gdc-static

maintainer kozzi · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads GCC and ISL source tarballs from official project hosts (ftp.gnu.org and isl.gforge.inria.fr) to build GDC statically; these are legitimate build sources, not executables or untrusted payloads, so the non-whitelisted host is not a supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads GCC and ISL source tarballs from official project hosts (ftp.gnu.org and isl.gforge.inria.fr) to build GDC statically; these are legitimate build sources, not executables or untrusted payloads, so the non-whitelisted host is not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 http://isl.gforge.inria.fr/isl-${_islver}.tar.xz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Daniel Kozak <kozzi11@gmail.com>
    
      2
    
      3pkgname=(gdc-static)
    
      4pkgver=9.1.0
    
      5_majorver=${pkgver:0:1}
    
      6_islver=0.21
    
      7pkgrel=1
    
      8pkgdesc='The GNU D compiler (part of official gcc distribution with static phobos)'
    
      9arch=(x86_64)
    
      10license=(GPL LGPL FDL custom)
    
      11url='https://gcc.gnu.org'
    
      12makedepends=(binutils libmpc python subversion)
    
      13checkdepends=(dejagnu inetutils)
    
      14options=(!emptydirs)
    
      15source=(https://ftp.gnu.org/gnu/gcc/gcc-$pkgver/gcc-$pkgver.tar.xz
    
      16        http://isl.gforge.inria.fr/isl-${_islver}.tar.xz
    
      17        c89 c99
    
      18        bz90397.patch
    
      19        bz90949.patch
    
      20        phobos_path.patch)
    
      21sha256sums=('79a66834e96a6050d8fe78db2c3b32fb285b230b855d0a66288235bc04b327a0'
    
      22            '777058852a3db9500954361e294881214f6ecd4b594c00da5eee974cd6a54960'
    
      23            'de48736f6e4153f03d0a5d38ceb6c6fdb7f054e8f47ddd6af0a3dbf14f27b931'
    
      24            '2513c6d9984dd0a2058557bf00f06d8d5181734e41dcfe07be7ed86f2959622a'
    
      25            'cc20d05bcc6cb35bf0944b391f0b0380af375f2a8a03ce1cd67835884bc41fac'
    
      26            'c860819e730faf1621e1286ebe3a0179df6e25182b81a9ca0a3db02633982a14'
    
      27            'c86372c207d174c0918d4aedf1cb79f7fc093649eb1ad8d9450dccc46849d308')
    
      28
    
      29_libdirpath=usr/lib/gdc
    
      30
    
      31_libdir="$_libdirpath"/gcc/$CHOST/${pkgver%%+*}
    
      32
    
      33
    
      34prepare() {
    
      35  [[ ! -d gcc ]] && ln -s gcc-${pkgver/+/-} gcc
    
      36  cd gcc
    
      37
    
      38  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90397
    
      39  patch -p0 -i "$srcdir/bz90397.patch"
    
      40
    
      41  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90949
    
      42  patch -p0 -i "$srcdir/bz90949.patch"
    
      43
    
      44  # Seup gdc include dir path
    
      45  patch -p1 -i "$srcdir"/phobos_path.patch
    
      46
    
      47  # link isl for in-tree build
    
      48  [[ ! -d isl ]] && ln -s ../isl-${_islver} isl
    
      49
    
      50  # Do not run fixincludes
    
      51  sed -i 's@\./fixinc\.sh@-c true@' gcc/Makefile.in
    
      52
    
      53  # Arch Linux installs x86_64 libraries /lib
    
      54  sed -i '/m64=/s/lib64/lib/' gcc/config/i386/t-linux64
    
      55
    
      56  # hack! - some configure tests for header files using "$CPP $CPPFLAGS"
    
      57  sed -i "/ac_cpp=/s/\$CPPFLAGS/\$CPPFLAGS -O2/" {libiberty,gcc}/configure
    
      58
    
      59  mkdir -p "$srcdir/gcc-build"
    
      60}
    
      61
    
      62build() {
    
      63  cd gcc-build
    
      64
    
      65  # using -pipe causes spurious test-suite failures
    
      66  # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48565
    
      67  CFLAGS=${CFLAGS/-pipe/}
    
      68  CXXFLAGS=${CXXFLAGS/-pipe/}
    
      69
    
      70  "$srcdir/gcc/configure" --prefix=/usr \
    
      71      --libdir="/$_libdirpath" \
    
      72      --libexecdir="/$_libdirpath" \
    
      73      --mandir=/usr/share/man \
    
      74      --infodir=/usr/share/info \
    
      75      --with-bugurl=https://gcc.gnu.org/bugzilla/ \
    
      76      --enable-languages=d \
    
      77      --enable-static \
    
      78      --enable-threads=posix \
    
      79      --with-system-zlib \
    
      80      --with-isl \
    
      81      --enable-__cxa_atexit \
    
      82      --disable-libunwind-exceptions \
    
      83      --enable-clocale=gnu \
    
      84      --disable-libstdcxx-pch \
    
      85      --disable-libssp \
    
      86      --enable-gnu-unique-object \
    
      87      --enable-linker-build-id \
    
      88      --enable-lto \
    
      89      --enable-plugin \
    
      90      --enable-install-libiberty \
    
      91      --with-linker-hash-style=gnu \
    
      92      --enable-gnu-indirect-function \
    
      93      --disable-multilib \
    
      94      --disable-werror \
    
      95      --disable-bootstrap \
    
      96      --enable-checking=release \
    
      97      --enable-default-pie \
    
      98      --enable-default-ssp \
    
      99      --enable-cet=auto \
    
      100      --with-target-system-zlib=yes \
    
      101      gdc_include_dir=/usr/include/dlang/gdc
    
      102
    
      103  make
    
      104}
    
      105
    
      106package_gdc-static() {
    
      107  pkgdesc="Compiler for D programming language which uses gcc backend"
    
      108  depends=('gcc')
    
      109  provides=(d-compiler=2.076.1 gdc libgphobos libgphobos.so libgdruntime.so)
    
      110  conflicts=('gdc' 'libgphobos' 'gcc-gdc')
    
      111  options=('staticlibs')
    
      112
    
      113  cd gcc-build
    
      114  make -C gcc DESTDIR="$pkgdir" d.install-{common,man,info}
    
      115  make -C $CHOST/libphobos DESTDIR="$pkgdir" install
    
      116  make -C lto-plugin DESTDIR="$pkgdir" install
    
      117  make -C $CHOST/libgcc DESTDIR="$pkgdir" install
    
      118
    
      119  # Binaries
    
      120  install -Dm 755 gcc/gdc "$pkgdir"/usr/bin/gdc
    
      121  install -Dm 755 gcc/d21 "$pkgdir"/"$_libdir"/d21
    
      122  #install -Dm 755 ../GDMD/dmd-script "$pkgdir"/usr/bin/gdmd
    
      123
    
      124
    
      125  # Doc
    
      126  #install -Dm 644 "$srcdir"/GDMD/dmd-script.1 "$pkgdir"/usr/share/man/man1/gdmd.1
    
      127
    
      128  # Install Runtime Library Exception
    
      129  install -d "$pkgdir/usr/share/licenses/$pkgname/"
    
      130  ln -s /usr/share/licenses/gcc-libs/RUNTIME.LIBRARY.EXCEPTION \
    
      131    "$pkgdir/usr/share/licenses/$pkgname/"
    
      132
    
      133  mkdir -p -m 755 "$pkgdir"/usr/include/dlang
    
      134  ln -s /"${_libdir}"/include/d "$pkgdir"/usr/include/dlang/gdc
    
      135
    
      136  if [ -d "$pkgdir"/usr/lib/lib ]; then
    
      137    mv "$pkgdir"/usr/lib/lib/* "$pkgdir"/usr/lib
    
      138    rmdir "$pkgdir"/usr/lib/lib
    
      139  fi
    
      140
    
      141  rm -f "$pkgdir"/usr/lib{,32}/libgcc_s.so*
    
      142
    
      143}
    
      144

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2