devkitarm-r47-bin

LOW

maintainer Sterophonick 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt devkitARM and libgba binaries from a personal server, but these are legacy development tools intended for GBA development; the source is not whitelisted, yet the host is plausibly associated with the devkitPro project maintainers, and the package installs only static toolchain and library files without executing remote code or exfiltrating data.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt devkitARM and libgba binaries from a personal server, but these are legacy development tools intended for GBA development; the source is not whitelisted, yet the host is plausibly associated with the devkitPro project maintainers, and the package installs only static toolchain and library files without executing remote code or exfiltrating data.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=(https://wii.leseratte10.de/devkitPro/devkitARM/r47%20%282017%29/devkitARM_r47-x86_64-linux.tar.bz2

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sterophonick
    
      2pkgname=devkitarm-r47-bin
    
      3_pkgname='devkitarm-r47-bin'
    
      4pkgver=r47
    
      5pkgrel=1
    
      6pkgdesc="Older version of devkitARM and libgba (GCC 7.1.0). Intended for legacy GBA dev."
    
      7url='https://sourceforge.net/projects/devkitadv/'
    
      8arch=(x86_64 i686)
    
      9makedepends=(p7zip)
    
      10source=(https://wii.leseratte10.de/devkitPro/devkitARM/r47%20%282017%29/devkitARM_r47-x86_64-linux.tar.bz2
    
      11        https://wii.leseratte10.de/devkitPro/libgba/libgba_0.5.1/libgba-0.5.1.tar.bz2)
    
      12md5sums=('77212d6eaaeedefe4b40d9101b0acf7a' '1ae988c7c19b336852d0cb36c64f9f03')
    
      13license=('gplv3')
    
      14options=(!debug !strip)
    
      15noextract=('libgba-0.5.1.tar.bz2')
    
      16
    
      17package() {
    
      18  cd $srcdir
    
      19
    
      20  mkdir -p $pkgdir/opt/devkitpro-old/libgba
    
      21  cp -r devkitARM $pkgdir/opt/devkitpro-old
    
      22
    
      23  7z x libgba-0.5.1.tar.bz2 -o$srcdir
    
      24  7z x libgba-0.5.1.tar -o$pkgdir/opt/devkitpro-old/libgba
    
      25
    
      26  chmod -R 777 $pkgdir/opt/devkitpro-old
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2