mcxx

LOW

maintainer gamezelda 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a tarball from the project's official domain (pm.bsc.es), which is not on the standard whitelist but is plausibly the project's own infrastructure; building from official project sources, even on non-whitelisted hosts, is normal for AUR packages and does not constitute a high risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official domain (pm.bsc.es), which is not on the standard whitelist but is plausibly the project's own infrastructure; building from official project sources, even on non-whitelisted hosts, is normal for AUR packages and does not constitute a high risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://pm.bsc.es/ftp/${_bundlepkgname}/releases/${_bundlepkgname}-${_bundlepkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Joan Bruguera Micó <joanbrugueram@gmail.com>
    
      2pkgname='mcxx'
    
      3_bundlepkgname='ompss'
    
      4pkgdesc='Mercurium is a C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping developed by the Programming Models group at the Barcelona Supercomputing Center.'
    
      5pkgver='2.3.0.20190627'
    
      6_bundlepkgver='19.06'
    
      7pkgrel='10'
    
      8arch=('x86_64')
    
      9url='https://pm.bsc.es/ompss'
    
      10license=('LGPL-3.0-or-later')
    
      11depends=(nanox gcc-fortran sqlite3)
    
      12makedepends=(python3 gperf)
    
      13source=("https://pm.bsc.es/ftp/${_bundlepkgname}/releases/${_bundlepkgname}-${_bundlepkgver}.tar.gz"
    
      14        # Generated with `git format-patch -5 --stdout 2a98963e7ff28f70cf2a8bcf42a792a1420f36e3`
    
      15        # on the mcxx repository at https://github.com/bsc-pm/mcxx
    
      16        migrate_scripts_to_python3.patch
    
      17        0001-Add-support-for-gperf-3.3.x.patch
    
      18        "0001-Fix-build-with-Python-3.13-exec-eval-changes.patch")
    
      19sha512sums=(159efc17ba446f3f2205a8c0580ed10fab263f8bdb7306d5444d1fc6a592f80d749c03031e7e416090360c36a51a38da083b2b2ed4e75dda5c55a103806d91d2
    
      20            0330f65d18065ed47b9af19cc3100be7b914b720bb5858a59b89473a29ffe32c12d84da6e3c7557a2aa1b0f8bc955c17000e19302724071caa2477eefdc71af1
    
      21            3646fb1fcd20932caaf4653df52fdb0c6ad490643d026d4752692b775bfb571d835f2f46f60604ffe38ac57abcc6975218517d5b822f4acb2855363965939dd3
    
      22            fb59290edcf58b5c70390b462dea4df02f2eae028bed39aea0bb5c17caca6ec4a89e4545b1d4edf9a460c9de868e4b91f42fd7bd54d5fa5ffd98624daeb5003a)
    
      23
    
      24prepare() {
    
      25	cd "$srcdir/${_bundlepkgname}-${_bundlepkgver}/$pkgname-${pkgver%.*}"
    
      26
    
      27	# Backport Python 2 to 3 backports to OmpSs(1)
    
      28	patch -Np1 -i "$srcdir/migrate_scripts_to_python3.patch"
    
      29	patch -Np1 -i "$srcdir/0001-Add-support-for-gperf-3.3.x.patch"
    
      30	autoreconf -fiv
    
      31
    
      32	patch -Np1 -i "$srcdir/0001-Fix-build-with-Python-3.13-exec-eval-changes.patch"
    
      33}
    
      34
    
      35build() {
    
      36	cd "$srcdir/${_bundlepkgname}-${_bundlepkgver}/$pkgname-${pkgver%.*}"
    
      37
    
      38	# WORKAROUND: The sources are outdated compared to Arch's environment,
    
      39	#             so we have to downgrade/disable some things...
    
      40	export LDFLAGS="${LDFLAGS:-} -Wl,--no-as-needed"
    
      41
    
      42	# WORKAROUND: Force gperf files to be regenerated, to avoid build errors
    
      43	#             (declaration mismatches due to unsigned int / gperf_length_t)
    
      44	rm src/driver/cxx-configoptions.c
    
      45	rm src/driver/cxx-debugflags.c
    
      46	rm src/driver/cxx-fileextensions.c
    
      47	rm src/frontend/cxx-asttype-str-internal.h
    
      48	rm src/frontend/fortran/fortran03-keywords.c
    
      49
    
      50	# See https://hub.docker.com/r/bscpm/ompss/dockerfile
    
      51	./configure \
    
      52		--prefix=/usr \
    
      53		--enable-ompss \
    
      54		--with-nanox=/usr
    
      55
    
      56	make
    
      57}
    
      58
    
      59package() {
    
      60	cd "$srcdir/${_bundlepkgname}-${_bundlepkgver}/$pkgname-${pkgver%.*}"
    
      61
    
      62	make DESTDIR="$pkgdir/" install
    
      63}
    
      64

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2