coreboot-toolchain-gcc-aarch64

LOW
maintainer felixsinger 5 votes base coreboot-toolchain scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads source tarballs from official project mirrors (GNU, Intel, NASM, GitHub) to build a cross-compilation toolchain; all sources are used for building and not executed directly, and checksums are provided except for the git source which is expected to be volatile.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source tarballs from official project mirrors (GNU, Intel, NASM, GitHub) to build a cross-compilation toolchain; all sources are used for building and not executed directly, and checksums are provided except for the git source which is expected to be volatile.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:19 "git+https://review.coreboot.org/coreboot#commit=${_commit}"
  • PKGBUILD:20 'https://downloadmirror.intel.com/783534/acpica-unix-20230628.tar.gz'
  • PKGBUILD:21 'https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/nasm-2.16.03.tar.bz2'

PKGBUILD

3 offending line(s) highlighted
1# Maintainer: Felix Singer <felixsinger@posteo.net>
2
3_gcc_targets="i386 x64 arm aarch64 riscv ppc64"
4_is_clang_enabled=1
5_commit='04bb74a7267a64d39ca87ba8c9b4f9f34c7d2bbb'
6
7pkgbase='coreboot-toolchain'
8pkgname=()
9pkgver=24.08
10pkgrel=1
11pkgdesc='Used to build coreboot'
12url='https://www.coreboot.org'
13license=(BSD2 BSD3 GPL2 LGPL2Plus GPL3Plus)
14arch=(x86_64 aarch64 riscv)
15depends=() # TODO
16makedepends=('gcc-ada' 'git') # TODO
17options=('buildflags' '!debug')
18source=(
19 "git+https://review.coreboot.org/coreboot#commit=${_commit}"
20 'https://downloadmirror.intel.com/783534/acpica-unix-20230628.tar.gz'
21 'https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/nasm-2.16.03.tar.bz2'
22)
23sha256sums=(
24 'SKIP'
25 '86876a745e3d224dcfd222ed3de465b47559e85811df2db9820ef09a9dff5cce'
26 'bef3de159bcd61adf98bb7cc87ee9046e944644ad76b7633f18ab063edb29e57'
27)
28sources_gcc=(
29 'https://ftpmirror.gnu.org/gmp/gmp-6.3.0.tar.xz'
30 'https://ftpmirror.gnu.org/mpfr/mpfr-4.2.1.tar.xz'
31 'https://ftpmirror.gnu.org/mpc/mpc-1.3.1.tar.gz'
32 'https://ftpmirror.gnu.org/gcc/gcc-14.1.0/gcc-14.1.0.tar.xz'
33 'https://ftpmirror.gnu.org/binutils/binutils-2.42.tar.xz'
34)
35hashes_gcc=(
36 'a3c2b80201b89e68616f4ad30bc66aee4927c3ce50e33929ca819d5c43538898'
37 '277807353a6726978996945af13e52829e3abd7a9a5b7fb2793894e18f1fcbb2'
38 'ab642492f5cf882b74aa0cb730cd410a81edcdbec895183ce930e706c1c759b8'
39 'e283c654987afe3de9d8080bc0bd79534b5ca0d681a73a11ff2b5d3767426840'
40 'f6e4d41fd5fc778b06b7891457b3620da5ecea1006c6a4a41ae998109f85a800'
41)
42sources_clang=(
43 'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/lld-18.1.6.src.tar.xz'
44 'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/llvm-18.1.6.src.tar.xz'
45 'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/clang-18.1.6.src.tar.xz'
46 'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/cmake-18.1.6.src.tar.xz'
47 'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/compiler-rt-18.1.6.src.tar.xz'
48 'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/clang-tools-extra-18.1.6.src.tar.xz'
49 'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/libunwind-18.1.6.src.tar.xz'
50 'https://cmake.org/files/v3.29/cmake-3.29.3.tar.gz'
51)
52hashes_clang=(
53 'f1f059c2bf98ffa558cd0c48ea568736c41f0c8029dabb53147d48b9efdaa802'
54 'c231d0a5445db2aafab855e052c247bdd9856ff9d7d9bffdd04e9f0bf8d5366f'
55 '54e0817f918b90b5f94684e9729ac2f9d3820fce040d6395d71c1f19ffa3b03c'
56 'a643261ed98ff76ab10f1a7039291fa841c292435ba1cfe11e235c2231b95cdb'
57 'f05f4e15a4524194c93303aa6027006a5182eccfe8f5c90491c2f1fbfcedb96b'
58 'd78732ec6d55b7374abe14b97c9529a7b56a1fe19929a5bf4c3802b69f77764e'
59 '7ed4651612a5c07aadfda38fdbd4e7e786877826790b5d74ce30edd638eb00b3'
60 '252aee1448d49caa04954fd5e27d189dd51570557313e7b281636716a238bccb'
61)
62
63for target in ${_gcc_targets}; do
64 pkgname+=("${pkgbase}-gcc-${target}")
65done
66
67if [ ${_is_clang_enabled} -eq 1 ]; then
68 pkgname+=("${pkgbase}-clang")
69fi
70
71if [ ${#_gcc_targets[@]} -ne 0 ]; then
72 source+=("${sources_gcc[@]}")
73 sha256sums+=("${hashes_gcc[@]}")
74fi
75
76if [ ${_is_clang_enabled} -eq 1 ]; then
77 makedepends+=('python')
78 source+=("${sources_clang[@]}")
79 sha256sums+=("${hashes_clang[@]}")
80fi
81
82noextract=("${source[@]##*/}")
83
84
85prepare() {
86 tarballs="coreboot/util/crossgcc/tarballs"
87 mkdir -p ${tarballs}
88 for url in ${source[@]:1}; do
89 filename="$(basename ${url})"
90 ln -sf "$(pwd)/../${filename}" "${tarballs}/${filename}"
91 done
92}
93
94build() {
95 cd coreboot
96 export CFLAGS=${CFLAGS/-Werror=format-security/}
97 export CXXFLAGS=${CXXFLAGS/-Werror=format-security/}
98
99 for target in ${_gcc_targets}; do
100 make crossgcc-${target} CPUS=$(nproc) DEST="${srcdir}/gcc-${target}"
101 done
102
103 if [ ${_is_clang_enabled} -eq 1 ]; then
104 for component in "clang iasl nasm"; do
105 make ${component} CPUS=$(nproc) DEST="${srcdir}/clang"
106 done
107 fi
108}
109
110do_package_gcc() {
111 target="$(echo ${pkgname} | cut -d '-' -f 4)"
112
113 toolchain_dir="usr/${target}-coreboot-gcc"
114 dest_path="${pkgdir}/${toolchain_dir}"
115 mkdir -p ${dest_path}
116 mv "${srcdir}/gcc-${target}"/* "${dest_path}"
117}
118
119do_package_clang() {
120 toolchain_dir="usr/multiarch-coreboot-clang"
121 dest_path="${pkgdir}/${toolchain_dir}"
122 mkdir -p ${dest_path}
123 mv ${srcdir}/clang/* "${dest_path}"/
124}
125
126package_coreboot-toolchain-gcc-i386() {
127 do_package_gcc
128}
129
130package_coreboot-toolchain-gcc-x64() {
131 do_package_gcc
132}
133
134package_coreboot-toolchain-gcc-arm() {
135 do_package_gcc
136}
137
138package_coreboot-toolchain-gcc-aarch64() {
139 do_package_gcc
140}
141
142package_coreboot-toolchain-gcc-riscv() {
143 do_package_gcc
144}
145
146package_coreboot-toolchain-gcc-ppc64() {
147 do_package_gcc
148}
149
150package_coreboot-toolchain-clang() {
151 do_package_clang
152}
153

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion