch64
7
pkgname=android-${_android_arch}-boost
8
pkgver=1.91.0
9
pkgrel=1
10
_srcname=boost_${pkgver//./_}
11
arch=('any')
12
pkgdesc="Free peer-reviewed portable C++ source libraries (Android, ${_android_arch})"
13
url="https://www.boost.org/"
14
license=('BSL-1.0')
15
depends=("android-${_android_arch}-bzip2"
16
"android-${_android_arch}-icu"
17
"android-${_android_arch}-zlib"
18
"android-${_android_arch}-zstd")
19
makedepends=('android-environment')
20
options=(!strip !buildflags staticlibs !emptydirs)
21
source=("https://archives.boost.io/release/${pkgver}/source/${_srcname}.tar.bz2"
22
"disable-version-check.patch"
23
"fix-android-x64-fp-traits.patch")
24
sha256sums=('de5e6b0e4913395c6bdfa90537febd9028ea4c0735d2cdb0cd9b45d5f51264f5'
25
'63d12e7d703b471882608b4225c489f6a35ab425602783a4f9c4ea99a10f9c4b'
26
'a7d1f66b813e64f3865fed1046451d838674e1d7ba3da0183ea0dd90d844f536')
27
28
prepare() {
29
cd "${srcdir}/$_srcname"
30
source android-env ${_android_arch}
31
patch -p1 -i ../disable-version-check.patch
32
patch -p1 -i ../fix-android-x64-fp-traits.patch
33
}
34
35
build() {
36
cd "${srcdir}/$_srcname"
37
source android-env ${_android_arch}
38
39
# Platform specific patches
40
case "$_android_arch" in
41
aarch64)
42
_boost_arch=arm
43
_boost_address_model=64
44
;;
45
armv7a-eabi)
46
_boost_arch=arm
47
_boost_address_model=32
48
;;
49
x86)
50
_boost_arch=x86
51
_boost_address_model=32
52
;;
53
x86-64)
54
_boost_arch=x86
55
_boost_address_model=64
56
;;
57
*)
58
;;
59
esac
60
61
./bootstrap.sh -with-toolset=gcc
62
63
# support for OpenMPI
64
if [[ _boost_address_model == 64 ]]; then
65
_boost_mpi='using mpi ;'
66
else
67
_boost_mpi=''
68
fi
69
70
userConfigs=$srcdir/$_srcname/user-config.jam
71
72
cat << EOF > "${userConfigs}"
73
${_boost_mpi}
74
using clang : android : ${ANDROID_CXX} :
75
<archiver>${ANDROID_AR} \
76
<assembler>${ANDROID_AS}
77
;
78
EOF
79
80
./b2 install \
81
--prefix="$srcdir/fakeinstall" \
82
--user-config="${userConfigs}" \
83
--layout=system \
84
--with-atomic \
85
--with-chrono \
86
--with-container \
87
--with-date_time \
88
--with-exception \
89
--with-fiber \
90
--with-filesystem \
91
--with-graph \
92
--with-graph_parallel \
93
--with-iostreams \
94
--with-locale \
95
--with-log \
96
--with-math \
97
--with-mpi \
98
--with-program_options \
99
--with-random \
100
--with-regex \
101
--with-serialization \
102
--with-test \
103
--with-thread \
104
--with-timer \
105
--with-type_erasure \
106
--with-wave \
107
--with-stacktrace \
108
-sICONV_PATH="${ANDROID_PREFIX}" \
109
-sZLIB_BINARY="${ANDROID_PREFIX_LIB}/libz.so" \
110
-sZSTD_BINARY="${ANDROID_PREFIX_LIB}/libzstd.so" \
111
-sBZIP2_BINARY="${ANDROID_PREFIX_LIB}/libbz2.so" \
112
-sLZMA_BINARY="${ANDROID_PREFIX_LIB}/liblzma.so" \
113
variant=release \
114
debug-symbols=off \
115
runtime-link=shared \
116
link=shared,static \
117
target-os=android \
118
toolset=clang-android \
119
architecture=$_boost_arch \
120
threading=multi \
121
address-model=$_boost_address_model \
122
cflags="${CXXFLAGS}" \
123
cxxflags="${CFLAGS}" \
124
linkflags="${LDFLAGS}"
125
}
126
127
package() {
128
cd "${srcdir}/$_srcname"
129
source android-env ${_android_arch}
130
131
find "${srcdir}/fakeinstall"/lib -iname '*.a' -exec $ANDROID_STRIP -g {} \;
132
find "${srcdir}/fakeinstall"/lib -iname '*.so' -exec $ANDROID_STRIP --strip-unneeded {} \;
133
134
install -dm755 "$pkgdir/${ANDROID_PREFIX_LIB}/"
135
cp -a "${srcdir}/fakeinstall"/lib/*.{a,so} "$pkgdir/${ANDROID_PREFIX_LIB}/"
136
cp -a "${srcdir}/fakeinstall"/lib/cmake "$pkgdir/${ANDROID_PREFIX_LIB}/"
137
cp -a "${srcdir}/fakeinstall"/include "$pkgdir/${ANDROID_PREFIX}/"
138
139
install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE_1_0.txt
140
}
141
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |