bglibs

LOW

maintainer dreieck 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is downloaded from the project's official domain (untroubled.org), which is not on the whitelist but is plausibly legitimate; building from official project sources is normal AUR practice and does not constitute a significant supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from the project's official domain (untroubled.org), which is not on the whitelist but is plausibly legitimate; building from official project sources is normal AUR practice and does not constitute a significant supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:47 "https://untroubled.org/bglibs/bglibs-${pkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  dreieck
    
      2# Contributor: Jakob Gahde <j5lx@fmail.co.uk>
    
      3# Contributor: Nathan Owe <ndowens.aur at gmail dot com>
    
      4
    
      5_pkgname=bglibs
    
      6pkgname="${_pkgname}"
    
      7pkgver=2.04
    
      8_debianrel=9
    
      9pkgrel=1
    
      10pkgdesc="Collection of libraries needed for software from untroubled.org (by Bruce Guenter)."
    
      11arch=(
    
      12  'i686'
    
      13  'x86_64'
    
      14  'aarch64'
    
      15  'armv6h'
    
      16  'armv7h'
    
      17)
    
      18url="http://untroubled.org/bglibs"
    
      19license=('LGPL-2.1-or-later')
    
      20depends=(
    
      21  'glibc'
    
      22)
    
      23optdepends=(
    
      24  "perl: For '/usr/bin/cli-generate'."
    
      25)
    
      26provides=(
    
      27  "bg-installer=${pkgver}"
    
      28  "cli-generate=${pkgver}"
    
      29  "crc-gentab=${pkgver}"
    
      30  "libbg-cli.a=${pkgver}"
    
      31  "libpwcmp.a=${pkgver}"
    
      32  "libpwcmp-module.a=${pkgver}"
    
      33  "libvmailmgr.a=${pkgver}"
    
      34  "libbg.so"
    
      35)
    
      36conflicts=(
    
      37  "bg-installer"
    
      38  "cli-generate"
    
      39  "crc-gentab"
    
      40  "libbg-cli.a"
    
      41  "libpwcmp.a"
    
      42  "libpwcmp-module.a"
    
      43  "libvmailmgr.a"
    
      44  "libbg.so"
    
      45)
    
      46source=(
    
      47  "https://untroubled.org/bglibs/bglibs-${pkgver}.tar.gz"
    
      48  "https://untroubled.org/bglibs/bglibs-${pkgver}.tar.gz.sig"
    
      49  "https://deb.debian.org/debian/pool/main/b/bglibs/bglibs_${pkgver}+dfsg-${_debianrel}.debian.tar.xz" # https://packages.debian.org/source/sid/bglibs
    
      50  "bglibs_0001_properly-align-HMAC-state-buffers-on-stack.patch::https://github.com/bruceg/bglibs/pull/1.patch"
    
      51  "bglibs_0002_feature-tests-gcc14.patch::https://github.com/bruceg/bglibs/pull/8.patch"
    
      52  "bglibs_0003_fix-build-with-musl-libc.patch::https://github.com/bruceg/bglibs/pull/9.patch"
    
      53  "bglibs_0004_fixes-for-newer-GCC.patch::https://github.com/bruceg/bglibs/pull/10.patch"
    
      54  "bglibs_0005_fix-documentation-typo-seperately.patch::https://github.com/bruceg/bglibs/pull/4.patch"
    
      55  "bglibs_0006_add-feature-macro-for-glibc-in-sig_suspend.c.patch::https://github.com/bruceg/bglibs/pull/7.patch"
    
      56)
    
      57validpgpkeys=('D0B7C8DD365DA39529DA2E2AE96FB2DC699980E8')
    
      58sha256sums=(
    
      59  'e4ae34a4c43f72ff0c5f100b3ac432460e7d736a7f0708d5e429c97dd5c52474'
    
      60  'b5cb24d7c9dba6984eb8dc33168c5382fb33e24846944219a49b6de4cdd31ef2'
    
      61  '1ee0ccc8a5a7fd01a89a6c7e3180587d1e01498d78a8cda214d2fdd78cef520d'
    
      62  '479cba5acc7720d3c3cefcde1bb226e63dc06409d146418f3ce3c704c835d74c'
    
      63  '9184a4dd8a67d8bf32591086231c59ead5a607214223fc849c8617b5985a77de'
    
      64  '02c49c3cd026068319133127250fc5606672a2d3d9be37ca17d24a25cc2498a6'
    
      65  '78c1e461a1ca0c5f45673718f49bec8b89572fab825aacf4eb5fb77e9e00577f'
    
      66  '0739cad7a181b39e76bd88ceeb638481cb9297c3c9d227df8d87a9e4ad02c78c'
    
      67  '159ed85a0225ba1f490dab712d9a9f510a5a9a1c4bdc5b4d95f09fac99ac349b'
    
      68)
    
      69options+=('staticlibs' 'emptydirs')
    
      70
    
      71prepare() {
    
      72  cd "${srcdir}/${pkgname}-${pkgver}"
    
      73
    
      74  local _patch
    
      75  for _patch in "${srcdir}"/bglibs_[0-9]*.patch "${srcdir}/debian"/patches/001_ensure_use_of_usr_bin_perl.patch; do
    
      76    printf '%s\n' "Applying patch $(basename "${_patch}" ...)"
    
      77    patch -Np1 --follow-symlinks -i "${_patch}"
    
      78  done
    
      79}
    
      80
    
      81build() {
    
      82  cd "${srcdir}/${pkgname}-${pkgver}"
    
      83
    
      84  local _CFLAGSADDITIONS _NO_ERROR _noerror
    
      85  _CFLAGSADDITIONS=""
    
      86  _NO_ERROR=("unterminated-string-initialization" "address" "cast-function-type" "sizeof-pointer-memaccess" "old-style-definition" "unused-but-set-variable" "implicit-fallthrough" "misleading-indentation" "unterminated-string-initialization" "array-parameter" "stringop-overread" "stringop-overflow")
    
      87  for _noerror in "${_NO_ERROR[@]}"; do
    
      88    _CFLAGSADDITIONS+=" -Wno-${_noerror} -Wno-error=${_noerror}"
    
      89  done
    
      90  CFLAGS+="${_CFLAGSADDITIONS}"
    
      91  export CFLAGS
    
      92
    
      93  echo "/usr/bin" > conf-bin
    
      94  echo "/usr/include" > conf-include
    
      95  echo "/usr/lib" > conf-lib
    
      96  echo "/usr/share/man" > conf-man
    
      97  sed -i "1s/\$/ $(echo -n $CFLAGS | sed 's/[\/&]/\\&/g')/" conf-cc
    
      98  sed -i "1s/\$/ $(echo -n $LDFLAGS | sed 's/[\/&]/\\&/g')/" conf-ld
    
      99
    
      100  # 'make' also runs selftests, which fail with segmentation fault at some point
    
      101  #make -j1
    
      102  make -j1 compile
    
      103  make -j1 sysdeps.h
    
      104  make -j1 libraries
    
      105  make -j1 programs
    
      106  make -j1 man
    
      107  make -j1 dl.lib
    
      108  make -j1 bg-installer
    
      109  make -j1 bg-installer.1
    
      110}
    
      111
    
      112package() {
    
      113  cd "${srcdir}/${pkgname}-${pkgver}"
    
      114
    
      115  install_prefix="${pkgdir}" make -j1 install
    
      116
    
      117  install -Dvm644 -t "${pkgdir}/usr/share/doc/${_pkgname}"      ANNOUNCEMENT LIBVERSION NEWS README TODO VERSION
    
      118  install -Dvm644 -t "${pkgdir}/usr/share/licenses/${pkgname}"  COPYING
    
      119}
    
      120

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2