gowin-eda-programmer
LOW
maintainer kpn
4 votes
base
gowin-eda
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a source tarball from a CDN host (cdn.gowinsemi.com.cn) that is plausibly owned by the vendor, and installs official EDA tools; the source is verified by a fixed checksum, and no untrusted remote code execution occurs.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from a CDN host (cdn.gowinsemi.com.cn) that is plausibly owned by the vendor, and installs official EDA tools; the source is verified by a fixed checksum, and no untrusted remote code execution occurs.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:12
source=("https://cdn.gowinsemi.com.cn/Gowin_V${pkgver/_/-}_linux.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: insmtr <insmtr@insmtr.cn>
2
# Contributor: yjun <jerrysteve1101 at gmail dot com>
3
4
pkgbase=gowin-eda
5
pkgver=1.9.12.03
6
pkgrel=1
7
epoch=1
8
_desc="Gowin EDA, an easy to use integrated design environment provides design engineers one-stop solution from design entry to verification."
9
arch=('x86_64')
10
url="https://www.gowinsemi.com.cn/software/index"
11
license=('unknown')
12
source=("https://cdn.gowinsemi.com.cn/Gowin_V${pkgver/_/-}_linux.tar.gz"
13
"gw_ide.sh"
14
"gw_sh.sh"
15
"programmer.sh"
16
"programmer_cli.sh"
17
"${pkgbase}.png"
18
"${pkgbase}-ide-project.xml"
19
"${pkgbase}-ide.desktop"
20
"${pkgbase}-programmer.desktop")
21
sha256sums=('4cf60a8ffd0337da23191a911c69b1e0ca3457a6070c15c9dc245005212ecb51'
22
'2d0366a0f172cf1cf8a076d21085237919277c815920dc0ebf16f607eb439ffc'
23
'21abbbb6f609eb8f5878386a61636de7ba35a42b03a56180e0bb4cc8ea424790'
24
'9a87376bf3b204e7c83cfd7e4f242ee66b7f08d0662a897937ded74884c9348d'
25
'54900d9c54d1862950e21275f3602c880e7b82c902da55f725165bf3cd022342'
26
'346991b57db67aa4a8373ad09fd221e310c87ac7a6c90313cad7b48f7e6934ab'
27
'a95d18239e9ecb6b3f712fa569601e964624ef4ccb39ca85e56dfafa74b573d2'
28
'27894cfb7ab767fc9d4a1392e9d521fefbb819be7806512cbe44118934e16697'
29
'664f20c092c8b6fd018327a8e60c2f31454bbd9a27950b8ea7e98b76895235b8')
30
31
_install() {
32
find ${@: 2} -type f -exec install -Dm$1 {} ${pkgdir}/opt/${pkgname}/{} \;
33
}
34
35
_install_exec() {
36
# executable script
37
install -dm 755 ${pkgdir}/usr/bin/
38
for _exec in $@
39
do
40
install -Dm755 ${srcdir}/${_exec}.sh ${pkgdir}/usr/bin/${_exec}
41
done
42
}
43
44
_package-ide() {
45
pkgdesc="Gowin EDA IDE - ${_desc}"
46
depends=('fontconfig' 'freetype2')
47
optdepends=('openfpgaloader: open source fpga programmer, as a replacement to Gowin Programmer')
48
provides=("gowin-eda-ide" "gowin-ide")
49
backup=("opt/${pkgname}/bin/gwlicense.ini")
50
51
cd ${srcdir}/IDE
52
53
_install 644 doc/
54
_install 644 lib/
55
_install 644 data/
56
_install 644 share/
57
_install 644 simlib/
58
_install 644 ipcore/
59
_install 644 plugins/
60
_install 644 bin/vhdl_packages
61
_install 644 bin/prim_syns
62
_install 644 bin/eye_mon_task_gen.dist
63
_install 644 bin/serdes_toml_to_csr.dist
64
_install 644 bin/ssc_task_gen.dist
65
_install 644 bin/resources
66
_install 644 bin/translations
67
_install 755 bin/ -maxdepth 1
68
69
chmod 644 ${pkgdir}/opt/${pkgname}/bin/prim{itive.xml,_syn.vhd,_syn.v}
70
chmod 644 ${pkgdir}/opt/${pkgname}/bin/qt.conf
71
chmod 644 ${pkgdir}/opt/${pkgname}/bin/programmer.json
72
chmod 666 ${pkgdir}/opt/${pkgname}/bin/gwlicense.ini
73
chmod 644 ${pkgdir}/opt/${pkgname}/bin/hardcore.xml
74
75
# desktop entry
76
install -Dm644 ${srcdir}/${pkgname}.desktop -t ${pkgdir}/usr/share/applications
77
78
#icon
79
install -Dm644 ${srcdir}/${pkgbase}.png ${pkgdir}/usr/share/pixmaps/${pkgname}.png
80
81
_install_exec gw_sh gw_ide
82
83
# fix ide launch error
84
# libfreetype.so.6 from Gowin EDA ide could cause error when launch the IDE:
85
# /opt/gowin-eda-edu-ide/bin/gw_ide: symbol lookup error: /usr/lib/libfontconfig.so.1: undefined symbol: FT_Done_MM_Var
86
#
87
# https://bbs.archlinux.org/viewtopic.php?id=251445
88
# https://mathematica.stackexchange.com/questions/189306/cant-launch-mathematica-11-on-fedora-29
89
rm -f ${pkgdir}/opt/${pkgname}/lib/libfreetype.so.6
90
91
# HACK: fix IDE hardcode path of Programmer
92
sed -i 's|../../Programmer|..////Programmer|g' ${pkgdir}/opt/${pkgname}/bin/gao_{sh,analyzer}
93
sed -i 's|../../Programmer|..////Programmer|g' ${pkgdir}/opt/${pkgname}/bin/gvio_{sh,analyzer}
94
sed -i 's|../../Programmer|..////Programmer|g' ${pkgdir}/opt/${pkgname}/bin/gw_goeye
95
sed -i 's|../../Programmer|..////Programmer|g' ${pkgdir}/opt/${pkgname}/plugins/ide/lib{StartPage,FpgaPrj}.so
96
ln -s /opt/${pkgbase}-programmer ${pkgdir}/opt/${pkgname}/Programmer
97
98
# MimeType association
99
install -Dm644 ${srcdir}/${pkgbase}-ide-project.xml -t ${pkgdir}/usr/share/mime/packages/
100
}
101
102
_package-programmer() {
103
pkgdesc="Gowin EDA Programmer - ${_desc}"
104
# depends=('fontconfig' 'freetype2')
105
provides=("gowin-eda-programmer" "gowin-programmer")
106
options=('emptydirs')
107
108
cd ${srcdir}/Programmer
109
110
_install 644 doc/
111
_install 644 bin/PyQt5
112
_install 644 bin/data
113
_install 644 bin/Crypto -path '*/__pycache__' -prune -o
114
_install 644 bin/tools
115
_install 644 bin/ -maxdepth 1
116
117
_install_exec programmer programmer_cli
118
119
# empty dir
120
install -dm755 ${pkgdir}/opt/${pkgname}/bin/data/output
121
install -dm755 ${pkgdir}/opt/${pkgname}/bin/data/lang
122
123
# desktop entry
124
install -Dm644 ${srcdir}/${pkgname}.desktop -t ${pkgdir}/usr/share/applications
125
126
#icon
127
install -Dm644 ${srcdir}/${pkgbase}.png ${pkgdir}/usr/share/pixmaps/${pkgname}.png
128
129
chmod 755 ${pkgdir}/opt/${pkgname}/bin/programmer{,_cli}
130
chmod 755 ${pkgdir}/opt/${pkgname}/bin/jtagserver{,_lpt}
131
chmod 755 ${pkgdir}/opt/${pkgname}/bin/JTAGLoading
132
}
133
134
pkgname=("${pkgbase}-ide" "${pkgbase}-programmer")
135
for _p in ${pkgname[@]}; do
136
eval "package_${_p}() {
137
$(declare -f "_package${_p#$pkgbase}")
138
_package${_p#${pkgbase}}
139
}"
140
done
141
# vim: set sw=2 ts=2 et:
142
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |