epiphany-elf-gcc

maintainer mkaczanowski · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds GCC from official GNU and Sourceware sources, which are legitimate project hosts despite not being on the whitelist; the source tarballs are verified with sha256sums and used to compile a cross-compiler, posing no remote code execution or supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds GCC from official GNU and Sourceware sources, which are legitimate project hosts despite not being on the whitelist; the source tarballs are verified with sha256sums and used to compile a cross-compiler, posing no remote code execution or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 ftp://sourceware.org/pub/newlib/newlib-$_newlibver.tar.gz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mateusz Kaczanowski <kaczanowski.mateusz@gmail.com>
    
      2# Adapted from arm-none-eabi- by Anatol Pomozov
    
      3
    
      4_target=epiphany-elf
    
      5pkgname=$_target-gcc
    
      6pkgver=9.2
    
      7pkgrel=1
    
      8_snapshot=9-20200111
    
      9_newlibver=3.1.0
    
      10pkgdesc='The GNU Compiler Collection - cross compiler for the Adapteva Epiphany target'
    
      11arch=(i686 x86_64 armv7h)
    
      12url='http://gcc.gnu.org/'
    
      13license=(GPL LGPL FDL)
    
      14depends=($_target-binutils libmpc)
    
      15makedepends=(gmp mpfr)
    
      16#checkdepends=(dejagnu)
    
      17options=(!emptydirs !strip staticlibs)
    
      18source=(#ftp://gcc.gnu.org/pub/gcc/releases/gcc-$pkgver/gcc-$pkgver.tar.bz2
    
      19        ftp://gcc.gnu.org/pub/gcc/snapshots/$_snapshot/gcc-$_snapshot.tar.xz
    
      20        ftp://sourceware.org/pub/newlib/newlib-$_newlibver.tar.gz)
    
      21sha256sums=('f3963e5f92b5f79cd8316dd8c6c334e3992bbda0ee545914bd7305c3137a29f5'
    
      22            'fb4fa1cc21e9060719208300a61420e4089d6de6ef59cf533b57fe74801d102a')
    
      23
    
      24if [ -n "$_snapshot" ]; then
    
      25  _basedir=gcc-$_snapshot
    
      26else
    
      27  _basedir=gcc-$pkgver
    
      28fi
    
      29
    
      30prepare() {
    
      31  cd "$srcdir/$_basedir"
    
      32  echo $pkgver > gcc/BASE-VER
    
      33
    
      34  # Move newlib and libgloss to gcc source directory
    
      35  mv "$srcdir"/newlib-$_newlibver/newlib "$srcdir/$_basedir"
    
      36  mv "$srcdir"/newlib-$_newlibver/libgloss "$srcdir/$_basedir"
    
      37
    
      38  # hack! - some configure tests for header files using "$CPP $CPPFLAGS"
    
      39  sed -i "/ac_cpp=/s/\$CPPFLAGS/\$CPPFLAGS -O2/" "$srcdir"/$_basedir/{libiberty,gcc}/configure
    
      40}
    
      41
    
      42build() {
    
      43  cd $_basedir
    
      44  mkdir -p build
    
      45  cd build
    
      46
    
      47  export CFLAGS_FOR_TARGET='-O2 -g -pipe'
    
      48  export CXXFLAGS_FOR_TARGET='-O2 -g -pipe'
    
      49
    
      50  # disable-libcc1 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66955
    
      51  ../configure --target=$_target \
    
      52               --prefix=/usr \
    
      53               --libexecdir=/usr/lib \
    
      54               --with-pkgversion='Arch Repository' \
    
      55               --with-bugurl='https://bugs.archlinux.org/' \
    
      56               --enable-multilib \
    
      57               --enable-interwork \
    
      58               --enable-languages=c,c++ \
    
      59               --with-newlib \
    
      60               --with-gnu-as \
    
      61               --with-gnu-ld \
    
      62               --disable-nls \
    
      63               --disable-libcc1 \
    
      64               --with-headers=newlib/libc/include \
    
      65               --disable-werror
    
      66
    
      67  make
    
      68}
    
      69
    
      70check() {
    
      71  cd $_basedir/build
    
      72}
    
      73
    
      74package() {
    
      75  cd $_basedir/build
    
      76
    
      77  make DESTDIR="$pkgdir" install -j1
    
      78
    
      79  # Strip host objects but do not touch target one (strip corrupts access.o in libepiphany.a)
    
      80  find "$pkgdir/usr/lib" -executable -type f -exec /usr/bin/strip --strip-debug '{}' \;
    
      81  find "$pkgdir/usr/bin" -executable -type f -exec /usr/bin/strip --strip-debug '{}' \;
    
      82
    
      83  # Remove files that conflict with host gcc package
    
      84  rm -r "$pkgdir"/usr/share/man/man7
    
      85  rm -r "$pkgdir"/usr/share/info
    
      86  rm -r "$pkgdir"/usr/share/gcc-$pkgver
    
      87}
    
      88

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2