folding

maintainer gamezelda · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a legitimate project tarball from the BSC's official tools subdomain, building the project's own code; the non-whitelisted host is plausibly project-owned, and no untrusted executable is run.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a legitimate project tarball from the BSC's official tools subdomain, building the project's own code; the non-whitelisted host is plausibly project-owned, and no untrusted executable is run.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://ftp.tools.bsc.es/$pkgname/$pkgname-${pkgver%.*}-src.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Joan Bruguera Micó <joanbrugueram@gmail.com>
    
      2pkgname='folding'
    
      3pkgdesc='Combined instrumentation and sampling for instantaneous metric evolution with low overhead (from BSC).'
    
      4pkgver='1.4.2.20250211'
    
      5pkgrel='2'
    
      6arch=('x86_64')
    
      7url='https://www.bsc.es/discover-bsc/organisation/scientific-structure/performance-tools'
    
      8license=('LGPL-2.1-or-later')
    
      9depends=(boost qt5-base libbsctools r clang python)
    
      10makedepends=(gcc-fortran)
    
      11source=("https://ftp.tools.bsc.es/$pkgname/$pkgname-${pkgver%.*}-src.tar.bz2"
    
      12        python3-ports.patch)
    
      13sha512sums=(6cfcf562cc056d7135c42313640ff63432096c725dab34f79ea6e13a929ab60b6b1cf2075248a8b49c9218d59709d314155ada179221d136c13a1f1df7c8cd17
    
      14            f62af324cfe585605dbdfdb87fa7877cb794ba854c1445193710f22ce3cb92effcfcb7c6b8e32286f927bd0804478580b6358b62f15cba789359862bc0589aa1)
    
      15
    
      16prepare() {
    
      17	cd "$srcdir/$pkgname-${pkgver%.*}"
    
      18
    
      19	# WORKAROUND: The configure/make scripts check if a static version (.a) of the libbsctools libraries
    
      20	#             are installed, and fails to detect libbsctools if they aren't.
    
      21	#             Since we're going to link against the dynamic version (.so) as is typical in Arch,
    
      22	#             hack it up to check for the dynamic version consistently instead
    
      23	sed -i 's/\.a/.so/g' config/libbsctools.m4
    
      24
    
      25	autoreconf -i -f -I config
    
      26
    
      27	# WORKAROUND: Fix some scripts that still only work with Python 2
    
      28	patch -Np1 -i "$srcdir/python3-ports.patch"
    
      29}
    
      30
    
      31build() {
    
      32	cd "$srcdir/$pkgname-${pkgver%.*}"
    
      33
    
      34	# NOTE: The following optional features are NOT enabled:
    
      35	# * LaTeX documentation
    
      36	./configure \
    
      37		--prefix=/usr \
    
      38		--with-libbsctools=/usr
    
      39
    
      40	make
    
      41}
    
      42
    
      43package() {
    
      44	cd "$srcdir/$pkgname-${pkgver%.*}"
    
      45
    
      46	make prefix="$pkgdir/usr/" install
    
      47
    
      48	# FIXME: Why are those libraries from libbsctools copied to the package directory when installing?
    
      49	rm "${pkgdir}/usr/lib/libparavertraceconfig.so"
    
      50	rm "${pkgdir}/usr/lib/libparavertraceparser.so"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2