gdal-ecw

LOW

maintainer olivervbk 4 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package builds GDAL with ECW support from a source tarball hosted on the official OSGeo download server, which is a standard and trusted host for this project; the non-whitelisted host flag is a false positive due to static analysis not recognizing osgeo.org as a legitimate project domain.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds GDAL with ECW support from a source tarball hosted on the official OSGeo download server, which is a standard and trusted host for this project; the non-whitelisted host flag is a false positive due to static analysis not recognizing osgeo.org as a legitimate project domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 source=(https://download.osgeo.org/${_pkgbase}/${pkgver}/${_pkgbase}-${pkgver}.tar.xz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sylvain POULAIN <sylvain dot poulain at giscan dot com>
    
      2# Contributor: Jaroslav Lichtblau <svetlemodry@archlinux.org>
    
      3# Contributor: dibblethewrecker dibblethewrecker.at.jiwe.dot.org
    
      4# Contributor: William Rea <sillywilly@gmail.com>
    
      5# Contributor: Luigi Ranghetti <ggranga@gmail.com>
    
      6# Contributor: Oliver Kuster <olivervbk (at) gmail>
    
      7#
    
      8# Original can be found at:
    
      9# https://github.com/archlinux/svntogit-community/blob/packages/gdal/trunk/PKGBUILD
    
      10
    
      11pkgbase=gdal-ecw
    
      12_pkgbase=gdal
    
      13provides=('gdal=3.13.2')
    
      14conflicts=('gdal')
    
      15pkgname=('gdal-ecw' 'python-gdal-ecw')
    
      16pkgver=3.13.2
    
      17pkgrel=1
    
      18pkgdesc="A translator library for raster and vector geospatial data formats, with support to ECW format. Based on gdal-hdf4 AUR package."
    
      19arch=(x86_64)
    
      20url="https://gdal.org/"
    
      21license=(custom)
    
      22depends=('curl' 'geos' 'giflib' 'hdf5' 'libgeotiff' 'libjpeg-turbo' 'libpng' 'libspatialite' 'libtiff' 'netcdf'
    
       'openjpeg2' 'poppler' 'cfitsio' 'sqlite' 'mariadb-libs' 'postgresql-libs' 'xerces-c' 'json-c' 'arrow' 'pcre2'
    
       'libecwj2' 
    
       'sfcgal'
    
       'libkml-git'
    
       )
    
      28
    
      29makedepends=(cmake opencl-headers python-setuptools python-numpy
    
           proj arrow blosc cfitsio curl crypto++ libdeflate expat libfreexl
    
           libgeotiff geos giflib libheif hdf5 libjpeg-turbo json-c libjxl xz
    
           libxml2 lz4 mariadb-libs netcdf unixodbc ocl-icd openexr openjpeg2
    
           openssl pcre2 libpng podofo poppler postgresql-libs qhull
    
           libspatialite sqlite swig libtiff libwebp xerces-c zlib zstd libaec 
    
           sfcgal
    
           )
    
           # armadillo basisu brunsli lerc qb3 rasterlite2 tiledb
    
           # ogdi
    
      39changelog=$_pkgbase.changelog
    
      40source=(https://download.osgeo.org/${_pkgbase}/${pkgver}/${_pkgbase}-${pkgver}.tar.xz)
    
      41b2sums=('6c22f3a19b28c67c03db83b8138283955371d1a939a1cfdeadd2fa646fa8fb760961f227ba4c819cb2386bc372371352a8c5e45c35ed552d91738590cee22013')
    
      42
    
      43build() {
    
opt_libs=""
    
[[ "$(ldconfig -p | grep kml)" ]] && { echo "Found libkml"; opt_libs+=" -DGDAL_USE_LIBKML=ON"; }
    
      46
    
cmake -B build -S $_pkgbase-$pkgver \
    
  -DCMAKE_INSTALL_PREFIX=/usr \
    
  -DENABLE_IPO=ON \
    
  -DBUILD_PYTHON_BINDINGS=ON \
    
  -DGDAL_ENABLE_PLUGINS=ON \
    
  -DGDAL_USE_ARROW=ON \
    
  -DGDAL_USE_BLOSC=ON \
    
  -DGDAL_USE_CFITSIO=ON \
    
  -DGDAL_USE_CURL=ON \
    
  -DGDAL_USE_CRYPTOPP=ON \
    
  -DGDAL_USE_DEFLATE=ON \
    
  -DGDAL_USE_EXPAT=ON \
    
  -DGDAL_USE_FREEXL=ON \
    
  -DGDAL_USE_GEOTIFF=ON \
    
  -DGDAL_USE_GEOS=ON \
    
  -DGDAL_USE_GIF=ON \
    
  -DGDAL_USE_HEIF=ON \
    
  -DGDAL_USE_HDF5=ON \
    
  -DGDAL_USE_ICONV=ON \
    
  -DGDAL_USE_JPEG=ON \
    
  -DGDAL_USE_JSONC=ON \
    
  -DGDAL_USE_JXL=ON \
    
  -DGDAL_USE_LIBLZMA=ON \
    
  -DGDAL_USE_LIBXML2=ON \
    
  -DGDAL_USE_LZ4=ON \
    
  -DGDAL_USE_MYSQL=ON \
    
  -DGDAL_USE_NETCDF=ON \
    
  -DGDAL_USE_ODBC=ON \
    
  -DGDAL_USE_OPENEXR=ON \
    
  -DGDAL_USE_OPENJPEG=ON \
    
  -DGDAL_USE_OPENSSL=ON \
    
  -DGDAL_USE_PARQUET=ON \
    
  -DGDAL_USE_PCRE2=ON \
    
  -DGDAL_USE_PNG=ON \
    
  -DGDAL_USE_POPPLER=ON \
    
  -DGDAL_USE_POSTGRESQL=ON \
    
  -DGDAL_USE_QHULL=ON \
    
  -DGDAL_USE_SPATIALITE=ON \
    
  -DGDAL_USE_SQLITE3=ON \
    
  -DGDAL_USE_TIFF_INTERNAL=ON \
    
  -DGDAL_USE_GEOTIFF_INTERNAL=ON \
    
  -DGDAL_USE_TIFF=ON \
    
  -DGDAL_USE_WEBP=ON \
    
  -DGDAL_USE_XERCESC=ON \
    
  -DGDAL_USE_ZLIB=ON \
    
  -DGDAL_USE_ZSTD=ON \
    
  $opt_libs
    
make -C build
    
      95}
    
      96
    
      97package_gdal-ecw () {
    
depends=(proj blosc crypto++ curl libdeflate expat libfreexl geos libgeotiff
    
         giflib libjpeg-turbo json-c xz libxml2 lz4 unixodbc ocl-icd openssl
    
         pcre2 libpng qhull libspatialite sqlite libtiff xerces-c zlib zstd libaec
    
         arrow cfitsio hdf5 libheif mariadb-libs netcdf openexr openjpeg2
    
         podofo poppler postgresql-libs libwebp libecwj2 
    
         )
    
optdepends=('arrow: Arrow/Parquet support'
    
            'cfitsio: FITS support'
    
            'hdf5: HDF5 support'
    
            'libheif: HEIF support'
    
            'libjxl: JPEG XL support'
    
            'libkml-git: Full KML/KMZ support'
    
            'mariadb-libs: MySQL support'
    
            'netcdf: netCDF support'
    
            'openexr: EXR support'
    
            'openjpeg2: JP2 support'
    
            'podofo: PDF support'
    
            'poppler: PDF support'
    
            'postgresql-libs: PostgreSQL support'
    
            'perl: perl binding support'
    
            'unixodbc: when present while building, will add odbc support'
    
            'libwebp: WebP support')
    
      120
    
make -C build DESTDIR="${pkgdir}" install
    
install -Dm644 ${_pkgbase}-${pkgver}/LICENSE.TXT -t "${pkgdir}"/usr/share/licenses/$_pkgbase/
    
# Move python stuff
    
mkdir -p {bin,lib}
    
mv "${pkgdir}"/usr/bin/*py bin
    
mv "${pkgdir}"/usr/lib/python* lib
    
      127}
    
      128
    
      129package_python-gdal-ecw () {
    
pkgdesc="Python bindings for GDAL, with support to ECW format"
    
provides=("python-gdal")
    
conflicts=("python-gdal")
    
depends=("gdal-ecw=$pkgver" 'python-numpy')
    
      134
    
install -d "${pkgdir}"/usr/{bin,lib}
    
mv bin/* "${pkgdir}"/usr/bin
    
mv lib/* "${pkgdir}"/usr/lib
    
install -dm755 "${pkgdir}"/usr/share/licenses
    
ln -s $_pkgbase "${pkgdir}"/usr/share/licenses/$pkgname
    
# byte-compile python modules since the CMake build does not do it.
    
local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
    
python -m compileall -o 0 -o 1 -o 2 --hardlink-dupes -s "${pkgdir}" "${pkgdir}"${site_packages}
    
      143}
    
      144

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2