armv7l-gcc-bootstrap

maintainer graysky · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a Git checkout from sourceware.org, the official GCC project host, which is legitimate despite not being on the analyzer's whitelist; building from official source is normal AUR practice.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a Git checkout from sourceware.org, the official GCC project host, which is legitimate despite not being on the analyzer's whitelist; building from official source is normal AUR practice.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=(git+https://sourceware.org/git/gcc.git#commit=${_commit})

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: graysky <therealgraysky AT proton DOT me>
    
      2# Contributor: Christer Solskogen <christer.solskogen@gmail.com>
    
      3# Build order: armv7l-binutils -> armv7l-linux-api-headers -> armv7l-gcc-bootstrap -> armv7l-glibc -> armv7l-gcc -> armv7l-glibc (again)
    
      4
    
      5_arch=armv7l
    
      6_target=$_arch-unknown-linux-gnueabihf
    
      7pkgname=$_arch-gcc-bootstrap
    
      8pkgver=16.1.1+r346+g4e03491b401d
    
      9# https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git
    
      10_commit=4e03491b401dce0658543dd90524ddb92063836e
    
      11pkgrel=2
    
      12pkgdesc='The GNU Compiler Collection - cross compiler for armv7l - bootstrap compiler'
    
      13arch=(x86_64)
    
      14url='https://gcc.gnu.org/'
    
      15license=('GPL-3.0-or-later WITH GCC-exception-3.1' GFDL-1.3-or-later)
    
      16depends=(libmpc zstd libisl)
    
      17makedepends=($_arch-binutils git)
    
      18provides=($_arch-gcc)
    
      19conflicts=($_arch-gcc)
    
      20options=(!emptydirs !strip staticlibs)
    
      21source=(git+https://sourceware.org/git/gcc.git#commit=${_commit})
    
      22
    
      23sha256sums=('73dca834e44d5e4501efa3f68a190a902d0a83c66f4cf4fd5b3da24e2cefdaf4')
    
      24
    
      25validpgpkeys=(F3691687D867B81B51CE07D9BBE43771487328A9  # bpiotrowski@archlinux.org
    
      26              86CFFCA918CF3AF47147588051E8B148A9999C34  # evangelos@foutrelis.com
    
      27              13975A70E63C361C73AE69EF6EEB81F8981C74C7  # richard.guenther@gmail.com
    
      28              D3A93CAD751C2AF4F8C7AD516C35B99309B5FA62) # Jakub Jelinek <jakub@redhat.com>
    
      29
    
      30prepare() {
    
      31  [[ ! -d gcc ]] && ln -s gcc-${pkgver/+/-} gcc
    
      32  cd gcc
    
      33
    
      34  rm -rf "$srcdir"/gcc-build
    
      35  mkdir "$srcdir"/gcc-build
    
      36}
    
      37
    
      38build() {
    
      39  cd gcc-build
    
      40
    
      41  # Credits @allanmcrae
    
      42  # https://github.com/allanmcrae/toolchain/blob/f18604d70c5933c31b51a320978711e4e6791cf1/gcc/PKGBUILD
    
      43  # TODO: properly deal with the build issues resulting from this
    
      44  CFLAGS=${CFLAGS/-Werror=format-security/}
    
      45  CXXFLAGS=${CXXFLAGS/-Werror=format-security/}
    
      46
    
      47  "$srcdir"/gcc/configure \
    
      48      --prefix=/usr \
    
      49      --with-sysroot=/usr/$_target/sys-root \
    
      50      --libexecdir=/usr/lib \
    
      51      --target=$_target \
    
      52      --disable-nls \
    
      53      --enable-languages=c \
    
      54      --with-system-zlib \
    
      55      --disable-multilib --disable-werror \
    
      56      --disable-threads --without-headers  \
    
      57      --disable-shared --with-newlib \
    
      58      --disable-libatomic
    
      59
    
      60  make all-gcc all-target-libgcc
    
      61}
    
      62
    
      63package() {
    
      64  cd gcc-build
    
      65
    
      66  make install-strip-gcc install-strip-target-libgcc DESTDIR="$pkgdir"
    
      67  # Remove files that conflict with host gcc package
    
      68  rm -r "$pkgdir"/usr/{include,share}
    
      69
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2