dotnet-aot-xc
LOW
maintainer czirok
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt toolchain tarballs from toolchains.bootlin.com, a known and legitimate embedded Linux toolchain provider, and installs them with verified checksums; while the host is not universally whitelisted, the content is legitimate build tooling used in a standard way, posing minimal supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt toolchain tarballs from toolchains.bootlin.com, a known and legitimate embedded Linux toolchain provider, and installs them with verified checksums; while the host is not universally whitelisted, the content is legitimate build tooling used in a standard way, posing minimal supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
source=("https://toolchains.bootlin.com/downloads/releases/toolchains/x86-64/tarballs/x86-64--glibc--bleeding-edge-2025.08-1.tar.xz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Ferenc Czirok <ferenc@czirok.net>
2
# Packager: Ferenc Czirok <ferenc@czirok.net>
3
4
pkgname=dotnet-aot-xc
5
pkgver=2025.08
6
pkgrel=2
7
pkgdesc="Complete cross-compilation toolchain for .NET AOT (linux-x64, linux-arm64, linux-musl-x64, linux-musl-arm64). Run 'dotnet-aot-xc --help' for usage"
8
arch=("x86_64")
9
url="https://toolchains.bootlin.com"
10
license=(
11
'GPL-2.0-or-later'
12
'GPL-3.0-or-later'
13
'GPL-3.0-or-later WITH GCC-exception-3.1'
14
'ISC'
15
'LGPL-3.0-or-later'
16
'MIT'
17
'Python-2.0'
18
'Zlib'
19
)
20
groups=('devel')
21
22
options=('!strip' '!emptydirs')
23
24
source=("https://toolchains.bootlin.com/downloads/releases/toolchains/x86-64/tarballs/x86-64--glibc--bleeding-edge-2025.08-1.tar.xz"
25
"https://toolchains.bootlin.com/downloads/releases/toolchains/x86-64/tarballs/x86-64--musl--bleeding-edge-2025.08-1.tar.xz"
26
"https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64/tarballs/aarch64--glibc--bleeding-edge-2025.08-1.tar.xz"
27
"https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64/tarballs/aarch64--musl--bleeding-edge-2025.08-1.tar.xz"
28
"dotnet-aot-xc.sh")
29
30
sha256sums=('dc986211c6a8701868277d52e8f5061ea13d119ce0d9f23b61f1b0373984479b'
31
'830644a5f9c921fd8df2d40ab80dd81f03a662e5a7ad3cee20dbe2fde0de272e'
32
'54875d12829a792b8d4d1c9fb1f736afc60f514b0d260616f188eafafaac7cb5'
33
'e102fe06809440bbca3b6d0d8837ffdb5122b07386d1d2ac023084d898aafe7b'
34
'acd6a47a60fef238101f948ae20bc7f27f9852e8c6eadd0d88878a643e78fe23')
35
36
build() {
37
cd "$srcdir"
38
39
declare -A relocations=(
40
["aarch64--glibc--bleeding-edge-2025.08-1"]="/opt/dotnet-aot-xc/linux-arm64"
41
["aarch64--musl--bleeding-edge-2025.08-1"]="/opt/dotnet-aot-xc/linux-musl-arm64"
42
["x86-64--glibc--bleeding-edge-2025.08-1"]="/opt/dotnet-aot-xc/linux-x64"
43
["x86-64--musl--bleeding-edge-2025.08-1"]="/opt/dotnet-aot-xc/linux-musl-x64"
44
)
45
46
for dir in "${!relocations[@]}"; do
47
msg2 "Relocating $dir to ${relocations[$dir]}"
48
cd "$dir"
49
sh relocate-sdk.sh "${relocations[$dir]}"
50
cd "$srcdir"
51
done
52
}
53
54
package() {
55
cd "$srcdir"
56
57
# Create base directory
58
install -dm755 "$pkgdir/opt/dotnet-aot-xc"
59
60
# Install toolchains
61
msg2 "Installing toolchains..."
62
cp -a "aarch64--glibc--bleeding-edge-2025.08-1" "$pkgdir/opt/dotnet-aot-xc/linux-arm64"
63
cp -a "aarch64--musl--bleeding-edge-2025.08-1" "$pkgdir/opt/dotnet-aot-xc/linux-musl-arm64"
64
cp -a "x86-64--glibc--bleeding-edge-2025.08-1" "$pkgdir/opt/dotnet-aot-xc/linux-x64"
65
cp -a "x86-64--musl--bleeding-edge-2025.08-1" "$pkgdir/opt/dotnet-aot-xc/linux-musl-x64"
66
67
# Install helper script
68
install -Dm755 "$srcdir/dotnet-aot-xc.sh" "$pkgdir/opt/dotnet-aot-xc/dotnet-aot-xc.sh"
69
70
# Symlink to /usr/bin
71
install -dm755 "$pkgdir/usr/bin"
72
ln -s /opt/dotnet-aot-xc/dotnet-aot-xc.sh "$pkgdir/usr/bin/dotnet-aot-xc"
73
74
# Create GCC wrapper scripts to filter --target flag
75
msg2 "Creating GCC wrapper scripts..."
76
77
# linux-x64 wrapper (passthrough for consistency)
78
cat > "$pkgdir/opt/dotnet-aot-xc/linux-x64/bin/x86_64-linux-gcc" << 'EOF'
79
#!/bin/bash
80
exec x86_64-buildroot-linux-gnu-gcc.br_real "$@"
81
EOF
82
chmod +x "$pkgdir/opt/dotnet-aot-xc/linux-x64/bin/x86_64-linux-gcc"
83
84
# linux-arm64 wrapper
85
cat > "$pkgdir/opt/dotnet-aot-xc/linux-arm64/bin/aarch64-linux-gcc" << 'EOF'
86
#!/bin/bash
87
args=()
88
for arg in "$@"; do
89
[[ "$arg" != --target=* ]] && args+=("$arg")
90
done
91
exec aarch64-buildroot-linux-gnu-gcc.br_real "${args[@]}"
92
EOF
93
chmod +x "$pkgdir/opt/dotnet-aot-xc/linux-arm64/bin/aarch64-linux-gcc"
94
95
# linux-musl-arm64 wrapper
96
cat > "$pkgdir/opt/dotnet-aot-xc/linux-musl-arm64/bin/aarch64-linux-musl-gcc" << 'EOF'
97
#!/bin/bash
98
args=()
99
for arg in "$@"; do
100
[[ "$arg" != --target=* ]] && args+=("$arg")
101
done
102
exec aarch64-buildroot-linux-musl-gcc.br_real "${args[@]}"
103
EOF
104
chmod +x "$pkgdir/opt/dotnet-aot-xc/linux-musl-arm64/bin/aarch64-linux-musl-gcc"
105
106
# linux-musl-x64 wrapper
107
cat > "$pkgdir/opt/dotnet-aot-xc/linux-musl-x64/bin/x86_64-linux-musl-gcc" << 'EOF'
108
#!/bin/bash
109
args=()
110
for arg in "$@"; do
111
[[ "$arg" != --target=* ]] && args+=("$arg")
112
done
113
exec x86_64-buildroot-linux-musl-gcc.br_real "${args[@]}"
114
EOF
115
chmod +x "$pkgdir/opt/dotnet-aot-xc/linux-musl-x64/bin/x86_64-linux-musl-gcc"
116
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |