linux-manjaro-xanmod-headers
LOW
maintainer eusebiacalvet
11 votes
base
linux-manjaro-xanmod
scanned 2026-09-17 00:27:14.276658
Why flagged
The source uses SourceForge for a patch, which is a non-standard host, but SourceForge is a known and generally trusted platform for open-source projects; the patch is part of the official Xanmod release and used to build the kernel, which is a legitimate use case.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source uses SourceForge for a patch, which is a non-standard host, but SourceForge is a known and generally trusted platform for open-source projects; the patch is part of the official Xanmod release and used to build the kernel, which is a legitimate use case.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:114
"https://gitlab.manjaro.org/packages/core/linux${_major//.}/-/archive/${__commit}/linux${_major//.}-${__commit}.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: parov0z <andrey.android7890@gmail.com>
2
3
# https://gitlab.manjaro.org/packages/core/linux515
4
#
5
# Maintainer: Philip Müller
6
# Maintainer: Bernhard Landauer
7
# Maintainer: Helmut Stult
8
9
# http://aur.archlinux.org/packages/linux-xanmod
10
#
11
# Maintainer: Joan Figueras
12
# Contributor: Torge Matthies
13
# Contributor: Jan Alexander Steffens (heftig)
14
15
##
16
## The following variables can be customized at build time. Use env or export to change at your wish
17
##
18
## Example: env _microarchitecture=99 use_numa=n use_tracers=n makepkg -sc
19
##
20
## Look inside 'choose-gcc-optimization.sh' to choose your microarchitecture
21
## Valid numbers between: 0 to 99
22
## Default is: 0 => generic
23
## Good option if your package is for one machine: 98 (Intel native) or 99 (AMD native)
24
if [ -z ${_microarchitecture+x} ]; then
25
_microarchitecture=0
26
fi
27
28
## Disable NUMA since most users do not have multiple processors. Breaks CUDA/NvEnc.
29
## Archlinux and Xanmod enable it by default.
30
## Set variable "use_numa" to: n to disable (possibly increase performance)
31
## y to enable (stock default)
32
if [ -z ${use_numa+x} ]; then
33
use_numa=y
34
fi
35
36
## Since upstream disabled CONFIG_STACK_TRACER (limits debugging and analyzing of the kernel)
37
## you can enable them setting this option. Caution, because they have an impact in performance.
38
## Stock Archlinux has this enabled.
39
## Set variable "use_tracers" to: n to disable (possibly increase performance, XanMod default)
40
if [ -z ${use_tracers+x} ]; then
41
use_tracers=n
42
fi
43
44
# Unique compiler supported upstream is GCC
45
## Choose between GCC and CLANG config (default is GCC)
46
## Use the environment variable "_compiler=clang"
47
if [ "${_compiler}" = "clang" ]; then
48
_compiler_flags="CC=clang HOSTCC=clang LLVM=1 LLVM_IAS=1"
