mcxx

maintainer gamezelda · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the project's official domain (pm.bsc.es), which is not on the standard whitelist but is plausibly the project's own infrastructure; building from official project sources, even on non-whitelisted hosts, is normal for AUR packages and does not constitute a high risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official domain (pm.bsc.es), which is not on the standard whitelist but is plausibly the project's own infrastructure; building from official project sources, even on non-whitelisted hosts, is normal for AUR packages and does not constitute a high risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://pm.bsc.es/ftp/${_bundlepkgname}/releases/${_bundlepkgname}-${_bundlepkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Joan Bruguera Micó <joanbrugueram@gmail.com>
    
      2pkgname='mcxx'
    
      3_bundlepkgname='ompss'
    
      4pkgdesc='Mercurium is a C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping developed by the Programming Models group at the Barcelona Supercomputing Center.'
    
      5pkgver='2.3.0.20190627'
    
      6_bundlepkgver='19.06'
    
      7pkgrel='10'
    
      8arch=('x86_64')
    
      9url='https://pm.bsc.es/ompss'
    
      10license=('LGPL-3.0-or-later')
    
      11depends=(nanox gcc-fortran sqlite3)
    
      12makedepends=(python3 gperf)
    
      13source=("https://pm.bsc.es/ftp/${_bundlepkgname}/releases/${_bundlepkgname}-${_bundlepkgver}.tar.gz"
    
      14        # Generated with `git format-patch -5 --stdout 2a98963e7ff28f70cf2a8bcf42a792a1420f36e3`
    
      15        # on the mcxx repository at https://github.com/bsc-pm/mcxx
    
      16        migrate_scripts_to_python3.patch
    
      17        0001-Add-support-for-gperf-3.3.x.patch
    
      18        "0001-Fix-build-with-Python-3.13-exec-eval-changes.patch")
    
      19sha512sums=(159efc17ba446f3f2205a8c0580ed10fab263f8bdb7306d5444d1fc6a592f80d749c03031e7e416090360c36a51a38da083b2b2ed4e75dda5c55a103806d91d2
    
      20            0330f65d18065ed47b9af19cc3100be7b914b720bb5858a59b89473a29ffe32c12d84da6e3c7557a2aa1b0f8bc955c17000e19302724071caa2477eefdc71af1
    
      21            3646fb1fcd20932caaf4653df52fdb0c6ad490643d026d4752692b775bfb571d835f2f46f60604ffe38ac57abcc6975218517d5b822f4acb2855363965939dd3
    
      22            fb59290edcf58b5c70390b462dea4df02f2eae028bed39aea0bb5c17caca6ec4a89e4545b1d4edf9a460c9de868e4b91f42fd7bd54d5fa5ffd98624daeb5003a)
    
      23
    
      24prepare() {
    
      25	cd "$srcdir/${_bundlepkgname}-${_bundlepkgver}/$pkgname-${pkgver%.*}"
    
      26
    
      27	# Backport Python 2 to 3 backports to OmpSs(1)
    
      28	patch -Np1 -i "$srcdir/migrate_scripts_to_python3.patch"
    
      29	patch -Np1 -i "$srcdir/0001-Add-support-for-gperf-3.3.x.patch"
    
      30	autoreconf -fiv
    
      31
    
      32	patch -Np1 -i "$srcdir/0001-Fix-build-with-Python-3.13-exec-eval-changes.patch"
    
      33}
    
      34
    
      35build() {
    
      36	cd "$srcdir/${_bundlepkgname}-${_bundlepkgver}/$pkgname-${pkgver%.*}"
    
      37
    
      38	# WORKAROUND: The sources are outdated compared to Arch's environment,
    
      39	#             so we have to downgrade/disable some things...
    
      40	export LDFLAGS="${LDFLAGS:-} -Wl,--no-as-needed"
    
      41
    
      42	# WORKAROUND: Force gperf files to be regenerated, to avoid build errors
    
      43	#             (declaration mismatches due to unsigned int / gperf_length_t)
    
      44	rm src/driver/cxx-configoptions.c
    
      45	rm src/driver/cxx-debugflags.c
    
      46	rm src/driver/cxx-fileextensions.c
    
      47	rm src/frontend/cxx-asttype-str-internal.h
    
      48	rm src/frontend/fortran/fortran03-keywords.c
    
      49
    
      50	# See https://hub.docker.com/r/bscpm/ompss/dockerfile
    
      51	./configure \
    
      52		--prefix=/usr \
    
      53		--enable-ompss \
    
      54		--with-nanox=/usr
    
      55
    
      56	make
    
      57}
    
      58
    
      59package() {
    
      60	cd "$srcdir/${_bundlepkgname}-${_bundlepkgver}/$pkgname-${pkgver%.*}"
    
      61
    
      62	make DESTDIR="$pkgdir/" install
    
      63}
    
      64

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,7 +4,7 @@
 pkgdesc='Mercurium is a C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping developed by the Programming Models group at the Barcelona Supercomputing Center.'
 pkgver='2.3.0.20190627'
 _bundlepkgver='19.06'
-pkgrel='9'
+pkgrel='10'
 arch=('x86_64')
 url='https://pm.bsc.es/ompss'
 license=('LGPL-3.0-or-later')
@@ -21,10 +21,6 @@
             3646fb1fcd20932caaf4653df52fdb0c6ad490643d026d4752692b775bfb571d835f2f46f60604ffe38ac57abcc6975218517d5b822f4acb2855363965939dd3
             fb59290edcf58b5c70390b462dea4df02f2eae028bed39aea0bb5c17caca6ec4a89e4545b1d4edf9a460c9de868e4b91f42fd7bd54d5fa5ffd98624daeb5003a)
 
-# WORKAROUND: The sources are outdated compared to Arch's environment,
-#             so we have to downgrade/disable some things...
-export LDFLAGS="${LDFLAGS:-} -Wl,--no-as-needed"
-
 prepare() {
 	cd "$srcdir/${_bundlepkgname}-${_bundlepkgver}/$pkgname-${pkgver%.*}"
 
@@ -38,6 +34,10 @@
 
 build() {
 	cd "$srcdir/${_bundlepkgname}-${_bundlepkgver}/$pkgname-${pkgver%.*}"
+
+	# WORKAROUND: The sources are outdated compared to Arch's environment,
+	#             so we have to downgrade/disable some things...
+	export LDFLAGS="${LDFLAGS:-} -Wl,--no-as-needed"
 
 	# WORKAROUND: Force gperf files to be regenerated, to avoid build errors
 	#             (declaration mismatches due to unsigned int / gperf_length_t)

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 15:29:50	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1