bisheng-compiler15

MEDIUM

maintainer legendt 0 votes scanned 2026-08-31 07:46:16.480028

View on AUR

Why flagged

This package installs a prebuilt binary toolchain (clang/flang/lld) from mirrors.huaweicloud.com, which is Huawei's own mirror infrastructure and plausibly official for this Kunpeng/BiSheng compiler project, but it is still an unverifiable prebuilt executable bundle from a non-standard host; the sha256 checksum is present which mitigates swap risk, lowering concern, but the nature of installing a full prebuilt compiler toolchain from a vendor mirror warrants medium caution.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("BiShengCompiler-${pkgver}-x86-linux.tar.gz::https://mirrors.huaweicloud.com/kunpeng/archive/compiler/bisheng_compiler/BiShengCompiler-${pkgver}-x86-linux.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): This package installs a prebuilt binary toolchain (clang/flang/lld) from mirrors.huaweicloud.com, which is Huawei's own mirror infrastructure and plausibly official for this Kunpeng/BiSheng compiler project, but it is still an unverifiable prebuilt executable bundle from a non-standard host; the sha256 checksum is present which mitigates swap risk, lowering concern, but the nature of installing a full prebuilt compiler toolchain from a vendor mirror warrants medium caution.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Wensheng Tang <sp3478 at gmail dot com>
    
      2pkgname=bisheng-compiler15
    
      3pkgver=3.2.0.1
    
      4pkgrel=1
    
      5pkgdesc="毕昇编译器 3.2：华为基于 LLVM 15 的 C/C++/Fortran 工具链（clang/flang/lld）"
    
      6arch=('x86_64')
    
      7url="https://www.hikunpeng.com/developer/devkit/compiler/bisheng"
    
      8license=('Apache-2.0 WITH LLVM-exception' 'custom')
    
      9depends=('gcc-libs' 'zlib')
    
      10options=('!strip' 'staticlibs' '!debug')
    
      11conflicts=()
    
      12# 上游只提供预编译二进制（Kunpeng 归档 x86 tarball），无从源码构建流程
    
      13source=("BiShengCompiler-${pkgver}-x86-linux.tar.gz::https://mirrors.huaweicloud.com/kunpeng/archive/compiler/bisheng_compiler/BiShengCompiler-${pkgver}-x86-linux.tar.gz")
    
      14sha256sums=('7b6268a45ef0a9ca5af970718fa1ffd58d7d64960130c3c9bf42b749b2a0f43a')
    
      15
    
      16_prefix="/opt/bisheng-compiler15"
    
      17_srcdir="BiShengCompiler-${pkgver}-x86-linux"
    
      18
    
      19package() {
    
      20    cd "${srcdir}"
    
      21    install -dm755 "${pkgdir}${_prefix%/*}"
    
      22    cp -a "${_srcdir}" "${pkgdir}${_prefix}"
    
      23    # 上游 tarball 内文件权限为 0550/0640（无 other 位），非 root 用户无法执行；
    
      24    # 放开 group/other 的读与执行（可执行文件 0555、普通文件 0644）
    
      25    chmod -R go+rX "${pkgdir}${_prefix}"
    
      26
    
      27    # 环境脚本（二进制含 RPATH \$ORIGIN/../lib，仅需设 PATH）
    
      28    install -Dm644 /dev/stdin "${pkgdir}${_prefix}/env.sh" <<EOF
    
      29# source 本文件以使用毕昇编译器 ${pkgver}（LLVM 15）
    
      30# 注意：会把 bisheng 的 clang 放到 PATH 最前，与系统 clang / bisheng-compiler 互斥
    
      31export BISHENG_COMPILER_ROOT="${_prefix}"
    
      32export PATH="\${BISHENG_COMPILER_ROOT}/bin:\${PATH}"
    
      33export MANPATH="\${BISHENG_COMPILER_ROOT}/share/man:\${MANPATH}"
    
      34EOF
    
      35
    
      36    install -Dm644 "${pkgdir}${_prefix}/include/llvm/Support/LICENSE.TXT" \
    
      37        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.TXT"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-31 07:46:16	Medium	3
2026-08-31 07:44:47	Medium	2