libstud-optional

maintainer migrev · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Source tarball is fetched from pkg.cppget.org, the official build2/bpkg package registry for the codesynthesis project, with a pinned sha256 checksum; the build uses bpkg to compile and install the library's own source, which is normal packaging practice with no obfuscation or remote code execution concerns.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Source tarball is fetched from pkg.cppget.org, the official build2/bpkg package registry for the codesynthesis project, with a pinned sha256 checksum; the build uses bpkg to compile and install the library's own source, which is normal packaging practice with no obfuscation or remote code execution concerns.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://pkg.cppget.org/1/stable/libstud/${pkgname}-${pkgver}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Miguel Revilla <yo at miguelrevilla dot com>
    
      2
    
      3pkgname=libstud-optional
    
      4pkgver=1.0.0
    
      5pkgrel=1
    
      6pkgdesc="A reasonably-conforming optional class template implementation for C++14"
    
      7url="https://www.codesynthesis.com/projects/libstud-optional/"
    
      8arch=('i686' 'x86_64')
    
      9depends=('build2')
    
      10options=('!libtool')
    
      11license=('MIT')
    
      12source=("https://pkg.cppget.org/1/stable/libstud/${pkgname}-${pkgver}.tar.gz")
    
      13sha256sums=('5ae2487e81b95335c25b89b61390353a84a31c93f51a88151d8ca635bcfddbe4')
    
      14
    
      15prepare() {
    
      16
    
      17	GPPVER="$(${CXX:-g++} --version | grep 'g++ (GCC)' | sed 's/g++ (GCC) //' | sed 's/\s.*$//')"
    
      18
    
      19	bpkg create -d odb-gcc-${GPPVER} cc \
    
      20	config.cxx=${CXX:-g++} \
    
      21	config.cc.coptions="-O3 -DODB_GCC_PLUGIN_DIR $CXXFLAGS" \
    
      22	config.bin.rpath=${pkgdir}/usr/lib \
    
      23	config.install.root=${pkgdir}/usr \
    
      24	config.install.relocatable=true
    
      25
    
      26	mv ${pkgname}-${pkgver}.tar.gz odb-gcc-${GPPVER}
    
      27}
    
      28
    
      29build() {
    
      30
    
      31	GPPVER="$(${CXX:-g++} --version | grep 'g++ (GCC)' | sed 's/g++ (GCC) //' | sed 's/\s.*$//')"
    
      32	cd "${srcdir}/odb-gcc-${GPPVER}"
    
      33
    
      34	bpkg build ${pkgname}-${pkgver}.tar.gz
    
      35}
    
      36
    
      37package() {
    
      38
    
      39	GPPVER="$(${CXX:-g++} --version | grep 'g++ (GCC)' | sed 's/g++ (GCC) //' | sed 's/\s.*$//')"
    
      40	cd "${srcdir}/odb-gcc-${GPPVER}"
    
      41
    
      42	bpkg install ${pkgname}
    
      43
    
      44	rm ${pkgdir}/usr/lib/pkgconfig/${pkgname}.static.pc
    
      45	install -Dm644 "$srcdir"/$pkgname-$pkgver/LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 17:43:21	LOW	3
2026-07-28 17:39:33	MEDIUM	2