epiphany-elf-gcc
LOW
maintainer mkaczanowski
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package builds GCC from official GNU and Sourceware sources, which are legitimate project hosts despite not being on the whitelist; the source tarballs are verified with sha256sums and used to compile a cross-compiler, posing no remote code execution or supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds GCC from official GNU and Sourceware sources, which are legitimate project hosts despite not being on the whitelist; the source tarballs are verified with sha256sums and used to compile a cross-compiler, posing no remote code execution or supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:20
ftp://sourceware.org/pub/newlib/newlib-$_newlibver.tar.gz)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Mateusz Kaczanowski <kaczanowski.mateusz@gmail.com>
2
# Adapted from arm-none-eabi- by Anatol Pomozov
3
4
_target=epiphany-elf
5
pkgname=$_target-gcc
6
pkgver=9.2
7
pkgrel=1
8
_snapshot=9-20200111
9
_newlibver=3.1.0
10
pkgdesc='The GNU Compiler Collection - cross compiler for the Adapteva Epiphany target'
11
arch=(i686 x86_64 armv7h)
12
url='http://gcc.gnu.org/'
13
license=(GPL LGPL FDL)
14
depends=($_target-binutils libmpc)
15
makedepends=(gmp mpfr)
16
#checkdepends=(dejagnu)
17
options=(!emptydirs !strip staticlibs)
18
source=(#ftp://gcc.gnu.org/pub/gcc/releases/gcc-$pkgver/gcc-$pkgver.tar.bz2
19
ftp://gcc.gnu.org/pub/gcc/snapshots/$_snapshot/gcc-$_snapshot.tar.xz
20
ftp://sourceware.org/pub/newlib/newlib-$_newlibver.tar.gz)
21
sha256sums=('f3963e5f92b5f79cd8316dd8c6c334e3992bbda0ee545914bd7305c3137a29f5'
22
'fb4fa1cc21e9060719208300a61420e4089d6de6ef59cf533b57fe74801d102a')
23
24
if [ -n "$_snapshot" ]; then
25
_basedir=gcc-$_snapshot
26
else
27
_basedir=gcc-$pkgver
28
fi
29
30
prepare() {
31
cd "$srcdir/$_basedir"
32
echo $pkgver > gcc/BASE-VER
33
34
# Move newlib and libgloss to gcc source directory
35
mv "$srcdir"/newlib-$_newlibver/newlib "$srcdir/$_basedir"
36
mv "$srcdir"/newlib-$_newlibver/libgloss "$srcdir/$_basedir"
37
38
# hack! - some configure tests for header files using "$CPP $CPPFLAGS"
39
sed -i "/ac_cpp=/s/\$CPPFLAGS/\$CPPFLAGS -O2/" "$srcdir"/$_basedir/{libiberty,gcc}/configure
40
}
41
42
build() {
43
cd $_basedir
44
mkdir -p build
45
cd build
46
47
export CFLAGS_FOR_TARGET='-O2 -g -pipe'
48
export CXXFLAGS_FOR_TARGET='-O2 -g -pipe'
49
50
# disable-libcc1 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66955
51
../configure --target=$_target \
52
--prefix=/usr \
53
--libexecdir=/usr/lib \
54
--with-pkgversion='Arch Repository' \
55
--with-bugurl='https://bugs.archlinux.org/' \
56
--enable-multilib \
57
--enable-interwork \
58
--enable-languages=c,c++ \
59
--with-newlib \
60
--with-gnu-as \
61
--with-gnu-ld \
62
--disable-nls \
63
--disable-libcc1 \
64
--with-headers=newlib/libc/include \
65
--disable-werror
66
67
make
68
}
69
70
check() {
71
cd $_basedir/build
72
}
73
74
package() {
75
cd $_basedir/build
76
77
make DESTDIR="$pkgdir" install -j1
78
79
# Strip host objects but do not touch target one (strip corrupts access.o in libepiphany.a)
80
find "$pkgdir/usr/lib" -executable -type f -exec /usr/bin/strip --strip-debug '{}' \;
81
find "$pkgdir/usr/bin" -executable -type f -exec /usr/bin/strip --strip-debug '{}' \;
82
83
# Remove files that conflict with host gcc package
84
rm -r "$pkgdir"/usr/share/man/man7
85
rm -r "$pkgdir"/usr/share/info
86
rm -r "$pkgdir"/usr/share/gcc-$pkgver
87
}
88
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |