android-aarch64-mariadb

maintainer hipersayan_x · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a MariaDB tarball from a legitimate mirror (osuosl.org, which hosts official MariaDB releases); building from this source is standard practice, and the package does not execute untrusted remote code or install prebuilt binaries.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a MariaDB tarball from a legitimate mirror (osuosl.org, which hosts official MariaDB releases); building from this source is standard practice, and the package does not execute untrusted remote code or install prebuilt binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("https://rsync.osuosl.org/pub/mariadb/mariadb-${pkgver}/source/mariadb-${pkgver}.tar.gz"{,.asc}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gonzalo Exequiel Pedone <hipersayan DOT x AT gmail DOT com>
    
      2# Contributor: Christian Hesse <eworm@archlinux.org>
    
      3
    
      4_android_arch=aarch64
    
      5
    
      6pkgname=android-${_android_arch}-mariadb
    
      7pkgdesc="MariaDB client library (Android ${_android_arch})"
    
      8pkgver=12.1.2
    
      9pkgrel=2
    
      10arch=('any')
    
      11license=('LGPL2.1')
    
      12url='https://mariadb.org/'
    
      13groups=('android-mariadb')
    
      14depends=("android-${_android_arch}-curl"
    
      15         "android-${_android_arch}-openssl"
    
      16         "android-${_android_arch}-zlib"
    
      17         "android-${_android_arch}-zstd")
    
      18makedepends=('android-cmake')
    
      19optdepends=("android-${_android_arch}-curl: for ha_s3 plugin")
    
      20options=(!strip !buildflags staticlibs !emptydirs)
    
      21# The default links with mirror redirection fail for signatures, specific
    
      22# mirrors may be out of date every now and then. Let's use the upstream
    
      23# rsync source via https and hope it does not hurt them too much.
    
      24# https://mariadb.com/kb/en/library/mirror-sites-for-mariadb/
    
      25source=("https://rsync.osuosl.org/pub/mariadb/mariadb-${pkgver}/source/mariadb-${pkgver}.tar.gz"{,.asc}
    
      26        '0004-Dont-read-PEM-keys.patch')
    
      27md5sums=('ccddcc219867b833521c279eb739191d'
    
      28         'SKIP'
    
      29         '05ce29a22db5d51618eb62fd01cf77ed')
    
      30validpgpkeys=('177F4010FE56CA3336300305F1656F24C74CD1D8') # MariaDB Signing Key <signing-key@mariadb.org>
    
      31
    
      32prepare() {
    
      33    cd "${srcdir}/mariadb-${pkgver}"
    
      34    source android-env ${_android_arch}
    
      35
    
      36    patch -Np1 -i ../0004-Dont-read-PEM-keys.patch
    
      37    sed -i 's|"lib/mariadb"|"lib"|g' libmariadb/cmake/install.cmake
    
      38}
    
      39
    
      40build() {
    
      41    cd "${srcdir}/mariadb-${pkgver}/libmariadb"
    
      42    source android-env ${_android_arch}
    
      43
    
      44    android-${_android_arch}-cmake \
    
      45        -B build \
    
      46        -DCMAKE_BUILD_TYPE=Release \
    
      47        -DWITH_EXTERNAL_ZLIB=ON \
    
      48        -DWITH_ZSTD=system \
    
      49        -DWITH_UNIT_TESTS=OFF \
    
      50        -DZLIB_BUILD_EXAMPLES=OFF \
    
      51        -DINSTALL_MANDIR=share/man \
    
      52        -DOPENSSL_ROOT_DIR="${ANDROID_PREFIX}" \
    
      53        -DOPENSSL_INCLUDE_DIR="${ANDROID_PREFIX_INCLUDE}" \
    
      54        -DOPENSSL_CRYPTO_LIBRARY="${ANDROID_PREFIX_LIB}/libcrypto.so" \
    
      55        -DOPENSSL_SSL_LIBRARY="${ANDROID_PREFIX_LIB}/libssl.so" \
    
      56        -DZSTD_LIBRARIES="${ANDROID_PREFIX_LIB}/libzstd.so" \
    
      57        -DZSTD_INCLUDE_DIRS="${ANDROID_PREFIX_INCLUDE}" \
    
      58        -DCURL_INCLUDE_DIR="${ANDROID_PREFIX_INCLUDE}" \
    
      59        -DCURL_LIBRARY="${ANDROID_PREFIX_LIB}/libcurl.so" \
    
      60        -Dpkgcfg_lib_PC_CURL_curl="${ANDROID_PREFIX_LIB}/pkgconfig/libcurl.pc"
    
      61    make -C build $MAKEFLAGS
    
      62}
    
      63
    
      64package() {
    
      65    cd "${srcdir}/mariadb-${pkgver}/libmariadb"
    
      66    source android-env ${_android_arch}
    
      67
    
      68    make -C build DESTDIR="${pkgdir}" install
    
      69    rm -rf "${pkgdir}/${ANDROID_PREFIX_SHARE}"
    
      70    ${ANDROID_STRIP} -g --strip-unneeded "${pkgdir}/${ANDROID_PREFIX_LIB}"/*.so
    
      71    ${ANDROID_STRIP} -g "${pkgdir}/${ANDROID_PREFIX_LIB}"/*.a
    
      72
    
      73    install -vDm 644 COPYING.LIB -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2