libcmatrix-lite

LOW

maintainer a.kudelin 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a library tarball from a university-hosted domain (dur.ac.uk), which is plausibly the project's official source; building from project-owned infrastructure, even non-whitelisted, is normal AUR packaging and not inherently dangerous.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a library tarball from a university-hosted domain (dur.ac.uk), which is plausibly the project's official source; building from project-owned infrastructure, even non-whitelisted, is normal AUR packaging and not inherently dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=(https://www.dur.ac.uk/media/training/file-types-test/pNMRsim.zip

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Anton Kudelin <kudelin at proton dot me>
    
      2
    
      3_pkgname=libcmatrix
    
      4pkgname=$_pkgname-lite
    
      5pkgver=3.11.0
    
      6pkgrel=1
    
      7pkgdesc="A library designed for numerical studies of problems in NMR"
    
      8arch=(x86_64)
    
      9url="https://www.dur.ac.uk/departments/academic/chemistry/about-us/solid-state-nmr/research-profile/equipment-and-software"
    
      10license=(MIT)
    
      11depends=(gcc-libs)
    
      12makedepends=(root cblas lapacke)
    
      13source=(https://www.dur.ac.uk/media/training/file-types-test/pNMRsim.zip
    
      14        LICENSE
    
      15        $_pkgname-3.11.0-gcc5.2.patch
    
      16        $_pkgname-3.11.0-shared.patch
    
      17        $_pkgname-3.2.1-gcc4.7.patch
    
      18        $_pkgname-3.9.0-atlas.patch
    
      19        $_pkgname-3.11.0-sse.patch)
    
      20sha256sums=('9eff652c726ed990ff5fd7108c7f58e52d4f5e110ca6446da87c4021879a5e2b'
    
      21            '2963a12ca6d9dc877463101cd8e13ceaa58b34b545f3f6d80c1313f1ee6b1b06'
    
      22            '58a1278a8f1323bd201979cdce8ecdc390ce8825f58a1d143264455d5bc0f80c'
    
      23            'e52c2adb42f5a2836db1e71e4ae2f3235e58bc5c92b04594069548201fd821cf'
    
      24            'bc4eec9967be3d9ad520d1750abb23f5b6732b8352c7ad61f54c78fb7c9d6312'
    
      25            'fc4463ff41d3a691b351f4891bcd2fb3177ce3c04f0f4d2f3d398e5b64c26b0a'
    
      26            '91cdf928663ba79cd6f4aa7a4c5d198d6e6d86407fad1640cf6b2c4a66aa106a')
    
      27
    
      28prepare() {
    
      29  tar xzf pNMRsim/libcmatrixR3_lite.tar.gz -C .
    
      30  mv "$srcdir/libcmatrixR3" "$srcdir/$_pkgname-$pkgver"
    
      31  cd "$srcdir/$_pkgname-$pkgver"
    
      32
    
      33  patch -p1 < ../$_pkgname-3.11.0-shared.patch
    
      34  patch -p1 < ../$_pkgname-3.2.1-gcc4.7.patch
    
      35  patch -p1 < ../$_pkgname-3.9.0-atlas.patch
    
      36  patch -p1 < ../$_pkgname-3.11.0-gcc5.2.patch
    
      37  patch -p1 < ../$_pkgname-3.11.0-sse.patch
    
      38
    
      39  autoupdate -f configure-compiler.ac
    
      40  autoupdate -f configure-libraries.ac
    
      41  autoupdate -f configure.ac
    
      42
    
      43  AUTOHEADER=true autoreconf -ifv configure.ac
    
      44
    
      45  sed -i 's/latlas/lcblas/g' configure
    
      46}
    
      47
    
      48build() {
    
      49  cd "$srcdir/$_pkgname-$pkgver"
    
      50  ./configure \
    
      51    --prefix=/usr \
    
      52    --includedir=/usr/include/$_pkgname \
    
      53    --with-sse \
    
      54    --with-atlas \
    
      55    --with-minuit \
    
      56    --without-mpi \
    
      57    CXX=g++ \
    
      58    CXXFLAGS="$CXXFLAGS -DHAVE_LIBLAPACK -I/usr/include/openblas -I/usr/include/openblas64" \
    
      59    ATLAS_CFLAGS='-I/usr/include' \
    
      60    ATLAS_LIBS='-lcblas' \
    
      61    LDFLAGS='-L/usr/lib -L/usr/lib/root'
    
      62  make
    
      63}
    
      64
    
      65package() {
    
      66  cd "$srcdir/$_pkgname-$pkgver"
    
      67  install -dm 755 "$pkgdir"/usr/{include/$_pkgname,lib}
    
      68  install -m755 include/*.h "$pkgdir/usr/include/$_pkgname"
    
      69  install -m755 lib/$_pkgname.so.$pkgver "$pkgdir/usr/lib"
    
      70
    
      71  cd "$pkgdir/usr/lib"
    
      72  ln -sf $_pkgname.so.$pkgver $_pkgname.so.3
    
      73  ln -sf $_pkgname.so.3 $_pkgname.so
    
      74
    
      75  install -Dm755 "$srcdir/LICENSE" \
    
      76    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      77}
    
      78

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2