bigloo-devel

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a development version tarball from the project's official INRIA host, which is plausibly the project's own infrastructure; building from source is normal for AUR packages, and the download is not from a swappable or untrusted host despite the non-whitelisted domain.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a development version tarball from the project's official INRIA host, which is plausibly the project's own infrastructure; building from source is normal for AUR packages, and the download is not from a swappable or untrusted host despite the non-whitelisted domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("ftp://ftp-sop.inria.fr/indes/fp/Bigloo/${pkgname%-devel}-${_suffix}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Jürgen Hötzel <juergen@archlinux.org>
    
      2# Contributor: John Proctor <jproctor@prium.net>
    
      3# Contributor: Kevin Piche <kevin@archlinux.org>
    
      4# Maintainer: Stefan Husmann <stefan-husmann@t-online.de>
    
      5
    
      6pkgname=bigloo-devel
    
      7pkgver=4.6a
    
      8pkgrel=3
    
      9epoch=1
    
      10_suffix=unstable
    
      11pkgdesc="Fast scheme compiler"
    
      12arch=('x86_64')
    
      13url="https://www-sop.inria.fr/mimosa/fp/Bigloo/"
    
      14license=('GPL' 'LGPL')
    
      15depends=('gmp' 'openssl' 'libunistring' 'libnsl' 'gc' 'libuv'
    
      16	 'libpulse' 'mpg123' 'avahi' 'sqlite' 'gstreamer')
    
      17makedepends=('java-environment' 'emacs' 'zip' 'sqlite' 'alsa-lib'
    
      18	     'flac' 'avahi' 'chrpath' 'tar')
    
      19optdepends=('emacs' 'zip' 'sqlite' 'alsa-lib' 'flac' 'avahi')
    
      20options=('!makeflags' 'staticlibs')
    
      21conflicts=('bigloo')
    
      22provides=("bigloo=$pkgver")
    
      23source=("ftp://ftp-sop.inria.fr/indes/fp/Bigloo/${pkgname%-devel}-${_suffix}.tar.gz"
    
      24        "bigloo-emacs.patch"
    
      25        "Correct-string-type-declaration-in-SSL-library.patch::https://patch-diff.githubusercontent.com/raw/manuel-serrano/bigloo/pull/117.patch")
    
      26sha256sums=('cd0d3c177e4611dfec862a542581579b7751cb2249caf194624be50ae186ab52'
    
      27            '80356c27b58a302775f75e848a89ab2d588796a548f4ce7a20df048e215deab0'
    
      28            'b47500aa8fcdfa0133729aa6e0b0b71f0d1904e433b16bb1541b9c7e42908d88')
    
      29
    
      30prepare() {
    
      31  patch -p0 -d "${srcdir}/${pkgname%-devel}-$_suffix" -i "${srcdir}/bigloo-emacs.patch"
    
      32  patch -p1 -d "${srcdir}/${pkgname%-devel}-$_suffix" -i "${srcdir}/Correct-string-type-declaration-in-SSL-library.patch"
    
      33}
    
      34
    
      35build() {
    
      36  cd ${pkgname%-devel}-$_suffix
    
      37  ./configure --prefix=/usr \
    
      38    --docdir=/usr/share/doc/bigloo \
    
      39    --mandir=/usr/share/man \
    
      40    --infodir=/usr/share/info \
    
      41    --lispdir=${elisp_dir} \
    
      42    --coflags="$CFLAGS" \
    
      43    --cpicflags="-fPIC" \
    
      44    --customgc=no \
    
      45    --customgmp=no \
    
      46    --customlibuv=no \
    
      47    --customunistring=no \
    
      48    --jvm=no \
    
      49    --native-default-backend \
    
      50    --enable-avahi \
    
      51    --enable-flac \
    
      52    --enable-sqlite \
    
      53    --enable-ssl \
    
      54    --enable-gstreamer \
    
      55    --bee=full \
    
      56    --disable-mqtt \
    
      57    --no-ldpreload
    
      58  
    
      59  EXTRALIBS="-ldl -lresolv -lunistring -lpcre -lgmp -lm -lc" make build compile-bee
    
      60}
    
      61
    
      62check() {
    
      63  cd ${pkgname%-devel}-$_suffix
    
      64  make test
    
      65}
    
      66
    
      67package() {
    
      68  cd ${pkgname%-devel}-$_suffix
    
      69
    
      70  make DESTDIR="${pkgdir}" install install-bee
    
      71  make -C manuals DESTDIR="${pkgdir}" install-bee
    
      72
    
      73  rm "${pkgdir}"/usr/bin/{bglafile,bigloo}.sh
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2