morphos-cross-bin

LOW

maintainer metaneutrons 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The prebuilt cross-compiler binaries come from the project's own GitHub release assets (verifiable with sha256sums), and the MorphOS SDK .lha is downloaded from the official morphos-team.net site with a checksum; the only mild concern is that a prebuilt binary is executed at package time, but it originates from the maintainer's own project infrastructure and all checksums are present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The prebuilt cross-compiler binaries come from the project's own GitHub release assets (verifiable with sha256sums), and the MorphOS SDK .lha is downloaded from the official morphos-team.net site with a checksum; the only mild concern is that a prebuilt binary is executed at package time, but it originates from the maintainer's own project infrastructure and all checksums are present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("sdk-20260529.lha::https://morphos-team.net/files/sdk-20260529.lha")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Fabian Schmieder <fabian@schmieder.eu>
    
      2pkgname=morphos-cross-bin
    
      3pkgver=20260529
    
      4pkgrel=4
    
      5pkgdesc="GCC 15 cross-compiler toolchain for MorphOS (PowerPC), with the MorphOS SDK"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/metaneutrons/morphos-cross"
    
      8license=('GPL-3.0-or-later' 'LicenseRef-MorphOS-SDK')
    
      9depends=('glibc')
    
      10makedepends=('libarchive')
    
      11provides=('morphos-cross')
    
      12conflicts=('morphos-cross')
    
      13# The toolchain is a tree that must stay as built, and its target files are PowerPC code: makepkg would
    
      14# run the host's strip over them.
    
      15options=('!strip' '!debug' '!lto' 'staticlibs')
    
      16source=("sdk-20260529.lha::https://morphos-team.net/files/sdk-20260529.lha")
    
      17source_x86_64=("morphos-cross-20260529-r4-linux-x86_64.tar.xz::https://github.com/metaneutrons/morphos-cross/releases/download/v20260529-r4/morphos-cross-20260529-r4-linux-x86_64.tar.xz")
    
      18source_aarch64=("morphos-cross-20260529-r4-linux-arm64.tar.xz::https://github.com/metaneutrons/morphos-cross/releases/download/v20260529-r4/morphos-cross-20260529-r4-linux-arm64.tar.xz")
    
      19noextract=("sdk-20260529.lha")
    
      20sha256sums=('310dfb888b995e32206c5c3aba409847334a5fee049d13aad27b4af0d518ec77')
    
      21sha256sums_x86_64=('f35e54072b7c36b00e3901669cfc4ac3fa3df805c3117e0d5f3f22f3379caab6')
    
      22sha256sums_aarch64=('c992707004fc2c854f4a6b13a3975640899821bae35ca3bf5b837b2931bb06ca')
    
      23
    
      24# The MorphOS SDK belongs to the MorphOS Team. makepkg downloads it from their site for the user, so that
    
      25# this recipe never distributes it, and the toolchain's own helper installs it into the package.
    
      26package() {
    
      27    local tree="$pkgdir/opt/morphos-cross" tool
    
      28    install -d "$pkgdir/opt" "$pkgdir/usr/bin"
    
      29    cp -a "$srcdir/morphos-cross" "$tree"
    
      30    "$tree/bin/morphos-cross-sdk" install "$srcdir/sdk-20260529.lha"
    
      31    for tool in "$tree/bin/"*; do
    
      32        ln -s "/opt/morphos-cross/bin/${tool##*/}" "$pkgdir/usr/bin/${tool##*/}"
    
      33    done
    
      34    install -Dm644 "$tree/share/doc/morphos-cross/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      35    install -Dm644 "$tree/share/doc/morphos-cross/THIRD-PARTY.md" "$pkgdir/usr/share/licenses/$pkgname/THIRD-PARTY.md"
    
      36    bsdtar -xOf "$srcdir/sdk-20260529.lha" morphossdk/Readme.txt > "$pkgdir/usr/share/licenses/$pkgname/MorphOS-SDK-Readme.txt"
    
      37}
    
      38

Changes since previous scan

--- PKGBUILD @ 2026-10-15 21:16
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,7 @@
 # Maintainer: Fabian Schmieder <fabian@schmieder.eu>
 pkgname=morphos-cross-bin
 pkgver=20260529
-pkgrel=3
+pkgrel=4
 pkgdesc="GCC 15 cross-compiler toolchain for MorphOS (PowerPC), with the MorphOS SDK"
 arch=('x86_64' 'aarch64')
 url="https://github.com/metaneutrons/morphos-cross"
@@ -14,12 +14,12 @@
 # run the host's strip over them.
 options=('!strip' '!debug' '!lto' 'staticlibs')
 source=("sdk-20260529.lha::https://morphos-team.net/files/sdk-20260529.lha")
-source_x86_64=("morphos-cross-20260529-r3-linux-x86_64.tar.xz::https://github.com/metaneutrons/morphos-cross/releases/download/v20260529-r3/morphos-cross-20260529-r3-linux-x86_64.tar.xz")
-source_aarch64=("morphos-cross-20260529-r3-linux-arm64.tar.xz::https://github.com/metaneutrons/morphos-cross/releases/download/v20260529-r3/morphos-cross-20260529-r3-linux-arm64.tar.xz")
+source_x86_64=("morphos-cross-20260529-r4-linux-x86_64.tar.xz::https://github.com/metaneutrons/morphos-cross/releases/download/v20260529-r4/morphos-cross-20260529-r4-linux-x86_64.tar.xz")
+source_aarch64=("morphos-cross-20260529-r4-linux-arm64.tar.xz::https://github.com/metaneutrons/morphos-cross/releases/download/v20260529-r4/morphos-cross-20260529-r4-linux-arm64.tar.xz")
 noextract=("sdk-20260529.lha")
 sha256sums=('310dfb888b995e32206c5c3aba409847334a5fee049d13aad27b4af0d518ec77')
-sha256sums_x86_64=('bfcd7145d1f7cd7b8aee8e1a14bc0cc33dec8d84a06f2294480b9c71d4912998')
-sha256sums_aarch64=('1a5c5d0038cfe96da62a62728867b1e38aa0b7a830dc0c64141989600768d10e')
+sha256sums_x86_64=('f35e54072b7c36b00e3901669cfc4ac3fa3df805c3117e0d5f3f22f3379caab6')
+sha256sums_aarch64=('c992707004fc2c854f4a6b13a3975640899821bae35ca3bf5b837b2931bb06ca')
 
 # The MorphOS SDK belongs to the MorphOS Team. makepkg downloads it from their site for the user, so that
 # this recipe never distributes it, and the toolchain's own helper installs it into the package.

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 23:16:14	Low	3
2026-10-15 23:13:54	Medium	2
2026-10-15 21:16:57	Low	3
2026-10-15 21:13:25	Medium	2