gcc45

maintainer severach · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds GCC and related components from source tarballs hosted on official or plausible project infrastructure; the non-whitelisted hosts are standard mirrors for GCC, ISL, and CLooG, and the sources are checksum-verified, posing no supply-chain risk beyond typical AUR packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds GCC and related components from source tarballs hosted on official or plausible project infrastructure; the non-whitelisted hosts are standard mirrors for GCC, ISL, and CLooG, and the sources are checksum-verified, posing no supply-chain risk beyond typical AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "http://www.mirrorservice.org/sites/sourceware.org/pub/gcc/releases/gcc-${pkgver}/gcc-${pkgver}.tar.bz2"
PKGBUILD:24 "http://isl.gforge.inria.fr/isl-${_islver}.tar.bz2"
PKGBUILD:25 "http://www.bastoul.net/cloog/pages/download/cloog-${_cloogver}.tar.gz"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer:  Chris Severance aur.severach aATt spamgourmet dott com
    
      2# Contributor: Christian Babeux <christian.babeux@0x80.ca>
    
      3# Contributor: Tianjiao Yin <ytj000(at)gmail(dot)(see)(oh)(em)>
    
      4# Contributor: Allan McRae <allan@archlinux.org>
    
      5
    
      6set -u
    
      7_pkgver='4.5'
    
      8pkgname="gcc${_pkgver//\./}"
    
      9pkgver="${_pkgver}.4"
    
      10_islver='0.12.2'
    
      11_cloogver='0.18.1'
    
      12pkgrel='3'
    
      13pkgdesc="The GNU Compiler Collection (${_pkgver}.x)"
    
      14arch=('i686' 'x86_64')
    
      15url='http://gcc.gnu.org'
    
      16license=('GPL-2.0-only' 'LGPL-2.1-only' 'GPL-3.0-only' 'LGPL-3.0-only' 'custom')
    
      17depends=('glibc' 'gcc-libs' 'bash' 'binutils' 'gmp' 'mpfr' 'libmpc' 'ppl' 'python' 'libelf' 'zlib') #'isl' 'cloog' 
    
      18makedepends=('flex' 'bison' 'setconf' 'elfutils')
    
      19#makedepends+=('gcc49')
    
      20conflicts=("gcc${_pkgver//\./}-multilib")
    
      21options=('staticlibs' '!libtool' '!buildflags')
    
      22source=(
    
      23  "http://www.mirrorservice.org/sites/sourceware.org/pub/gcc/releases/gcc-${pkgver}/gcc-${pkgver}.tar.bz2"
    
      24  "http://isl.gforge.inria.fr/isl-${_islver}.tar.bz2"
    
      25  "http://www.bastoul.net/cloog/pages/download/cloog-${_cloogver}.tar.gz"
    
      26  'gcc-hash-style-both.patch'
    
      27  'gcc_pure64.patch'
    
      28)
    
      29source[1]="https://gcc.gnu.org/pub/gcc/infrastructure/${source[1]##*/}"
    
      30md5sums=('27e459c2566b8209ab064570e1b378f7'
    
      31         'e039bfcfb6c2ab039b8ee69bf883e824'
    
      32         'e34fca0540d840e5d0f6427e98c92252'
    
      33         '6fd395bacbd7b6e47c7b74854b478363'
    
      34         '4030ee1c08dd1e843c0225b772360e76')
    
      35sha256sums=('eef3f0456db8c3d992cbb51d5d32558190bc14f3bc19383dd93acc27acc6befc'
    
      36            'f4b3dbee9712850006e44f0db2103441ab3d13b406f77996d1df19ee89d11fb4'
    
      37            '02500a4edd14875f94fe84cbeda4290425cb0c1c2474c6f75d75a303d64b4196'
    
      38            'a600550d3d2b2fb8ee6a547c68c3a08a2af7579290b340c35ee5598c9bb305a5'
    
      39            '2d369cf93c6e15c3559c3560bce581e0ae5f1f34dc86bca013ac67ef1c1a9ff9')
    
      40
    
      41if [ -n "${_snapshot:-}" ]; then
    
      42  _basedir="gcc-${_snapshot}"
    
      43else
    
      44  _basedir="gcc-${pkgver}"
    
      45fi
    
      46
    
      47#_libdir="usr/lib/gcc/${CHOST}/${pkgver}"
    
      48
    
      49prepare() {
    
      50  set -u
    
      51  cd "${_basedir}"
    
      52
    
      53  # link isl/cloog for in-tree builds
    
      54  ln -s "../isl-${_islver}" 'isl'
    
      55  ln -s "../cloog-${_cloogver}" 'cloog'
    
      56
    
      57  # Do not install libiberty
    
      58  sed -e 's/install_to_$(INSTALL_DEST) //' -i 'libiberty/Makefile.in'
    
