◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

gcc6-fortran

maintainer valandil · 20 votes · base gcc6 · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The source is a legitimate infrastructure dependency (cloog) for GCC from a project-maintainer-controlled domain, used in building the compiler; the host is not whitelisted but is plausibly official, and no remote code execution or malicious behavior is present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a legitimate infrastructure dependency (cloog) for GCC from a project-maintainer-controlled domain, used in building the compiler; the host is not whitelisted but is plausibly official, and no remote code execution or malicious behavior is present.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:44 "http://www.bastoul.net/cloog/pages/download/cloog-${_cloogver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Joey Dumont <joey.dumont@gmail.com>
2# Contributor: Viktor Drobot (aka dviktor) linux776 [at] gmail [dot] com
3# Contributor: Sebastiaan Lokhorst <sebastiaanlokhorst@gmail.com>
4# Contributor: frankspace
5# Contributor: Renan Manola <rmanola@gmail.com>
6# Contributor: Stefan Husmann <stefan-husmann@t-online.de>
7# Contributor: Joey Dumont <joey.dumont@gmail.com>
8# Contributor: Sven-Hendrik Haase <sh@lutzhaase.com>
9# Contributor: Allan McRae <allan@archlinux.org>
10
11pkgbase=gcc6
12pkgname=('gcc6' 'gcc6-libs' 'gcc6-fortran' 'gcc6-gcj')
13pkgver=6.5.0
14_ver=${pkgver%%.*}
15_islver=0.18
16_cloogver=0.18.4
17pkgrel=10
18pkgdesc="The GNU Compiler Collection (6.x.x)"
19arch=(x86_64)
20license=(
21 GPL
22 LGPL
23 FDL
24 custom
25)
26url="https://gcc.gnu.org/gcc-6/"
27makedepends=(
28 binutils
29 libmpc
30 doxygen
31 subversion
32 java-environment-common
33 zip
34 jdk8-openjdk
35 gtk2
36 libart-lgpl
37 libxtst
38 zlib
39 java-runtime)
40options=(!buildflags)
41source=(
42 "https://gcc.gnu.org/pub/gcc/releases/gcc-${pkgver}/gcc-${pkgver}.tar.xz"
43 "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${_islver}.tar.bz2"
44 "http://www.bastoul.net/cloog/pages/download/cloog-${_cloogver}.tar.gz"
45 libsanitizer.patch
46 remove-termio.patch
47 c89
48 c99
49)
50sha512sums=(
51 'ce046f9a50050fd54b870aab764f7db187fe7ea92eb4aaffb7c3689ca623755604e231f2af97ef795f41c406bb80c797dd69957cfdd51dfa2ba60813f72b7eac'
52 '85d0b40f4dbf14cb99d17aa07048cdcab2dc3eb527d2fbb1e84c41b2de5f351025370e57448b63b2b8a8cf8a0843a089c3263f9baee1542d5c2e1cb37ed39d94'
53 'd35d67b08ffe13c1a010b65bfe4dd02b0ae013d5b489e330dc950bd3514defca8f734bd37781856dcedf0491ff6122c34eecb4b0fe32a22d7e6bdadea98c8c23'
54 'e7861f77d54ac9bc12cfc6d3498a9bc284e72f728435c23866ac0763fb93e94e431d819c3def9f5aa03acbafc437141882e7b3746f4574ec6e5eb66b555cebb6'
55 'c1415ef208cf924fa72cf4cb5ab192e46d21ef608c8de89c76c25c42014967170e6915c8a6bb1a31cab20535fb146bfe413c2485b854132b7f723332257154c8'
56 'a02da589b23e4a76b5ca3b3e4e2261ef4cf69dadd9460703f14e34090d4e574025a52acef9f54e897679115e2122b0095d9d7eab556024bb0e9c695915951a58'
57 'd17176547a1ed2b7aa4743eb66a06308db182a993985a1905b418dfa46b74723631b17fd0d536adfefbdf4900d3b71cdf1e7d663ad379fa11b58b613dccb931c'
58)
59
60_libdir="/usr/lib/gcc/$CHOST/$pkgver"
61
62prepare() {
63 [[ ! -d gcc ]] && ln -s gcc-${pkgver/+/-} gcc
64
65 cd gcc
66 # Apply patches.
67 patch --forward --strip=2 --input="${srcdir}"/libsanitizer.patch
68 patch --forward --strip=2 --input="${srcdir}"/remove-termio.patch
69
70 # Link isl/cloog for in-tree builds
71 ln -sf "../isl-${_islver}" isl
72 ln -sf "../cloog-${_cloogver}" cloog
73
74 # Do not run fixincludes
75 sed -i 's@\./fixinc\.sh@-c true@' gcc/Makefile.in
76
77 # Arch Linux installs x86_64 libraries /lib
78 sed -i '/m64=/s/lib64/lib/' gcc/config/i386/t-linux64
79
80 # hack! - some configure tests for header files using "$CPP $CPPFLAGS"
81 sed -i "/ac_cpp=/s/\$CPPFLAGS/\$CPPFLAGS -O2/" {libiberty,gcc}/configure
82
83 # Arch uses python version 3 as default python (for gcc6-gcj).
84 sed -i '1s+python+python2+' libjava/contrib/aot-compile.in
85
86 mkdir -p "${srcdir}"/gcc-build
87}
88
89build() {
90 cd gcc-build
91
92 # using -pipe causes spurious test-suite failures
93 # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48565
94 export CFLAGS="${CFLAGS/-pipe/} -Wno-error=format-security -Wformat-security"
95 export CXXFLAGS="${CXXFLAGS/-pipe/} -Wno-error=format-security -Wformat-security"
96
97 # Newer gcc versions don't support the same flags as the oldest versions, and it seems
98 # that xgcc picks up CFLAGS if CFLAGS_FOR_TARGET aren't set (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=25672).
99 export CFLAGS_FOR_TARGET="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions -fstack-protector -Wp,-D_FORTIFY_SOURCE=2 -Wno-error=format-security -Wformat-security"
100 export CXXFLAGS_FOR_TARGET="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions -fstack-protector -Wp,-D_FORTIFY_SOURCE=2 -Wno-error=format-security -Wformat-security"
101
102 "${srcdir}/gcc/configure" \
103 --prefix=/usr \
104 --build="${CHOST}" \
105 --libdir=/usr/lib \
106 --libexecdir=/usr/lib \
107 --mandir=/usr/share/man \
108 --infodir=/usr/share/info \
109 --with-bugurl=https://bugs.archlinux.org/ \
110 --enable-languages=c,c++,fortran,lto,java \
111 --with-isl \
112 --with-linker-hash-style=gnu \
113 --with-system-zlib \
114 --enable-__cxa_atexit \
115 --enable-build-format-warnings \
116 --enable-cet=auto \
117 --enable-checking=release \
118 --enable-clocale=gnu \
119 --enable-default-pie \
120 --enable-default-ssp \
121 --enable-gnu-indirect-function \
122 --enable-gnu-unique-object \
123 --disable-install-libiberty \
124 --enable-linker-build-id \
125 --enable-lto \
126 --disable-multilib \
127 --enable-plugin \
128 --enable-shared \
129 --enable-threads=posix \
130 --disable-libssp \
131 --disable-libstdcxx-pch \
132 --disable-libunwind-exceptions \
133 --disable-werror \
134 --enable-java-awt=gtk \
135 --with-java-home="$JAVA_HOME" \
136 --enable-libgcj-multifile \
137 --enable-version-specific-runtime-libs \
138 --enable-build-warnings \
139 --program-suffix=-"${_ver}" \
140 --disable-nls
141
142 make
143
144 # make documentation
145 make -C "${CHOST}"/libstdc++-v3/doc doc-man-doxygen
146}
147
148check() {
149 cd gcc-build
150
151 make -k check || true
152 "${srcdir}/gcc/contrib/test_summary"
153}
154
155package_gcc6-libs() {
156 pkgdesc="Runtime libraries shipped by GCC (6.x.x)"
157 depends=('glibc>=2.25' zlib)
158 options+=(!strip)
159
160 cd gcc-build
161 make -C "$CHOST"/libgcc DESTDIR="${pkgdir}" install-shared
162 rm "${pkgdir}"/"${_libdir}"/libgcc_eh.a
163 mv "${pkgdir}"/usr/lib/gcc/"$CHOST"/lib/libgcc_s.so* "${pkgdir}"/"${_libdir}"
164
165 for lib in libatomic \
166 libcilkrts \
167 libjava \
168 libgfortran \
169 libgomp \
170 libitm \
171 libquadmath \
172 libsanitizer/{a,l,ub}san \
173 libstdc++-v3/src \
174 libvtv; do
175 make -C "$CHOST/$lib" DESTDIR="${pkgdir}" install-toolexeclibLTLIBRARIES
176 done
177
178 make -C "$CHOST"/libsanitizer/tsan DESTDIR="${pkgdir}" install-toolexeclibLTLIBRARIES
179 make -C "$CHOST"/libstdc++-v3/po DESTDIR="${pkgdir}" install
180 #make -C "$CHOST"/libmpx DESTDIR="${pkgdir}" install
181 #rm "${pkgdir}"/"${_libdir}"/libmpx.spec
182
183 for lib in libgomp \
184 libitm \
185 libquadmath; do
186 make -C "$CHOST"/"$lib" DESTDIR="${pkgdir}" install-info
187 done
188
189 # Lazy way of dealing with conflicting files...
190 rm -rf "${pkgdir}"/usr/share/{info,locale,man}
191
192 # Install Runtime Library Exception
193 install -Dm644 "${srcdir}"/gcc-$pkgver/COPYING.RUNTIME \
194 "${pkgdir}"/usr/share/licenses/$pkgbase/RUNTIME.LIBRARY.EXCEPTION
195}
196
197package_gcc6() {
198 pkgdesc="The GNU Compiler Collection - C and C++ frontends (6.x.x)"
199 depends=("gcc6-libs=${pkgver}-${pkgrel}" 'binutils>=2.28' libmpc zlib)
200 options+=(staticlibs)
201
202 #export LD_PRELOAD=/usr/lib/libstdc++.so
203
204 cd gcc-build
205
206 make -C gcc DESTDIR="${pkgdir}" install-driver install-cpp install-gcc-ar \
207 c++.install-common install-headers install-plugin install-lto-wrapper
208
209 for _i in gcov gcov-dump gcov-tool collect2 collect-ld lto1; do
210 install -Dm755 "gcc/$_i" "$pkgdir/usr/bin/${_i}-${_ver}"
211 done
212
213 make -C "$CHOST"/libgcc DESTDIR="${pkgdir}" install
214 rm -rf "${pkgdir}"/usr/lib/gcc/"${CHOST}"/lib*
215
216 make -C "$CHOST"/libstdc++-v3/src DESTDIR="${pkgdir}" install
217 make -C "$CHOST"/libstdc++-v3/include DESTDIR="${pkgdir}" install
218 make -C "$CHOST"/libstdc++-v3/libsupc++ DESTDIR="${pkgdir}" install
219 make -C "$CHOST"/libstdc++-v3/python DESTDIR="${pkgdir}" install
220
221 make DESTDIR="${pkgdir}" install-libcc1
222 install -d "$pkgdir"/usr/share/gdb/auto-load/usr/lib
223 #mv "${pkgdir}"/${_libdir}/libstdc++.so.6.*-gdb.py \
224 # "${pkgdir}/usr/share/gdb/auto-load/{_libdir}/"
225 rm "${pkgdir}"/"${_libdir}"/libstdc++.so*
226
227 make DESTDIR="${pkgdir}" install-fixincludes
228 make -C gcc DESTDIR="${pkgdir}" install-mkheaders
229
230 make -C lto-plugin DESTDIR="${pkgdir}" install
231 install -dm755 "${pkgdir}"/usr/lib/bfd-plugins/
232 ln -s "${_libdir}"/liblto_plugin.so "${pkgdir}"/usr/lib/bfd-plugins/
233
234 make -C "$CHOST"/libcilkrts DESTDIR="${pkgdir}" install-nodist_{cilkinclude,toolexeclib}HEADERS
235 make -C "$CHOST"/libgomp DESTDIR="${pkgdir}" install-nodist_{libsubinclude,toolexeclib}HEADERS
236 make -C "$CHOST"/libitm DESTDIR="${pkgdir}" install-nodist_toolexeclibHEADERS
237 make -C "$CHOST"/libquadmath DESTDIR="${pkgdir}" install-nodist_libsubincludeHEADERS
238 make -C "$CHOST"/libsanitizer DESTDIR="${pkgdir}" install-nodist_{saninclude,toolexeclib}HEADERS
239 make -C "$CHOST"/libsanitizer/asan DESTDIR="${pkgdir}" install-nodist_toolexeclibHEADERS
240 #make -C "$CHOST"/libmpx DESTDIR="${pkgdir}" install-nodist_toolexeclibHEADERS
241
242 make -C gcc DESTDIR="${pkgdir}" install-man install-info
243 rm "${pkgdir}/usr/share/man/man1/gfortran-${_ver}.1"
244 rm "${pkgdir}/usr/share/info/gfortran.info"
245
246 make -C libcpp DESTDIR="${pkgdir}" install
247 make -C gcc DESTDIR="${pkgdir}" install-po
248
249 # many packages expect this symlink
250 ln -s "gcc-${_ver}" "${pkgdir}/usr/bin/cc-${_ver}"
251
252 # POSIX conformance launcher scripts for c89 and c99
253 install -Dm755 "${srcdir}/c89" "${pkgdir}/usr/bin/c89-${_ver}"
254 install -Dm755 "${srcdir}/c99" "${pkgdir}/usr/bin/c99-${_ver}"
255
256 # Lazy way of dealing with conflicting files...
257 rm -rf "${pkgdir}"/usr/share/{info,locale,man}
258 rm -rf "${pkgdir}"/"${_libdir}"/libstdc++.{a,la}
259
260 # Move potentially conflicting stuff to version specific subdirectory
261 mv "${pkgdir}"/usr/lib/bfd-plugins/liblto_plugin.so "${pkgdir}/usr/lib/bfd-plugins/liblto_plugin-${_ver}.so"
262 mv "${pkgdir}"/usr/lib/*.so* "${pkgdir}"/"${_libdir}"/
263 install -Dm755 gcc/cc1 "${pkgdir}"/"${_libdir}"/cc1
264 install -Dm755 gcc/cc1plus "${pkgdir}"/"${_libdir}"/cc1plus
265}
266
267package_gcc6-fortran() {
268 pkgdesc="Fortran front-end for GCC"
269 depends=("gcc6=$pkgver-$pkgrel" zlib libmpc)
270
271 #export LD_PRELOAD=/usr/lib/libstdc++.so
272
273 cd gcc-build
274 make -C "$CHOST"/libgfortran DESTDIR="${pkgdir}" install-cafexeclibLTLIBRARIES \
275 install-{toolexeclibDATA,nodist_fincludeHEADERS}
276 make -C "$CHOST"/libgomp DESTDIR="${pkgdir}" install-nodist_fincludeHEADERS
277 make -C gcc DESTDIR="${pkgdir}" fortran.install-common
278 install -Dm755 gcc/f951 "${pkgdir}/${_libdir}/f951"
279
280 ln -s "gfortran-${_ver}" "${pkgdir}/usr/bin/f95-${_ver}"
281}
282
283package_gcc6-gcj() {
284 pkgdesc="Java front-end for GCC"
285 depends=("gcc6=$pkgver-$pkgrel" libmpc libxtst gtk2 java-runtime libsm)
286 replaces=('gcc-gcj')
287
288 # Install libjava.
289 cd gcc-build
290 make -j1 DESTDIR="${pkgdir}" install-target-libjava
291
292 # Install java-common.
293 cd gcc
294 make -j1 DESTDIR="${pkgdir}" java.install-common java.install-man
295
296 install -m755 jc1 "${pkgdir}"/"${_libdir}"/
297 install -m755 jvgenmain "${pkgdir}"/"${_libdir}"/
298
299 # Remove conflicting files.
300 rm "${pkgdir}"/usr/lib/gcc/"$CHOST"/lib/libgcc_s.so*
301 rm "${pkgdir}"/"${_libdir}"/libg{cj,ij}*.so*
302 rm "${pkgdir}"/"${_libdir}"/libgcc_eh.a
303 rm "${pkgdir}"/"${_libdir}"/crtbegin.o
304 rm "${pkgdir}"/"${_libdir}"/crtbeginS.o
305 rm "${pkgdir}"/"${_libdir}"/crtbeginT.o
306 rm "${pkgdir}"/"${_libdir}"/crtend.o
307 rm "${pkgdir}"/"${_libdir}"/crtendS.o
308 rm "${pkgdir}"/"${_libdir}"/crtfastmath.o
309 rm "${pkgdir}"/"${_libdir}"/crtprec32.o
310 rm "${pkgdir}"/"${_libdir}"/crtprec64.o
311 rm "${pkgdir}"/"${_libdir}"/crtprec80.o
312 rm "${pkgdir}"/"${_libdir}"/include/unwind.h
313 rm "${pkgdir}"/"${_libdir}"/libgcc.a
314 rm "${pkgdir}"/"${_libdir}"/libgcov.a
315
316 # Rename two files to not conflict to classpath
317 mv "${pkgdir}"/usr/share/info/cp-tools.info "${pkgdir}"/usr/share/info/cp-tools-gcj.info
318
319 linkdir=$(basename "{$pkgdir}"/usr/lib/gcj-${pkgver%.*})
320 ln -sf "$linkdir" "${pkgdir}"/usr/lib/gcj-${pkgver%.*}
321 ln -sf "libgcj-${pkgver}.jar" "${pkgdir}"/usr/share/java/libgcj-${pkgver%.?}.jar
322 ln -sf "libgcj-${pkgver}.jar" "${pkgdir}"/usr/share/java/libgcj.jar
323 ln -sf "libgcj-tools-${pkgver}.jar" "${pkgdir}"/usr/share/java/libgcj-tools-${pkgver%.?}.jar
324 ln -sf "libgcj-tools-${pkgver}.jar" "${pkgdir}"/usr/share/java/libgcj-tools.jar
325}
326

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion