coccinelle-bin

maintainer meadow · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a prebuilt binary tarball from the project's official GitLab Pages site, which is a plausible project-owned host; the worst case of a swapped source is code execution, but the host is not inherently swappable like personal file hosts, and the package installs expected binaries and data for the software.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt binary tarball from the project's official GitLab Pages site, which is a plausible project-owned host; the worst case of a swapped source is code execution, but the host is not inherently swappable like personal file hosts, and the package installs expected binaries and data for the software.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://coccinelle.gitlabpages.inria.fr/website/distrib/coccinelle-${_distver}-bin-x86.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Manuel Wiesinger <m {you know what belongs here} mmap {and here} at>
    
      2
    
      3_basename=coccinelle
    
      4pkgname=$_basename-bin
    
      5_distver=1.3
    
      6pkgver=$_distver.0
    
      7pkgrel=1
    
      8pkgdesc="C source code matching and transformation engine. Without spgen and Python bindings."
    
      9arch=('x86_64')
    
      10url="https://coccinelle.lip6.fr"
    
      11license=('GPL-2.0-or-later')
    
      12depends=('glibc')
    
      13conflicts=('coccinelle' 'coccinelle-git')
    
      14provides=('coccinelle')
    
      15source=("https://coccinelle.gitlabpages.inria.fr/website/distrib/coccinelle-${_distver}-bin-x86.tar.gz")
    
      16b2sums=('c29c1775837b7bd19ad70540e50099cbfee8f15222dc4117b5fd6177ffb2c0352154966e1d155e3ca74ed2f5747530270c646d8397cd4a858e5a1ebafcc3c917')
    
      17
    
      18package() {
    
      19        cd $srcdir/$_basename-$_distver
    
      20
    
      21	# spatch
    
      22	strip spatch.opt
    
      23	install -Dm755 spatch.opt $pkgdir/usr/bin/spatch
    
      24
    
      25	# Bash completions
    
      26	install -Dm644 scripts/spatch.bash_completion $pkgdir/usr/share/bash-completion/completions/spatch
    
      27
    
      28	# Emacs modes
    
      29	install -Dm644 editors/emacs/cocci.el -t $pkgdir/usr/share/emacs/site-lisp
    
      30	install -Dm644 editors/emacs/cocci-ediff.el -t $pkgdir/usr/share/emacs/site-lisp
    
      31
    
      32	# vim
    
      33	install -Dm644 editors/vim/ftdetect/cocci.vim -t $pkgdir/usr/share/vim/vimfiles/ftdetect
    
      34	install -Dm644 editors/vim/syntax/cocci.vim -t $pkgdir/usr/share/vim/vimfiles/syntax
    
      35
    
      36	# Manpage
    
      37	install -Dm644 docs/spatch.1 -t $pkgdir/usr/share/man/man1
    
      38
    
      39	# OCaml libraries
    
      40	find ocaml -name \*cmi -or -name \*cmx -exec install -Dm644 {} -t $pkgdir/usr/lib/ocaml/coccinelle \;
    
      41	install -Dm644 standard.h -t $pkgdir/usr/lib/ocaml/coccinelle
    
      42	install -Dm644 standard.iso -t $pkgdir/usr/lib/ocaml/coccinelle
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2