gauche-c-wrapper

maintainer fabi · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads the source tarball from the project's own domain (koguro.net), which is the official upstream for this software; building from the project's own source is normal AUR practice, and the host, while not on a standard whitelist, is plausibly legitimate and not a swappable file host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the source tarball from the project's own domain (koguro.net), which is the official upstream for this software; building from the project's own source is normal AUR practice, and the host, while not on a standard whitelist, is plausibly legitimate and not a swappable file host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=('http://www.koguro.net/prog/c-wrapper/c-wrapper-0.6.1.tgz'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Fabian Brosda <fabi3141@gmx.de>
    
      2#
    
      3# The patches 1 to 10 and 17 are from the corresponding debian package
    
      4
    
      5pkgname=gauche-c-wrapper
    
      6_pkgname=${pkgname#gauche-}
    
      7pkgver=0.6.1
    
      8pkgrel=6
    
      9pkgdesc='Gauche foreign function interface for C and Objective-C libraries.'
    
      10url='http://www.koguro.net/prog/c-wrapper/'
    
      11arch=('x86_64')
    
      12depends=('gauche')
    
      13makedepends=('make' 'autoconf')
    
      14license=('MIT')
    
      15
    
      16# include any patches you want to have applied here
    
      17source=('http://www.koguro.net/prog/c-wrapper/c-wrapper-0.6.1.tgz'
    
      18	'01_use_installed_libffi.patch'
    
      19	'02_multilib.patch'
    
      20	'04_build_with_gcc5.patch'
    
      21	'05_cflags.patch'
    
      22	'06___glibc_macro_warning.patch'
    
      23	'08-gen-gpd-fix.patch'
    
      24	'09-cpp-c-ldflags.patch'
    
      25	'10-fix-closure-alloc.patch'
    
      26	'11_fix_jp_encoding.patch'
    
      27	'12_float128.patch'
    
      28	'13_local_typedef.patch'
    
      29	'14_extend_parser.patch'
    
      30	'15_fix_scm_reg_exec.patch'
    
      31	'16_gauche_0_9_11_compat.patch'
    
      32    '17_gauche_0_9_13_compat.patch'
    
      33    '18_lexer.patch')
    
      34sha1sums=('3b52496fa8151a409538d361e08b05ad9de16ac2'
    
      35          '99878b6fc5c306223e7119861b5af92362f90fd9'
    
      36          '11f45d119f2fc660ac32de724b01d47aaaf84675'
    
      37          '4a415ff35ad34ac84e4fadfd3f1b0aa5a11e4bba'
    
      38          '58a7d6a2b4591bb0a5b0481a79b63f5db4ca550d'
    
      39          '354a51fb8f578453c89d86c0ad9382dfe020b350'
    
      40          'faae81fcb833f5571ba151f319ed6d948d679935'
    
      41          'fc6aff7e1d30b177565654702b7eff67b953745d'
    
      42          'ec1582da5e299adc76fa21d0397e7ad1d323ee50'
    
      43          '341697ca27ee06fa80357f80807b11b5593cf6c3'
    
      44          '835d8befbfa7346f49fba39e2dfb74cb63a01af9'
    
      45          '46f2ae372276c51b534db5592398ef69a9264ca0'
    
      46          'c888b1aebf37adf20cc7874c31b1c8a2ba0dcd45'
    
      47          '8239972e42afb42a1040f7274c55620901458ca8'
    
      48          '113fc320f21d0648421b8e006bd63233dfa61619'
    
      49          '31acaa89ee0ecffc67ae420a40f4e5e2c6eb483c'
    
      50          'c8d0df0043ca437921506172245ee2f8937e6a14')
    
      51
    
      52prepare() {
    
      53    cd "${_pkgname}-${pkgver}"
    
      54
    
      55    for filename in "${source[@]}";
    
      56    do
    
      57	if [[ "$filename" =~ \.patch$ ]]; then
    
      58	    patch -p1 -N -i "$srcdir/${filename##*/}"
    
      59	fi
    
      60    done
    
      61}
    
      62
    
      63build() {
    
      64    export CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
    
      65    export CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
    
      66    cd "${_pkgname}-${pkgver}"
    
      67    ./configure --prefix=/usr
    
      68    make
    
      69
    
      70    # Extract license from README
    
      71    sed -n '/License/,/ license./p' README > LICENSE
    
      72}
    
      73
    
      74check() {
    
      75    cd "${_pkgname}-${pkgver}"
    
      76    make check
    
      77}
    
      78
    
      79package() {
    
      80    cd "${_pkgname}-${pkgver}"
    
      81
    
      82    make DESTDIR="$pkgdir" install
    
      83
    
      84    install -d "$pkgdir"/usr/share/licenses/$pkgname/
    
      85    install -m 444 -t "$pkgdir"/usr/share/licenses/$pkgname/ ${srcdir}/"${_pkgname}-${pkgver}"/LICENSE
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2