cpl

LOW
maintainer masutu 0 votes scanned 2026-08-26 00:12:07.713121
View on AUR
Why flagged

The package builds from source tarballs hosted on the official ESO FTP server, a plausible project-owned host, and includes a non-executable shell script for environment setup; the non-whitelisted host is actually a legitimate project domain, and all built components are from verifiable upstream sources.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source tarballs hosted on the official ESO FTP server, a plausible project-owned host, and includes a non-executable shell script for environment setup; the non-whitelisted host is actually a legitimate project domain, and all built components are from verifiable upstream sources.

2 higher static findings superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:16 source=(ftp://ftp.eso.org/pub/dfs/pipelines/libraries/cpl/cpl-${pkgver}.tar.gz
Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: masutu < masutu dot arch at gmail dot com >
2# Contributor: Yigit Dallilar <yigit.dallilar@gmail.com>
3
4pkgname=cpl
5pkgver=7.4
6pkgrel=1
7#lock the versions
8_wcs_ver=8.5
9_cfitsio_ver=4.6.3
10_fftw_ver=3.3.10
11pkgdesc="ESO Common Pipeline Library"
12url="https://www.eso.org/sci/software/cpl/index.html"
13arch=('x86_64')
14license=('GPL2')
15depends=(gsl)
16source=(ftp://ftp.eso.org/pub/dfs/pipelines/libraries/cpl/cpl-${pkgver}.tar.gz
17 https://ftp.eso.org/pub/dfs/pipelines/libraries/cfitsio/cfitsio-${_cfitsio_ver}.tar.gz
18 https://ftp.eso.org/pub/dfs/pipelines/libraries/wcslib/wcslib-${_wcs_ver}.tar.bz2
19 https://ftp.eso.org/pub/dfs/pipelines/libraries/fftw/fftw-${_fftw_ver}.tar.gz
20 cpl.sh)
21md5sums=('26930526738069a72c1b607f8a3ddacd'
22 '1f95e471cf89403ff877ab58a788ad69'
23 '07b188f67739a621101103f92ccf52cc'
24 '8ccbf6a5ea78a16dbc3e1306e234cc5c'
25 'SKIP')
26
27build_cfitsio () {
28 cd ${srcdir}/cfitsio-${_cfitsio_ver}
29 ./configure --prefix=${srcdir}/build --enable-reentrant --enable-shared
30 make
31 make install
32}
33
34build_wcslib () {
35 cd ${srcdir}/wcslib-${_wcs_ver}
36 ./configure --prefix=${srcdir}/build --without-pgplot --with-x --with-cfitsiolib=${srcdir}/lib --with-cfitsioinc=${srcdir}/include --disable-fortran
37 make
38 make install
39}
40
41build_fftw () {
42 cd ${srcdir}/fftw-${_fftw_ver}
43 ./configure --prefix=${srcdir}/build --enable-openmp --enable-threads --enable-avx --enable-sse2 --disable-fortran --enable-shared --enable-float
44 make
45 make install
46 make clean
47 ./configure --prefix=${srcdir}/build --enable-openmp --enable-threads --enable-avx --enable-sse2 --disable-fortran --enable-shared
48 make
49 make install
50}
51
52build () {
53 build_cfitsio
54 build_wcslib
55 build_fftw
56 export LD_LIBRARY_PATH=${srcdir}/build/lib:${LD_LIBRARY_PATH}
57 export C_INCLUDE_PATH=${srcdir}/build/include:${C_INCLUDE_PATH}
58 export CFITSIODIR=${srcdir}/build
59 export WCSDIR=${srcdir}/build
60 export FFTWDIR=${srcdir}/build
61
62 cd ${srcdir}/${pkgname}-${pkgver}
63 ./configure --prefix=${pkgdir}/opt/esopipes --with-fftw=${FFTWDIR} CPPFLAGS="-DCX_DISABLE_ASSERT -DL2_CACHE_BYTES=0" --with-system-cext=no
64 make
65}
66
67package() {
68
69 cd ${srcdir}/${pkgname}-${pkgver}
70 make install
71 install -D -m644 COPYING "${pkgdir}/share/licenses/${pkgname}/LICENSE"
72 install -D -m755 ${srcdir}/cpl.sh ${pkgdir}/etc/profile.d/cpl.sh
73
74 cp -a ${srcdir}/build/* ${pkgdir}/opt/esopipes/
75 install -d "$pkgdir/opt/esopipes/lib/esopipes-plugins"
76}
77
78# vim:set ts=4 sw=4 et:
79

