glibc-git-native-pgo
LOW
maintainer neycrol
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads data and configuration files from a non-whitelisted but official Arch Linux GitLab instance, which is a trusted source; these files are not executable and are used for building glibc from upstream source, a normal AUR practice.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads data and configuration files from a non-whitelisted but official Arch Linux GitLab instance, which is a trusted source; these files are not executable and are used for building glibc from upstream source, a normal AUR practice.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
"git+https://sourceware.org/git/glibc.git"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: neycrol <330578697@qq.com>
2
pkgbase=glibc-git-native-pgo
3
pkgname=(glibc-git-native-pgo lib32-glibc-git-native-pgo glibc-locales-git-native-pgo)
4
pkgver=2.42.9000.r635.g9da0585852
5
pkgrel=1
6
pkgdesc="GNU C Library (Git Master) - Native Optimized with Selective PGO (Built for Performance)"
7
arch=(x86_64)
8
url='https://www.gnu.org/software/libc'
9
license=(GPL-2.0-or-later LGPL-2.1-or-later)
10
makedepends=(git gd lib32-gcc-libs python)
11
# 核心禁忌：关 LTO，关 Debug，关 Strip
12
options=(staticlibs !lto !debug !strip)
13
# === 核心修改：定义上游源地址 ===
14
_arch_upstream="https://gitlab.archlinux.org/archlinux/packaging/packages/glibc/-/raw/main"
15
16
source=(
17
"git+https://sourceware.org/git/glibc.git"
18
# 数据文件：直接从上游拉取，保证最新
19
"locale.gen.txt::${_arch_upstream}/locale.gen.txt"
20
"locale-gen::${_arch_upstream}/locale-gen"
21
"lib32-glibc.conf::${_arch_upstream}/lib32-glibc.conf"
22
"sdt.h::${_arch_upstream}/sdt.h"
23
"sdt-config.h::${_arch_upstream}/sdt-config.h"
24
25
# 结构文件：必须保留在本地，否则 makepkg 启动会报错
26
"glibc.install"
27
"lib32-glibc.install"
28
)
29
30
# 全部设为 SKIP，让它永远信任下载下来的新文件
31
b2sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
32
33
34
provides=('glibc' 'libglibc')
35
conflicts=('glibc' 'glibc-git')
36
37
pkgver() {
38
cd glibc
39
git describe --long --tags | sed 's/^glibc-//;s/\([^-]*-g\)/r\1/;s/-/./g'
40
}
41
42
prepare() {
43
mkdir -p glibc-build-pgo lib32-glibc-build
44
}
45
46
build() {
47
# === 1. 物理极限参数 ===
48
local _phys_cflags="-march=native -mtune=native -O3 -pipe -fno-plt -fexceptions \
49
-Wformat -Werror=format-security \
50
-fstack-clash-protection -fcf-protection \
51
-fno-semantic-interposition -mno-vzeroupper \
52
-Wno-error=inline -Wno-error=attributes"
53
54
export CFLAGS="${_phys_cflags}"
55
export CXXFLAGS="${_phys_cflags}"
56
57
# 强制 BFD 链接器
58
export LDFLAGS="-Wl,-O2,--sort-common,--as-needed,-z,relro,-z,now -fuse-ld=bfd"
59
export CPPFLAGS=""
60
61
# === 2. 制作智能白名单 Wrapper (核心) ===
62
# 写入 srcdir (构建目录)，不污染源码目录
63
cat << 'EOF' > "$srcdir/gcc-wrapper"
64
#!/bin/bash
65
ARGS=("$@")
66
ENABLE_PGO=0
67
# PGO 白名单
68
WHITELIST=("malloc" "string" "math" "stdlib" "stdio-common" "wcsmbs" "time" "io" "nptl")
69
70
for ((i=0; i<${#ARGS[@]}; i++)); do
71
if [[ "${ARGS[i]}" == "-c" ]]; then
72
SOURCE_FILE="${ARGS[i+1]}"
73
for dir in "${WHITELIST[@]}"; do
74
if [[ "$SOURCE_FILE" == *"/$dir/"* ]]; then
75
ENABLE_PGO=1
76
break 2
77
fi
78
done
79
fi
80
done
81
82
# 双重保险：排除 rtld
83
for arg in "${ARGS[@]}"; do
84
if [[ "$arg" == *"-DIS_IN_rtld"* ]]; then
85
ENABLE_PGO=0
86
break
87
fi
88
done
89
90
PGO_MODE="${GLIBC_PGO_MODE:-}"
91
if [ "$ENABLE_PGO" -eq 1 ] && [ -n "$PGO_MODE" ]; then
92
exec /usr/bin/gcc "$PGO_MODE" "${ARGS[@]}"
93
else
94
exec /usr/bin/gcc "${ARGS[@]}"
95
fi
96
EOF
97
chmod +x "$srcdir/gcc-wrapper"
98
cp "$srcdir/gcc-wrapper" "$srcdir/g++-wrapper"
99
sed -i 's|/usr/bin/gcc|/usr/bin/g++|g' "$srcdir/g++-wrapper"
100
export PATH="$srcdir:$PATH"
101
102
local _configure_flags=(
103
--prefix=/usr
104
--with-headers=/usr/include
105
--enable-bind-now
106
--disable-fortify-source
107
--enable-kernel=5.15
108
--enable-multi-arch
109
--enable-stack-protector=strong
110
--enable-systemtap
111
--disable-nscd
112
--disable-profile
113
--disable-werror
114
)
115
116
# =================================================================
117
# 64-bit 构建 (PGO + CET + SFrame)
118
# =================================================================
119
(
120
cd glibc-build-pgo
121
echo "slibdir=/usr/lib" > configparms
122
echo "rtlddir=/usr/lib" >> configparms
123
echo "sbindir=/usr/bin" >> configparms
124
echo "rootsbindir=/usr/bin" >> configparms
125
126
# Stage 1: Instrumentation
127
msg2 "🚀 [64-bit] Starting PGO Stage 1..."
128
export GLIBC_PGO_MODE="-fprofile-generate"
129
130
"${srcdir}"/glibc/configure \
131
--libdir=/usr/lib \
132
--libexecdir=/usr/lib \
133
--enable-cet \
134
--enable-sframe \
135
"${_configure_flags[@]}"
136
137
make -j$(nproc)
138
139
# Stage 2: Training
140
msg2 "🏋️♂️ [64-bit] Training..."
141
make -j$(nproc) iconv/tests || true
142
make -j$(nproc) string/tests || true
143
make -j$(nproc) malloc/tests || true
144
make -j$(nproc) math/tests || true
145
146
# Stage 3: Optimization
147
msg2 "🔥 [64-bit] Final Optimization..."
148
find . -name "*.o" -type f -delete
149
find . -name "*.so" -type f -delete
150
151
export GLIBC_PGO_MODE="-fprofile-use -fprofile-correction"
152
153
"${srcdir}"/glibc/configure \
154
--libdir=/usr/lib \
155
--libexecdir=/usr/lib \
156
--enable-cet \
157
--enable-sframe \
158
"${_configure_flags[@]}"
159
160
make -j$(nproc)
161
make info
162
)
163
164
# =================================================================
165
# 32-bit 构建 (兼容模式)
166
# =================================================================
167
(
168
cd lib32-glibc-build
169
unset GLIBC_PGO_MODE
170
export CC="/usr/bin/gcc -m32 -mstackrealign"
171
export CXX="/usr/bin/g++ -m32 -mstackrealign"
172
export LD="ld.bfd"
173
export CFLAGS="${_phys_cflags}"
174
export CXXFLAGS="${_phys_cflags}"
175
export LDFLAGS="-Wl,-O2,--sort-common,--as-needed,-z,relro,-z,now -fuse-ld=bfd"
176
177
echo "slibdir=/usr/lib32" > configparms
178
echo "rtlddir=/usr/lib32" >> configparms
179
echo "sbindir=/usr/bin" >> configparms
180
echo "rootsbindir=/usr/bin" >> configparms
181
182
msg2 "⚙️ [32-bit] Building..."
183
"${srcdir}"/glibc/configure \
184
--host=i686-pc-linux-gnu \
185
--libdir=/usr/lib32 \
186
--libexecdir=/usr/lib32 \
187
--disable-cet \
188
--disable-sframe \
189
"${_configure_flags[@]}"
190
191
make -j$(nproc)
192
)
193
194
make -C "${srcdir}"/glibc/localedata objdir="${srcdir}"/glibc-build-pgo \
195
DESTDIR="${srcdir}"/locales install-locale-files
196
}
197
198
package_glibc-git-native-pgo() {
199
pkgdesc='GNU C Library (Git Master) - Native Optimized PGO'
200
depends=('linux-api-headers>=4.10' tzdata filesystem)
201
optdepends=('gd: for memusagestat' 'perl: for mtrace')
202
install=glibc.install
203
backup=(etc/gai.conf etc/locale.gen)
204
provides=('glibc' 'libglibc')
205
conflicts=('glibc')
206
207
make -C glibc-build-pgo DESTDIR="${pkgdir}" install
208
rm -f "${pkgdir}"/etc/ld.so.cache
209
rm -f "${pkgdir}"/usr/bin/{tzselect,zdump,zic}
210
211
cd glibc
212
install -dm755 "${pkgdir}"/usr/lib/locale
213
install -m644 posix/gai.conf "${pkgdir}"/etc/gai.conf
214
install -m755 "${srcdir}"/locale-gen "${pkgdir}"/usr/bin
215
install -m644 "${srcdir}"/locale.gen.txt "${pkgdir}"/etc/locale.gen
216
sed -e '1,3d' -e 's|/| |g' -e 's|\\| |g' -e 's|^|#|g' localedata/SUPPORTED >> "${pkgdir}"/etc/locale.gen
217
sed -e '1,3d' -e 's|/| |g' -e 's| \\||g' localedata/SUPPORTED > "${pkgdir}"/usr/share/i18n/SUPPORTED
218
install -dm755 "${pkgdir}"/usr/lib/locale
219
cp -r "${srcdir}"/locales/usr/lib/locale/C.utf8 -t "${pkgdir}"/usr/lib/locale
220
sed -i '/#C\.UTF-8 /d' "${pkgdir}"/etc/locale.gen
221
install -Dm644 "${srcdir}"/sdt.h "${pkgdir}"/usr/include/sys/sdt.h
222
install -Dm644 "${srcdir}"/sdt-config.h "${pkgdir}"/usr/include/sys/sdt-config.h
223
}
224
225
package_lib32-glibc-git-native-pgo() {
226
pkgdesc='GNU C Library (32-bit, Git Master) - Native Optimized'
227
depends=("glibc-git-native-pgo=$pkgver")
228
provides=('lib32-glibc')
229
conflicts=('lib32-glibc')
230
options+=('!emptydirs')
231
install=lib32-glibc.install
232
233
cd lib32-glibc-build
234
make DESTDIR="${pkgdir}" install
235
rm -rf "${pkgdir}"/{etc,sbin,usr/{bin,sbin,share},var}
236
find "${pkgdir}"/usr/include -type f -not -name '*-32.h' -delete
237
install -d "${pkgdir}"/usr/lib
238
ln -s ../lib32/ld-linux.so.2 "${pkgdir}"/usr/lib/
239
install -Dm644 "${srcdir}"/lib32-glibc.conf "${pkgdir}"/etc/ld.so.conf.d/lib32-glibc.conf
240
ln -s ../lib/locale "${pkgdir}"/usr/lib32/locale
241
}
242
243
package_glibc-locales-git-native-pgo() {
244
pkgdesc='Pregenerated locales for GNU C Library'
245
depends=("glibc-git-native-pgo=$pkgver")
246
provides=('glibc-locales')
247
conflicts=('glibc-locales')
248
249
cp -r locales/* -t "${pkgdir}"
250
rm -r "${pkgdir}"/usr/lib/locale/C.utf8
251
hardlink -c "${pkgdir}"/usr/lib/locale
252
}
253
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |