coreboot-toolchain-gcc-ppc64
maintainer felixsinger
· 5 votes
· base
coreboot-toolchain
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads source tarballs from official project mirrors (GNU, Intel, NASM, GitHub) to build a cross-compilation toolchain; all sources are used for building and not executed directly, and checksums are provided except for the git source which is expected to be volatile.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source tarballs from official project mirrors (GNU, Intel, NASM, GitHub) to build a cross-compilation toolchain; all sources are used for building and not executed directly, and checksums are provided except for the git source which is expected to be volatile.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
"git+https://review.coreboot.org/coreboot#commit=${_commit}" -
PKGBUILD:20
'https://downloadmirror.intel.com/783534/acpica-unix-20230628.tar.gz' -
PKGBUILD:21
'https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/nasm-2.16.03.tar.bz2'
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: Felix Singer <felixsinger@posteo.net>
2
3
_gcc_targets="i386 x64 arm aarch64 riscv ppc64"
4
_is_clang_enabled=1
5
_commit='04bb74a7267a64d39ca87ba8c9b4f9f34c7d2bbb'
6
7
pkgbase='coreboot-toolchain'
8
pkgname=()
9
pkgver=24.08
10
pkgrel=1
11
pkgdesc='Used to build coreboot'
12
url='https://www.coreboot.org'
13
license=(BSD2 BSD3 GPL2 LGPL2Plus GPL3Plus)
14
arch=(x86_64 aarch64 riscv)
15
depends=() # TODO
16
makedepends=('gcc-ada' 'git') # TODO
17
options=('buildflags' '!debug')
18
source=(
19
"git+https://review.coreboot.org/coreboot#commit=${_commit}"
20
'https://downloadmirror.intel.com/783534/acpica-unix-20230628.tar.gz'
21
'https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/nasm-2.16.03.tar.bz2'
22
)
23
sha256sums=(
24
'SKIP'
25
'86876a745e3d224dcfd222ed3de465b47559e85811df2db9820ef09a9dff5cce'
26
'bef3de159bcd61adf98bb7cc87ee9046e944644ad76b7633f18ab063edb29e57'
27
)
28
sources_gcc=(
29
'https://ftpmirror.gnu.org/gmp/gmp-6.3.0.tar.xz'
30
'https://ftpmirror.gnu.org/mpfr/mpfr-4.2.1.tar.xz'
31
'https://ftpmirror.gnu.org/mpc/mpc-1.3.1.tar.gz'
32
'https://ftpmirror.gnu.org/gcc/gcc-14.1.0/gcc-14.1.0.tar.xz'
33
'https://ftpmirror.gnu.org/binutils/binutils-2.42.tar.xz'
34
)
35
hashes_gcc=(
36
'a3c2b80201b89e68616f4ad30bc66aee4927c3ce50e33929ca819d5c43538898'
37
'277807353a6726978996945af13e52829e3abd7a9a5b7fb2793894e18f1fcbb2'
38
'ab642492f5cf882b74aa0cb730cd410a81edcdbec895183ce930e706c1c759b8'
39
'e283c654987afe3de9d8080bc0bd79534b5ca0d681a73a11ff2b5d3767426840'
40
'f6e4d41fd5fc778b06b7891457b3620da5ecea1006c6a4a41ae998109f85a800'
41
)
42
sources_clang=(
43
'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/lld-18.1.6.src.tar.xz'
44
'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/llvm-18.1.6.src.tar.xz'
45
'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/clang-18.1.6.src.tar.xz'
46
'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/cmake-18.1.6.src.tar.xz'
47
'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/compiler-rt-18.1.6.src.tar.xz'