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-26 00:12
@@ -1,39 +1,33 @@
-# Maintainer: Yigit Dallilar <yigit.dallilar@gmail.com>
+# Maintainer: masutu < masutu dot arch at gmail dot com >
+# Contributor: Yigit Dallilar <yigit.dallilar@gmail.com>
pkgname=cpl
-pkgver=7.1.4
-pkgrel=3
+pkgver=7.4
+pkgrel=1
#lock the versions
-_wcs_ver=7.6
-_cfitsio_ver=3.49
-_fftw_ver=3.3.9
+_wcs_ver=8.5
+_cfitsio_ver=4.6.3
+_fftw_ver=3.3.10
pkgdesc="ESO Common Pipeline Library"
url="https://www.eso.org/sci/software/cpl/index.html"
arch=('x86_64')
license=('GPL2')
depends=(gsl)
-makedepends=(gsl)
-provides=()
-conflicts=()
-replaces=()
-backup=()
source=(ftp://ftp.eso.org/pub/dfs/pipelines/libraries/cpl/cpl-${pkgver}.tar.gz
https://ftp.eso.org/pub/dfs/pipelines/libraries/cfitsio/cfitsio-${_cfitsio_ver}.tar.gz
https://ftp.eso.org/pub/dfs/pipelines/libraries/wcslib/wcslib-${_wcs_ver}.tar.bz2
https://ftp.eso.org/pub/dfs/pipelines/libraries/fftw/fftw-${_fftw_ver}.tar.gz
cpl.sh)
-md5sums=('fd172d323a94dce2624b5d9b8014f21a'
- '171860ffed8c1a396fc497d853f285c1'
- '8fea0d68e0a0d3946c2c39d62f7198a2'
- '50145bb68a8510b5d77605f11cadf8dc'
- SKIP)
-
+md5sums=('26930526738069a72c1b607f8a3ddacd'
+ '1f95e471cf89403ff877ab58a788ad69'
+ '07b188f67739a621101103f92ccf52cc'
+ '8ccbf6a5ea78a16dbc3e1306e234cc5c'
+ 'SKIP')
build_cfitsio () {
cd ${srcdir}/cfitsio-${_cfitsio_ver}
- ./configure --prefix=${srcdir}/build --enable-reentrant --enable-sse2 --enable-ssse3
+ ./configure --prefix=${srcdir}/build --enable-reentrant --enable-shared
make
- make shared
make install
}
@@ -66,10 +60,9 @@
export FFTWDIR=${srcdir}/build
cd ${srcdir}/${pkgname}-${pkgver}
- ./configure --prefix=${pkgdir}/opt/esopipes --with-fftw=${FFTWDIR} CPPFLAGS="-DCX_DISABLE_ASSERT -DL2_CACHE_BYTES=0"
+ ./configure --prefix=${pkgdir}/opt/esopipes --with-fftw=${FFTWDIR} CPPFLAGS="-DCX_DISABLE_ASSERT -DL2_CACHE_BYTES=0" --with-system-cext=no
make
}
-
package() {
@@ -78,8 +71,8 @@
install -D -m644 COPYING "${pkgdir}/share/licenses/${pkgname}/LICENSE"
install -D -m755 ${srcdir}/cpl.sh ${pkgdir}/etc/profile.d/cpl.sh
- cp -aR ${srcdir}/build/* ${pkgdir}/opt/esopipes/
-
+ cp -a ${srcdir}/build/* ${pkgdir}/opt/esopipes/
+ install -d "$pkgdir/opt/esopipes/lib/esopipes-plugins"
}
# vim:set ts=4 sw=4 et:

Scan history

Scanned at (UTC)SeverityRules
2026-08-26 00:12:07 Low 3
2026-08-25 23:28:42 Medium 2
2026-06-19 19:07:35 Clean 2
2026-06-18 16:11:54 Medium 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion