libstud-optional

LOW

maintainer migrev 1 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Why flagged

Source tarball is fetched from pkg.cppget.org, the official build2/bpkg package registry for the codesynthesis project, with a pinned sha256 checksum; the build uses bpkg to compile and install the library's own source, which is normal packaging practice with no obfuscation or remote code execution concerns.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Source tarball is fetched from pkg.cppget.org, the official build2/bpkg package registry for the codesynthesis project, with a pinned sha256 checksum; the build uses bpkg to compile and install the library's own source, which is normal packaging practice with no obfuscation or remote code execution concerns.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://pkg.cppget.org/1/stable/libstud/${pkgname}-${pkgver}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Miguel Revilla <yo at miguelrevilla dot com>
    
      2
    
      3pkgname=libstud-optional
    
      4pkgver=1.0.0
    
      5pkgrel=1
    
      6pkgdesc="A reasonably-conforming optional class template implementation for C++14"
    
      7url="https://www.codesynthesis.com/projects/libstud-optional/"
    
      8arch=('i686' 'x86_64')
    
      9depends=('build2')
    
      10options=('!libtool')
    
      11license=('MIT')
    
      12source=("https://pkg.cppget.org/1/stable/libstud/${pkgname}-${pkgver}.tar.gz")
    
      13sha256sums=('5ae2487e81b95335c25b89b61390353a84a31c93f51a88151d8ca635bcfddbe4')
    
      14
    
      15prepare() {
    
      16
    
      17	GPPVER="$(${CXX:-g++} --version | grep 'g++ (GCC)' | sed 's/g++ (GCC) //' | sed 's/\s.*$//')"
    
      18
    
      19	bpkg create -d odb-gcc-${GPPVER} cc \
    
      20	config.cxx=${CXX:-g++} \
    
      21	config.cc.coptions="-O3 -DODB_GCC_PLUGIN_DIR $CXXFLAGS" \
    
      22	config.bin.rpath=${pkgdir}/usr/lib \
    
      23	config.install.root=${pkgdir}/usr \
    
      24	config.install.relocatable=true
    
      25
    
      26	mv ${pkgname}-${pkgver}.tar.gz odb-gcc-${GPPVER}
    
      27}
    
      28
    
      29build() {
    
      30
    
      31	GPPVER="$(${CXX:-g++} --version | grep 'g++ (GCC)' | sed 's/g++ (GCC) //' | sed 's/\s.*$//')"
    
      32	cd "${srcdir}/odb-gcc-${GPPVER}"
    
      33
    
      34	bpkg build ${pkgname}-${pkgver}.tar.gz
    
      35}
    
      36
    
      37package() {
    
      38
    
      39	GPPVER="$(${CXX:-g++} --version | grep 'g++ (GCC)' | sed 's/g++ (GCC) //' | sed 's/\s.*$//')"
    
      40	cd "${srcdir}/odb-gcc-${GPPVER}"
    
      41
    
      42	bpkg install ${pkgname}
    
      43
    
      44	rm ${pkgdir}/usr/lib/pkgconfig/${pkgname}.static.pc
    
      45	install -Dm644 "$srcdir"/$pkgname-$pkgver/LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Low	2
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2