cpl

LOW

maintainer masutu 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from source tarballs hosted on the official ESO FTP server, a plausible project-owned host, and includes a non-executable shell script for environment setup; the non-whitelisted host is actually a legitimate project domain, and all built components are from verifiable upstream sources.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source tarballs hosted on the official ESO FTP server, a plausible project-owned host, and includes a non-executable shell script for environment setup; the non-whitelisted host is actually a legitimate project domain, and all built components are from verifiable upstream sources.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=(ftp://ftp.eso.org/pub/dfs/pipelines/libraries/cpl/cpl-${pkgver}.tar.gz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: masutu < masutu dot arch at gmail dot com >
    
      2# Contributor: Yigit Dallilar <yigit.dallilar@gmail.com>
    
      3
    
      4pkgname=cpl
    
      5pkgver=7.4
    
      6pkgrel=1
    
      7#lock the versions
    
      8_wcs_ver=8.5
    
      9_cfitsio_ver=4.6.3
    
      10_fftw_ver=3.3.10
    
      11pkgdesc="ESO Common Pipeline Library"
    
      12url="https://www.eso.org/sci/software/cpl/index.html"
    
      13arch=('x86_64')
    
      14license=('GPL2')
    
      15depends=(gsl)
    
      16source=(ftp://ftp.eso.org/pub/dfs/pipelines/libraries/cpl/cpl-${pkgver}.tar.gz
    
      17	https://ftp.eso.org/pub/dfs/pipelines/libraries/cfitsio/cfitsio-${_cfitsio_ver}.tar.gz
    
      18	https://ftp.eso.org/pub/dfs/pipelines/libraries/wcslib/wcslib-${_wcs_ver}.tar.bz2
    
      19	https://ftp.eso.org/pub/dfs/pipelines/libraries/fftw/fftw-${_fftw_ver}.tar.gz
    
      20    cpl.sh)	
    
      21md5sums=('26930526738069a72c1b607f8a3ddacd'
    
      22         '1f95e471cf89403ff877ab58a788ad69'
    
      23         '07b188f67739a621101103f92ccf52cc'
    
      24         '8ccbf6a5ea78a16dbc3e1306e234cc5c'
    
      25         'SKIP')
    
      26
    
      27build_cfitsio () {
    
      28    cd ${srcdir}/cfitsio-${_cfitsio_ver}
    
      29    ./configure --prefix=${srcdir}/build --enable-reentrant --enable-shared
    
      30    make
    
      31    make install
    
      32}
    
      33
    
      34build_wcslib () {
    
      35    cd ${srcdir}/wcslib-${_wcs_ver}
    
      36    ./configure --prefix=${srcdir}/build --without-pgplot --with-x --with-cfitsiolib=${srcdir}/lib --with-cfitsioinc=${srcdir}/include --disable-fortran
    
      37    make
    
      38    make install
    
      39}
    
      40
    
      41build_fftw () {
    
      42    cd ${srcdir}/fftw-${_fftw_ver}
    
      43     ./configure --prefix=${srcdir}/build --enable-openmp --enable-threads --enable-avx --enable-sse2 --disable-fortran --enable-shared --enable-float
    
      44    make
    
      45    make install
    
      46    make clean
    
      47     ./configure --prefix=${srcdir}/build --enable-openmp --enable-threads --enable-avx --enable-sse2 --disable-fortran --enable-shared
    
      48    make
    
      49    make install
    
      50}
    
      51
    
      52build () {
    
      53    build_cfitsio
    
      54    build_wcslib
    
      55    build_fftw
    
      56    export LD_LIBRARY_PATH=${srcdir}/build/lib:${LD_LIBRARY_PATH}
    
      57    export C_INCLUDE_PATH=${srcdir}/build/include:${C_INCLUDE_PATH}
    
      58    export CFITSIODIR=${srcdir}/build
    
      59    export WCSDIR=${srcdir}/build
    
      60    export FFTWDIR=${srcdir}/build
    
      61
    
      62    cd ${srcdir}/${pkgname}-${pkgver}
    
      63    ./configure --prefix=${pkgdir}/opt/esopipes --with-fftw=${FFTWDIR} CPPFLAGS="-DCX_DISABLE_ASSERT -DL2_CACHE_BYTES=0" --with-system-cext=no
    
      64    make 
    
      65}
    
      66
    
      67package() {
    
      68
    
      69    cd ${srcdir}/${pkgname}-${pkgver}
    
      70    make install
    
      71    install -D -m644 COPYING "${pkgdir}/share/licenses/${pkgname}/LICENSE"
    
      72    install -D -m755 ${srcdir}/cpl.sh ${pkgdir}/etc/profile.d/cpl.sh   
    
      73
    
      74    cp -a ${srcdir}/build/* ${pkgdir}/opt/esopipes/
    
      75    install -d "$pkgdir/opt/esopipes/lib/esopipes-plugins" 
    
      76}
    
      77
    
      78# vim:set ts=4 sw=4 et:
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2