48
'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/clang-tools-extra-18.1.6.src.tar.xz'
49
'https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.6/libunwind-18.1.6.src.tar.xz'
50
'https://cmake.org/files/v3.29/cmake-3.29.3.tar.gz'
51
)
52
hashes_clang=(
53
'f1f059c2bf98ffa558cd0c48ea568736c41f0c8029dabb53147d48b9efdaa802'
54
'c231d0a5445db2aafab855e052c247bdd9856ff9d7d9bffdd04e9f0bf8d5366f'
55
'54e0817f918b90b5f94684e9729ac2f9d3820fce040d6395d71c1f19ffa3b03c'
56
'a643261ed98ff76ab10f1a7039291fa841c292435ba1cfe11e235c2231b95cdb'
57
'f05f4e15a4524194c93303aa6027006a5182eccfe8f5c90491c2f1fbfcedb96b'
58
'd78732ec6d55b7374abe14b97c9529a7b56a1fe19929a5bf4c3802b69f77764e'
59
'7ed4651612a5c07aadfda38fdbd4e7e786877826790b5d74ce30edd638eb00b3'
60
'252aee1448d49caa04954fd5e27d189dd51570557313e7b281636716a238bccb'
61
)
62
63
for target in ${_gcc_targets}; do
64
pkgname+=("${pkgbase}-gcc-${target}")
65
done
66
67
if [ ${_is_clang_enabled} -eq 1 ]; then
68
pkgname+=("${pkgbase}-clang")
69
fi
70
71
if [ ${#_gcc_targets[@]} -ne 0 ]; then
72
source+=("${sources_gcc[@]}")
73
sha256sums+=("${hashes_gcc[@]}")
74
fi
75
76
if [ ${_is_clang_enabled} -eq 1 ]; then
77
makedepends+=('python')
78
source+=("${sources_clang[@]}")
79
sha256sums+=("${hashes_clang[@]}")
80
fi
81
82
noextract=("${source[@]##*/}")
83
84
85
prepare() {
86
tarballs="coreboot/util/crossgcc/tarballs"
87
mkdir -p ${tarballs}
88
for url in ${source[@]:1}; do
89
filename="$(basename ${url})"
90
ln -sf "$(pwd)/../${filename}" "${tarballs}/${filename}"
91
done
92
}
93
94
build() {
95
cd coreboot
96
export CFLAGS=${CFLAGS/-Werror=format-security/}
97
export CXXFLAGS=${CXXFLAGS/-Werror=format-security/}
98
99
for target in ${_gcc_targets}; do
100
make crossgcc-${target} CPUS=$(nproc) DEST="${srcdir}/gcc-${target}"
101
done
102
103
if [ ${_is_clang_enabled} -eq 1 ]; then
104
for component in "clang iasl nasm"; do
105
make ${component} CPUS=$(nproc) DEST="${srcdir}/clang"
106
done
107
fi
108
}
109
110
do_package_gcc() {
111
target="$(echo ${pkgname} | cut -d '-' -f 4)"
112
113
toolchain_dir="usr/${target}-coreboot-gcc"
114
dest_path="${pkgdir}/${toolchain_dir}"
115
mkdir -p ${dest_path}
116
mv "${srcdir}/gcc-${target}"/* "${dest_path}"
117
}
118
119
do_package_clang() {
120
toolchain_dir="usr/multiarch-coreboot-clang"
121
dest_path="${pkgdir}/${toolchain_dir}"
122
mkdir -p ${dest_path}
123
mv ${srcdir}/clang/* "${dest_path}"/
124
}
125
126
package_coreboot-toolchain-gcc-i386() {
127
do_package_gcc
128
}
129
130
package_coreboot-toolchain-gcc-x64() {
131
do_package_gcc
132
}
133
134
package_coreboot-toolchain-gcc-arm() {
135
do_package_gcc
136
}
137
138
package_coreboot-toolchain-gcc-aarch64() {
139
do_package_gcc
140
}
141
142
package_coreboot-toolchain-gcc-riscv() {
143
do_package_gcc
144
}
145
146
package_coreboot-toolchain-gcc-ppc64() {
147
do_package_gcc
148
}
149
150
package_coreboot-toolchain-clang() {
151
do_package_clang
152
}
153
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |