lib32-hwloc

LOW

maintainer vitaliikuzhdin 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The source is downloaded from the official project domain (open-mpi.org) which is plausibly the project's own infrastructure, making this a normal build from upstream source despite the non-whitelisted host.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from the official project domain (open-mpi.org) which is plausibly the project's own infrastructure, making this a normal build from upstream source despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://www.open-mpi.org/software/${_name}/v${pkgver%.*}/downloads/${_pkgsrc}.tar.bz2")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2# Maintainer: asyync1024 <asyync1024 at proton dot me>
    
      3# Contributor: Llewelyn Trahaearn <WoefulDerelict [at] GMail [dot] com>
    
      4
    
      5_name="hwloc"
    
      6pkgname="lib32-$_name"
    
      7pkgver=2.15.0
    
      8pkgrel=1
    
      9pkgdesc="Portable Hardware Locality is a portable abstraction of hierarchical architectures (32-bit)"
    
      10arch=('x86_64')
    
      11url="https://www.open-mpi.org/projects/hwloc/"
    
      12license=('BSD-3-Clause')
    
      13depends=(
    
      14  "${_name}>=${pkgver}"
    
      15  'lib32-glibc'
    
      16  'lib32-libpciaccess'
    
      17  # 'lib32-libtool>=2.2.6'
    
      18  'lib32-systemd'
    
      19)
    
      20makedepends=('lib32-gcc-libs' 'lib32-libxml2')
    
      21optdepends=('lib32-libxml2: full XML import/export support')
    
      22provides=("lib${_name}.so")
    
      23_pkgsrc="${_name}-${pkgver}"
    
      24source=("https://www.open-mpi.org/software/${_name}/v${pkgver%.*}/downloads/${_pkgsrc}.tar.bz2")
    
      25sha512sums=('3eca90872686c5887c6430b9d0b1e7ad50942f2afe77d599a79677c55072183809ca3cef2a68f727e8fa12183b4d2da0a5dea06aee4a9ea416059d3df3e18126')
    
      26b2sums=('ca80bd11f99af70860adcb95cc3c69292736f4eb230d990b3b8a5ed71302a6e6e7906b3c22480e2d45ee4e7cd83820c561877a1ca4aa8ace757dfd93083e2999')
    
      27
    
      28build() {
    
      29  export CFLAGS+=" -m32"
    
      30  export CXXFLAGS+=" -m32"
    
      31  export LDFLAGS+=" -m32"
    
      32  export PKG_CONFIG_PATH='/usr/lib32/pkgconfig'
    
      33  local configure_options=(
    
      34    --prefix='/usr'
    
      35    --sbindir='/usr/bin'
    
      36    --sysconfdir='/etc'
    
      37    --program-suffix='-32'
    
      38    --lib{exec,}dir='/usr/lib32'
    
      39    --build=i686-pc-linux-gnu
    
      40    --enable-plugins
    
      41    --disable-nvml
    
      42    --disable-cuda
    
      43    --disable-rsmi
    
      44  )
    
      45
    
      46  cd "$srcdir/$_pkgsrc"
    
      47  libtoolize
    
      48  autoreconf -vfi
    
      49  ./configure "${configure_options[@]}"
    
      50  make
    
      51}
    
      52
    
      53check() {
    
      54  make check -C "$srcdir/$_pkgsrc"
    
      55}
    
      56
    
      57package() {
    
      58  cd "$srcdir/$_pkgsrc"
    
      59  make DESTDIR="$pkgdir" install
    
      60
    
      61  cd "$pkgdir/usr"
    
      62  rm -rf "bin" "include" "share"
    
      63  install -Dm 644 "$srcdir/$_pkgsrc/COPYING" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      64}
    
      65

Changes since previous scan

--- PKGBUILD @ 2026-07-20 00:19
+++ PKGBUILD @ 2026-10-17 00:21
@@ -4,8 +4,8 @@
 
 _name="hwloc"
 pkgname="lib32-$_name"
-pkgver=2.14.0
-pkgrel=2
+pkgver=2.15.0
+pkgrel=1
 pkgdesc="Portable Hardware Locality is a portable abstraction of hierarchical architectures (32-bit)"
 arch=('x86_64')
 url="https://www.open-mpi.org/projects/hwloc/"
@@ -22,8 +22,8 @@
 provides=("lib${_name}.so")
 _pkgsrc="${_name}-${pkgver}"
 source=("https://www.open-mpi.org/software/${_name}/v${pkgver%.*}/downloads/${_pkgsrc}.tar.bz2")
-sha512sums=('547a9ed3c6af399de9617fe675bd6d16db300cc98213d6c71b2f1b41dd4a1706c7f2cf0dd1feb0d9f8a546b1976740c7a959dca0c23a4f52eac0b25cc403d087')
-b2sums=('5cc8d5dbe6d89cbe332fd4306b0c52ec781135b17dad6cdd1e7e149e5d4979f203819e02d53707b6a3e59de0e855cd4502f3c7adfbd520945ee7562291030c64')
+sha512sums=('3eca90872686c5887c6430b9d0b1e7ad50942f2afe77d599a79677c55072183809ca3cef2a68f727e8fa12183b4d2da0a5dea06aee4a9ea416059d3df3e18126')
+b2sums=('ca80bd11f99af70860adcb95cc3c69292736f4eb230d990b3b8a5ed71302a6e6e7906b3c22480e2d45ee4e7cd83820c561877a1ca4aa8ace757dfd93083e2999')
 
 build() {
   export CFLAGS+=" -m32"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 15:20:15	Medium	1
2026-07-20 00:19:49	Clean	2
2026-07-19 07:10:24	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 17:53:10	Clean	2
2026-06-18 16:11:54	Medium	1