49
fi
50
51
# Choose between the 4 main configs for stable branch. Default x86-64-v1 which use CONFIG_GENERIC_CPU2:
52
# Possible values: config_x86-64-v1 / config_x86-64-v2 (default) / config_x86-64-v3 / config_x86-64-v4
53
# This will be overwritten by selecting any option in microarchitecture script
54
# Source files: https://github.com/xanmod/linux/tree/5.17/CONFIGS/xanmod/gcc
55
if [ -z ${_config+x} ]; then
56
_config=config_x86-64-v2
57
fi
58
59
# Compress modules with ZSTD (to save disk space)
60
if [ -z ${_compress_modules+x} ]; then
61
_compress_modules=n
62
fi
63
64
# Compile ONLY used modules to VASTLY reduce the number of modules built
65
# and the build time.
66
#
67
# To keep track of which modules are needed for your specific system/hardware,
68
# give module_db script a try: https://aur.archlinux.org/packages/modprobed-db
69
# This PKGBUILD read the database kept if it exists
70
#
71
# More at this wiki page ---> https://wiki.archlinux.org/index.php/Modprobed-db
72
if [ -z ${_localmodcfg} ]; then
73
_localmodcfg=n
74
fi
75
76
# Tweak kernel options prior to a build via nconfig
77
if [ -z ${_makenconfig} ]; then
78
_makenconfig=n
79
fi
80
81
### IMPORTANT: Do no edit below this line unless you know what you're doing
82
83
84
pkgbase=linux-manjaro-xanmod
85
pkgname=("${pkgbase}" "${pkgbase}-headers")
86
_major=6.9
87
pkgver=${_major}.7
88
_branch=6.x
89
xanmod=1
90
_sf_branch=main
91
pkgrel=1
92
pkgdesc='Linux Manjaro Xanmod'
93
url="http://www.xanmod.org/"
94
arch=(x86_64)
95
96
__commit="7ae2ba409b5d010f43c6bb99d5498a94119bd598" # 6.7.12
97
98
license=(GPL2)
99
100
makedepends=(
101
bc cpio gettext libelf pahole perl python tar xz
102
python-sphinx inetutils kmod xmlto
103
)
104
105
if [ "${_compiler}" = "clang" ]; then
106
makedepends+=(clang llvm lld)
107
fi
108
options=('!strip')
109
_srcname="linux-${pkgver}-xanmod${xanmod}"
110
111
source=("https://cdn.kernel.org/pub/linux/kernel/v${_branch}/linux-${_major}.tar."{xz,sign}
112
"patch-${pkgver}-xanmod${xanmod}${_revision}.xz::https://sourceforge.net/projects/xanmod/files/releases/${_sf_branch}/${pkgver}-xanmod${xanmod}/patch-${pkgver}-xanmod${xanmod}.xz/download"
113
choose-gcc-optimization.sh
114
"https://gitlab.manjaro.org/packages/core/linux${_major//.}/-/archive/${__commit}/linux${_major//.}-${__commit}.tar.gz")
115
#"patch-${pkgver}-xanmod${xanmod}.xz::https://sourceforge.net/projects/xanmod/files/releases/stable/${pkgver}-xanmod${xanmod}/patch-${pkgver}-xanmod${xanmod}.xz/download"
116
117
# Archlinux patches
118
_commit="ec9e9a4219fe221dec93fa16fddbe44a34933d8d"
119
_patches=()
120
for _patch in ${_patches[@]}; do
121
source+=("${_patch}::https://raw.githubusercontent.com/archlinux/svntogit-packages/${_commit}/trunk/${_patch}")
122
done
123
124
sha256sums=('24fa01fb989c7a3e28453f117799168713766e119c5381dac30115f18f268149' # kernel tar.xz
125
'SKIP' # tar.sign
126
'235f0c325080342fed184ec3d415a865293c66a6010965b6cd3c5cfe02f2c6d9' # xanmod
127
'a8b38eb482eb685944757182c4886404abc12703e5e56ec39c7d61298d17d71f' # choose-gcc-optimization.sh
128
'3dc4bea7a4ffda78d624f59821a0a075d4a9c1d1f7c5c8d7e3b0bcbf824f02c3') # manjaro
129
130
validpgpkeys=(
131
'ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linux Torvalds
132
'647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman
133
)
134
135
export KBUILD_BUILD_HOST=${KBUILD_BUILD_HOST:-archlinux}
136
export KBUILD_BUILD_USER=${KBUILD_BUILD_USER:-makepkg}
137
export KBUILD_BUILD_TIMESTAMP=${KBUILD_BUILD_TIMESTAMP:-$(date -Ru${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH})}
138
139
prepare() {
140
cd linux-${_major}
141
142
# Apply Xanmod patch
143
patch -Np1 -i ../patch-${pkgver}-xanmod${xanmod}
144
145
msg2 "Setting version..."