      59
    
      60  # Do not run fixincludes
    
      61  sed -e 's@\./fixinc\.sh@-c true@' -i 'gcc/Makefile.in'
    
      62
    
      63  patch -Np0 -i "${srcdir}/gcc-hash-style-both.patch"
    
      64
    
      65  # fix build with glibc 2.26
    
      66  sed -e 's:\bstruct ucontext\b:ucontext_t:g' -i $(grep --include '*.[ch]' --include '*.cc' -lre '\bstruct ucontext\b')
    
      67  sed -e 's:\bstruct sigaltstack\b:stack_t:g' -i $(grep --include '*.[ch]' --include '*.cc' -lre '\bstruct sigaltstack\b')
    
      68
    
      69  case "${CARCH}" in
    
      70  'x86_64') patch -Np1 -i '../gcc_pure64.patch';;
    
      71  esac
    
      72
    
      73  echo "${pkgver}" > 'gcc/BASE-VER'
    
      74
    
      75  setconf 'gcc/configure' 'BUILD_INFO' ''
    
      76
    
      77  rm -rf 'gcc-build'
    
      78  mkdir 'gcc-build'
    
      79
    
      80  set +u
    
      81}
    
      82
    
      83build() {
    
      84  set -u
    
      85  if [ ! -s "${_basedir}/gcc-build/Makefile" ]; then
    
      86    cd "${_basedir}"
    
      87
    
      88    cd 'gcc-build'
    
      89    # The following options are one per line, mostly sorted so they are easy to diff compare to other gcc packages.
    
      90    local _conf=(
    
      91      --build="${CHOST}"
    
      92      --disable-libgomp
    
      93      --disable-libmudflap
    
      94      --disable-libssp
    
      95      --disable-libstdcxx-pch
    
      96      --disable-multilib
    
      97      --enable-__cxa_atexit
    
      98      --enable-clocale='gnu'
    
      99      --enable-cloog-backend='isl'
    
      100      --enable-languages='c,c++,fortran,objc,obj-c++'
    
      101      --enable-shared
    
      102      --enable-version-specific-runtime-libs
    
      103      --infodir='/usr/share/info'
    
      104      --libdir='/usr/lib'
    
      105      --libexecdir='/usr/lib'
    
      106      --mandir='/usr/share/man'
    
      107      --program-suffix="-${_pkgver}"
    
      108      --with-cloog
    
      109      --with-ppl
    
      110      --with-system-zlib
    
      111      --with-tune='generic'
    
      112      --prefix='/usr'
    
      113      #CXX='g++-4.9' CC='gcc-4.9'
    
      114      CXX='g++ -Wno-implicit-function-declaration -Wno-incompatible-pointer-types'
    
      115      CC='gcc -Wno-implicit-function-declaration -Wno-incompatible-pointer-types'
    
      116    )
    
      117    ../configure "${_conf[@]}"
    
      118
    
      119    sed -e 's/^STAGE1_CXXFLAGS.*$/& -std=gnu++11/' -i 'Makefile'
    
      120  fi
    
      121
    
      122  cd "${srcdir}/${_basedir}/gcc-build"
    
      123  #LD_PRELOAD='/usr/lib/libstdc++.so' \\
    
      124  nice make -s
    
      125  set +u
    
      126}
    
      127
    
      128package() {
    
      129  set -u
    
      130  cd "${_basedir}/gcc-build"
    
      131
    
      132  #LD_PRELOAD='/usr/lib/libstdc++.so' \\
    
      133  make -j1 DESTDIR="${pkgdir}" install
    
      134
    
      135  ## Lazy way of dealing with conflicting man and info pages and locales...
    
      136  rm -rf "${pkgdir}/usr/share/man/man7"
    
      137  rm -rf "${pkgdir}/usr/share/locale"
    
      138  rmdir "${pkgdir}/usr/include" "${pkgdir}/usr/share/info"
    
      139
    
      140  mv "${pkgdir}/usr/lib/gcc/${CHOST}"/lib* "${pkgdir}/usr/lib/gcc/${CHOST}/${pkgver}/"
    
      141
    
      142  # Create links for gcc build environment (useful for CUDA)
    
      143  mkdir -p "${pkgdir}/opt/gcc-${_pkgver}"
    
      144  ln -s "/usr/bin/gcc-${_pkgver}" "${pkgdir}/opt/gcc-${_pkgver}/gcc"
    
      145  ln -s "/usr/bin/g++-${_pkgver}" "${pkgdir}/opt/gcc-${_pkgver}/g++"
    
      146
    
      147  # Install Runtime Library Exception
    
      148  install -Dpm644 '../COPYING.RUNTIME' \
    
      149    "${pkgdir}/usr/share/licenses/${pkgname}/RUNTIME.LIBRARY.EXCEPTION" || :
    
      150  set +u
    
      151}
    
      152set +u
    
      153

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2