mingw-w64-boost

LOW

maintainer xantares 19 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The source is a tarball from the official boost.org domain, which is the project's legitimate release infrastructure; building from this source is standard practice and the non-whitelisted host is actually the project's own, making it low risk despite the static analyzer flag.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official boost.org domain, which is the project's legitimate release infrastructure; building from this source is standard practice and the non-whitelisted host is actually the project's own, making it low risk despite the static analyzer flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://archives.boost.io/release/${pkgver}/source/boost_${_boostver}.tar.bz2")

PKGBUILD

1 offending line(s) highlighted

      1pkgname=mingw-w64-boost
    
      2pkgver=1.92.0
    
      3_boostver=${pkgver//./_}
    
      4pkgrel=1
    
      5pkgdesc="Free peer-reviewed portable C++ source libraries (mingw-w64)"
    
      6arch=('any')
    
      7url="http://www.boost.org/"
    
      8license=('BSL-1.0')
    
      9depends=('mingw-w64-zlib' 'mingw-w64-zstd' 'mingw-w64-bzip2' 'mingw-w64-dlfcn')
    
      10makedepends=('mingw-w64-gcc' 'mingw-w64-wine' 'mingw-w64-environment')
    
      11options=('!strip' '!buildflags' 'staticlibs')
    
      12source=("https://archives.boost.io/release/${pkgver}/source/boost_${_boostver}.tar.bz2")
    
      13sha256sums=('5c1d40cb8e19adbf740a4ec2da35b3e58f3f5804b1dce44deb53df72193cbc6c')
    
      14
    
      15_architectures="32:i686-w64-mingw32 64:x86_64-w64-mingw32"
    
      16
    
      17prepare() {
    
      18  # https://github.com/boostorg/cobalt/commit/cba276884d3fc5509475910283091a0031970f1f
    
      19  curl -L https://github.com/boostorg/cobalt/commit/cba2768.patch | patch -p1 -d boost_${_boostver}/libs/cobalt
    
      20
    
      21  for _arch in ${_architectures}; do
    
      22    source mingw-env "${_arch:3}"
    
      23
    
      24    rm -rf build-${_arch:3}
    
      25    cp -r boost_${_boostver} build-${_arch:3}
    
      26    pushd build-${_arch:3}
    
      27
    
      28    cat > user-config.jam << EOF
    
      29using gcc : mingw64 : ${CXX}
    
      30        :
    
      31        <rc>${_arch:3}-windres
    
      32        <archiver>${_arch:3}-ar
    
      33;
    
      34EOF
    
      35    ./bootstrap.sh --with-toolset=gcc
    
      36    popd
    
      37  done
    
      38}
    
      39
    
      40package() {
    
      41  cd "${srcdir}"
    
      42  for _arch in ${_architectures}; do
    
      43    source mingw-env "${_arch:3}"
    
      44    pushd "build-${_arch:3}"
    
      45    LD_PRELOAD="" ./b2 -d2 -q ${MAKEFLAGS} \
    
      46      target-os=windows \
    
      47      variant=release \
    
      48      threading=multi \
    
      49      threadapi=win32 \
    
      50      link=shared,static \
    
      51      runtime-link=shared \
    
      52      --prefix=${pkgdir}/usr/${_arch:3} \
    
      53      --user-config=user-config.jam \
    
      54      --without-python --without-mpi --without-graph_parallel \
    
      55      cxxflags="${CXXFLAGS}" \
    
      56      linkflags="${LDFLAGS}" \
    
      57      address-model=${_arch:0:2} \
    
      58      architecture=x86 \
    
      59      binary-format=pe \
    
      60      abi=ms \
    
      61      -l0 ${MAKEFLAGS} \
    
      62      --layout=system install
    
      63    install -d $pkgdir/usr/${_arch:3}/bin
    
      64    ${_arch:3}-strip --strip-unneeded "$pkgdir"/usr/${_arch:3}/bin/*.dll
    
      65    ${_arch:3}-strip -g "$pkgdir"/usr/${_arch:3}/lib/*.a
    
      66    popd
    
      67  done
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2