146
#echo "-$pkgrel" > localversion.10-pkgrel
147
echo "-MANJARO" > localversion.20-pkgname
148
149
# Archlinux patches
150
local src
151
for src in "${source[@]}"; do
152
src="${src%%::*}"
153
src="${src##*/}"
154
[[ $src = *.patch ]] || continue
155
msg2 "Applying patch $src..."
156
patch -Np1 < "../$src"
157
done
158
159
# Manjaro patches
160
161
# remove conflicting ones
162
patchdir=../linux${_major//.}-$__commit
163
rm $patchdir/0101-ZEN_Add_sysctl_and_CONFIG_to_disallow_unprivileged_CLONE_NEWUSER.patch
164
rm $patchdir/v14.7-0001-HID-asus-fix-more-n-key-report-descriptors-if-.patch
165
166
167
local _patch
168
for _patch in ../linux${_major//.}-$__commit/*; do
169
[[ $_patch = *.patch ]] || continue
170
msg2 "Applying patch: $_patch..."
171
patch -Np1 < "../linux${_major//.}-$__commit/$_patch"
172
done
173
174
175
# Applying configuration
176
cp -vf CONFIGS/xanmod/gcc/${_config} .config
177
# enable LTO_CLANG_THIN
178
if [ "${_compiler}" = "clang" ]; then
179
scripts/config --disable LTO_CLANG_FULL
180
scripts/config --enable LTO_CLANG_THIN
181
fi
182
183
184
# CONFIG_STACK_VALIDATION gives better stack traces. Also is enabled in all official kernel packages by Archlinux team
185
scripts/config --enable CONFIG_STACK_VALIDATION
186
187
# Enable IKCONFIG following Arch's philosophy
188
scripts/config --enable CONFIG_IKCONFIG \
189
--enable CONFIG_IKCONFIG_PROC
190
191
# User set. See at the top of this file
192
if [ "$use_tracers" = "n" ]; then
193
msg2 "Disabling FUNCTION_TRACER/GRAPH_TRACER only if we are not compiling with clang..."
194
if [ "${_compiler}" = "gcc" ] || [ "${_compiler}q" = "q" ]; then
195
scripts/config --disable CONFIG_FUNCTION_TRACER \
196
--disable CONFIG_STACK_TRACER
197
fi
198
fi
199
200
if [ "$use_numa" = "n" ]; then
201
msg2 "Disabling NUMA..."
202
scripts/config --disable CONFIG_NUMA
203
fi
204
205
msg2 "add anbox support"
206
# CONFIG_ION is not set
207
scripts/config --enable CONFIG_ANDROID
208
scripts/config --enable CONFIG_ANDROID_BINDER_IPC
209
scripts/config --enable CONFIG_ANDROID_BINDERFS
210
scripts/config --set-str CONFIG_ANDROID_BINDER_DEVICES "binder,hwbinder,vndbinder"
211
# CONFIG_ANDROID_BINDER_IPC_SELFTEST is not set
212
213
scripts/config --set-str CONFIG_DEFAULT_HOSTNAME "manjaro"
214
215
# Compress modules by default (following Arch's kernel)
216
if [ "$_compress_modules" = "y" ]; then
217
scripts/config --enable CONFIG_MODULE_COMPRESS_ZSTD
218
fi
219
220
# Let's user choose microarchitecture optimization in GCC
221
# Use default microarchitecture only if we have not choosen another microarchitecture
222
if [ "$_microarchitecture" -ne "0" ]; then
223
../choose-gcc-optimization.sh $_microarchitecture
224
fi
225
226
# This is intended for the people that want to build this package with their own config
227
# Put the file "myconfig" at the package folder (this will take preference) or "${XDG_CONFIG_HOME}/linux-xanmod/myconfig"
228
# If we detect partial file with scripts/config commands, we execute as a script
229
# If not, it's a full config, will be replaced
230
for _myconfig in "${SRCDEST}/myconfig" "${HOME}/.config/linux-xanmod/myconfig" "${XDG_CONFIG_HOME}/linux-xanmod/myconfig" ; do
231
if [ -f "${_myconfig}" ] && [ "$(wc -l <"${_myconfig}")" -gt "0" ]; then
232
if grep -q 'scripts/config' "${_myconfig}"; then
233
# myconfig is a partial file. Executing as a script
234
msg2 "Applying myconfig..."
235
bash -x "${_myconfig}"
236
else
237
# myconfig is a full config file. Replacing default .config
238
msg2 "Using user CUSTOM config..."
239
cp -f "${_myconfig}" .config
240
fi
241
echo
242
break
243
fi
244
done
245
246
### Optionally load needed modules for the make localmodconfig
247
# See https://aur.archlinux.org/packages/modprobed-db
248
if [ "$_localmodcfg" = "y" ]; then
249
if [ -f $HOME/.config/modprobed.db ]; then
250
msg2 "Running Steven Rostedt's make localmodconfig now"
251
make ${_compiler_flags} LSMOD=$HOME/.config/modprobed.db localmodconfig
252
else
253
msg2 "No modprobed.db data found"
254
exit 1
255
fi
256
fi
257
258
msg2 "make ${_compiler_flags} olddefconfig"
259
make ${_compiler_flags} olddefconfig
260
#diff -u CONFIGS/xanmod/gcc/${_config} .config || :
261
262
make -s kernelrelease > version
263
msg2 "Prepared %s version %s" "$pkgbase" "$(<version)"
264
265
if [ "$_makenconfig" = "y" ]; then
266
make ${_compiler_flags} nconfig
267
fi
268
269
# save configuration for later reuse
270
cat .config > "${SRCDEST}/config.last"
271
}
272
273
build() {
274
cd linux-${_major}
275
make ${_compiler_flags} all
276
make -C tools/bpf/bpftool vmlinux.h feature-clang-bpf-co-re=1
277
}
278
279
_package() {
280
pkgdesc="The Linux kernel and modules with Xanmod and Manjaro patches"
281
depends=('coreutils' 'linux-firmware' 'kmod' 'initramfs')
282
optdepends=('wireless-regdb: to set the correct wireless channels of your country'
283
'linux-firmware: firmware images needed for some devices')
284
provides=(VIRTUALBOX-GUEST-MODULES
285
WIREGUARD-MODULE
286
KSMBD-MODULE
287
NTFS3-MODULE)
288
replaces=()
289
conflicts=()
290
291
cd linux-${_major}
292
local modulesdir="$pkgdir/usr/lib/modules/$(<version)"
293
294
msg2 "Installing boot image..."
295
# systemd expects to find the kernel here to allow hibernation
296
# https://github.com/systemd/systemd/commit/edda44605f06a41fb86b7ab8128dcf99161d2344
297
install -Dm644 "$(make -s image_name)" "$modulesdir/vmlinuz"
298
299
# Used by mkinitcpio to name the kernel
300
echo "manjaro-xanmod" | install -Dm644 /dev/stdin "$modulesdir/pkgbase"
301
302
# add kernel version
303
echo "${pkgver}-${pkgrel}-Manjaro-Xanmod x64" | install -Dm644 /dev/stdin "${pkgdir}/boot/${pkgbase}.kver"
304
305
msg2 "Installing modules..."
306
ZSTD_CLEVEL=19 make INSTALL_MOD_PATH="$pkgdir/usr" INSTALL_MOD_STRIP=1 \
307
DEPMOD=/doesnt/exist modules_install # Suppress depmod
308
309
# remove build link
310
rm "$modulesdir"/build
311
}
312
313
_package-headers() {
314
pkgdesc="Headers and scripts for building modules for the $pkgdesc kernel"
315
depends=(pahole)
316
provides=()
317
replaces=()
318
conflicts=()
319
320
cd linux-${_major}
321
local builddir="$pkgdir/usr/lib/modules/$(<version)/build"
322
323
msg2 "Installing build files..."
324
install -Dt "$builddir" -m644 .config Makefile Module.symvers System.map \
325
localversion.* version vmlinux tools/bpf/bpftool/vmlinux.h
326
install -Dt "$builddir/kernel" -m644 kernel/Makefile
327
install -Dt "$builddir/arch/x86" -m644 arch/x86/Makefile
328
cp -t "$builddir" -a scripts
329
330
# required when STACK_VALIDATION is enabled
331
install -Dt "$builddir/tools/objtool" tools/objtool/objtool
332
333
# required when DEBUG_INFO_BTF_MODULES is enabled
334
install -Dt "$builddir/tools/bpf/resolve_btfids" tools/bpf/resolve_btfids/resolve_btfids
335
336
msg2 "Installing headers..."
337
cp -t "$builddir" -a include
338
cp -t "$builddir/arch/x86" -a arch/x86/include
339
install -Dt "$builddir/arch/x86/kernel" -m644 arch/x86/kernel/asm-offsets.s
340
341
install -Dt "$builddir/drivers/md" -m644 drivers/md/*.h
342
install -Dt "$builddir/net/mac80211" -m644 net/mac80211/*.h
343
344
# https://bugs.archlinux.org/task/13146
345
install -Dt "$builddir/drivers/media/i2c" -m644 drivers/media/i2c/msp3400-driver.h
346
347
# https://bugs.archlinux.org/task/20402
348
install -Dt "$builddir/drivers/media/usb/dvb-usb" -m644 drivers/media/usb/dvb-usb/*.h
349
install -Dt "$builddir/drivers/media/dvb-frontends" -m644 drivers/media/dvb-frontends/*.h
350
install -Dt "$builddir/drivers/media/tuners" -m644 drivers/media/tuners/*.h
351
352
# https://bugs.archlinux.org/task/71392
353
install -Dt "$builddir/drivers/iio/common/hid-sensors" -m644 drivers/iio/common/hid-sensors/*.h
354
355
msg2 "Installing KConfig files..."
356
find . -name 'Kconfig*' -exec install -Dm644 {} "$builddir/{}" \;
357
358
msg2 "Removing unneeded architectures..."
359
local arch
360
for arch in "$builddir"/arch/*/; do
361
[[ $arch = */x86/ ]] && continue
362
echo "Removing $(basename "$arch")"
363
rm -r "$arch"
364
done
365
366
msg2 "Removing documentation..."
367
rm -r "$builddir/Documentation"
368
369
msg2 "Removing broken symlinks..."
370
find -L "$builddir" -type l -printf 'Removing %P\n' -delete
371
372
msg2 "Removing loose objects..."
373
find "$builddir" -type f -name '*.o' -printf 'Removing %P\n' -delete
374
375
msg2 "Stripping build tools..."
376
local file
377
while read -rd '' file; do
378
case "$(file -Sib "$file")" in
379
application/x-sharedlib\;*) # Libraries (.so)
380
strip -v $STRIP_SHARED "$file" ;;
381
application/x-archive\;*) # Libraries (.a)
382
strip -v $STRIP_STATIC "$file" ;;
383
application/x-executable\;*) # Binaries
384
strip -v $STRIP_BINARIES "$file" ;;
385
application/x-pie-executable\;*) # Relocatable binaries
386
strip -v $STRIP_SHARED "$file" ;;
387
esac
388
done < <(find "$builddir" -type f -perm -u+x ! -name vmlinux -print0)
389
390
msg2 "Stripping vmlinux..."
391
strip -v $STRIP_STATIC "$builddir/vmlinux"
392
msg2 "Adding symlink..."
393
mkdir -p "$pkgdir/usr/src"
394
ln -sr "$builddir" "$pkgdir/usr/src/$pkgbase"
395
}
396
397
pkgname=("${pkgbase}" "${pkgbase}-headers")
398
for _p in "${pkgname[@]}"; do
399
eval "package_$_p() {
400
$(declare -f "_package${_p#$pkgbase}")
401
_package${_p#$pkgbase}
402
}"
403
done
404
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |