firrtl

maintainer mirconeuschafer · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate project source on GitHub, uses system-provided antlr4 and protoc versions during build, and installs a JAR and a launcher script; the orphaned/re-adopted status is a metadata concern, not a security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project source on GitHub, uses system-provided antlr4 and protoc versions during build, and installs a JAR and a launcher script; the orphaned/re-adopted status is a metadata concern, not a security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Felix Yan <felixonmars@archlinux.org>
    
      2# Contributor: Sebastian Bøe <sebastianbooe at gmail dot com>
    
      3
    
      4pkgname=firrtl
    
      5pkgver=1.5.3
    
      6pkgrel=2
    
      7pkgdesc='Flexible Intermediate Representation for RTL'
    
      8arch=('any')
    
      9url='https://github.com/freechipsproject/firrtl'
    
      10license=('Apache')
    
      11provides=('firrtl')
    
      12conflicts=('firrtl')
    
      13depends=('java-environment' 'bash')
    
      14makedepends=('antlr4' 'protobuf' 'mill' 'git')
    
      15source=("$pkgname-$pkgver.tar.gz::https://github.com/freechipsproject/firrtl/archive/v$pkgver.tar.gz"
    
      16        'firrtl.sh')
    
      17sha512sums=('12277eb2d43819fb5fde428a917e15c2da585162b02fc7d9f9ab6797aee32758328da246c5959b129111b906631a53be20d66c0e659457091bc1aa7011c7a4e8'
    
      18            '2e3ca5c5771bbbf4cfa1245e5bc6e1b65cc17f521ee62ca79e044d24be3c403f85ad8134734eed66132190c1d02e1295de4a0c7a46fd057d8040f1c8cb1865a2')
    
      19
    
      20prepare() {
    
      21  cd firrtl-$pkgver
    
      22  # Force using system antlr4 and protoc
    
      23  _antlr4_version=$(antlr4 | head -n1 | grep -oP "(?<=Version ).+")
    
      24  _protoc_version=$(protoc --version | grep -oP "(?<=libprotoc ).+")
    
      25  sed -e "s/def antlr4Version = \"4.9.3\"/def antlr4Version = \"$_antlr4_version\"/" \
    
      26      -e "s/def protocVersion = \"3.15.6\"/def protocVersion = \"$_protoc_version\"/" \
    
      27      -i build.sc
    
      28}
    
      29
    
      30build(){
    
      31  cd firrtl-$pkgver
    
      32  mill -i firrtl[2.13.7].assembly
    
      33}
    
      34
    
      35package() {
    
      36  install -Dm755 firrtl.sh "$pkgdir"/usr/bin/firrtl
    
      37
    
      38  cd firrtl-$pkgver
    
      39  install -Dm755 out/firrtl/2.13.7/assembly.dest/out.jar "$pkgdir"/usr/share/scala/$pkgname/firrtl.jar
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 19:16:23	MEDIUM	1
2026-07-30 17:15:21	MEDIUM	1
2026-06-19 22:34:54	CLEAN	0