osxcross-git

LOW

maintainer swyter 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads an SDK archive from web.archive.org, a non-standard host, but this is a static data artifact necessary for building the toolchain; the source is not executed directly, and the rest of the build uses the legitimate upstream git repository, making the risk low despite the unverifiable checksum.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads an SDK archive from web.archive.org, a non-standard host, but this is a static data artifact necessary for building the toolchain; the source is not executed directly, and the rest of the build uses the legitimate upstream git repository, making the risk low despite the unverifiable checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "https://web.archive.org/https://s3.dockerproject.org/darwin/v2/${_sdkname}.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: emersion <contact@emersion.fr>
    
      2# Maintainer: swyter <swyterzone+aur@gmail.com>
    
      3# Contributor: @RandoOnSteam
    
      4pkgname=osxcross-git
    
      5_pkgname=${pkgname%-git}
    
      6_sdkname=MacOSX10.11.sdk # swy: choose your SDK version here
    
      7pkgver=0.17
    
      8pkgrel=3
    
      9pkgdesc="macOS cross-compiling toolchain for Linux, FreeBSD and NetBSD"
    
      10arch=('x86_64')
    
      11url="https://github.com/tpoechtrager/osxcross"
    
      12license=('MIT')
    
      13depends=('clang>=3.2')
    
      14makedepends=('patch' 'libxml2' 'bash' 'git' 'cmake')
    
      15optdepends=(
    
      16	'llvm: for Link Time Optimization support and ld64 -bitcode_bundle support'
    
      17	'uuid: for ld64 -random_uuid support'
    
      18	'xar: for ld64 -bitcode_bundle support'
    
      19)
    
      20provides=("$_pkgname" xar)
    
      21conflicts=("$_pkgname" xar apple-darwin-osxcross)
    
      22source=(
    
      23	'git+https://github.com/tpoechtrager/osxcross.git'
    
      24	"https://web.archive.org/https://s3.dockerproject.org/darwin/v2/${_sdkname}.tar.xz"
    
      25
    
      26	# swy: this repository by an anonymous individual seems to have pre-bundled versions of the other SDKs,
    
      27	#      in case you want to change $_sdkname and use a newer version, comment the URL above and uncomment this one
    
      28	#      or pack your own if you don't trust the unofficial source, which I can understand.
    
      29	#"https://github.com/phracker/MacOSX-SDKs/releases/latest/download/${_sdkname}.tar.xz"
    
      30)
    
      31md5sums=('SKIP' 'b0d81b95746c7e698c39c7df1e15ca7d')
    
      32noextract=("${_sdkname}.tar.xz")
    
      33options=('!strip' '!lto')
    
      34install="$pkgname.install"
    
      35
    
      36# https://github.com/tpoechtrager/cctools-port/issues/108
    
      37CXXFLAGS="$CXXFLAGS -U_GLIBCXX_ASSERTIONS -Wp,-U_GLIBCXX_ASSERTIONS"
    
      38
    
      39prepare() {
    
      40	cd "$srcdir/$_pkgname"
    
      41	mv "../${_sdkname}.tar.xz" tarballs/
    
      42}
    
      43
    
      44build() {
    
      45	cd "$srcdir/$_pkgname"
    
      46
    
      47	# Explicitly use system Clang/LLVM to avoid linker confusion
    
      48	export CC=clang
    
      49	export CXX=clang++
    
      50
    
      51	# swy: put all the generated files in there
    
      52	export OSXCROSS_TARGET_DIR="$srcdir/usr/local/osx-ndk-x86"; mkdir -p "$OSXCROSS_TARGET_DIR"
    
      53	sed -i -s "s|export TARGET_DIR\=|export TARGET_DIR\='${OSXCROSS_TARGET_DIR}' #|" "./tools/tools.sh"
    
      54
    
      55	# swy: use almost all available processor cores, for compiling speed. Leave a spare one.
    
      56	JOBS=$(( `nproc` - 1 )) UNATTENDED=yes OSX_VERSION_MIN=10.6  ./build.sh # OCDEBUG=1
    
      57}
    
      58
    
      59package() {
    
      60	cd "$srcdir/$_pkgname"
    
      61
    
      62	# swy: copy them over, as we can't seemingly use $pkgdir in build()
    
      63	mv "$srcdir/usr/" "$pkgdir/usr/"
    
      64
    
      65	# swy: as this package conflicts with «xar», make that un/packing tool widely available with a symlink
    
      66	mkdir -p "$pkgdir/usr/bin"; ln -s "$pkgdir/usr/local/osx-ndk-x86/bin/xar" "$pkgdir/usr/bin/xar"
    
      67
    
      68	# swy: make sure the cross-compiled binaries can locate the .so dependencies stored aside in every
    
      69	#      case without having to set funky environment variables or patching every .elf's RUNPATH
    
      70	mkdir -p "$pkgdir/etc/ld.so.conf.d/"
    
      71	echo '/usr/local/osx-ndk-x86/lib' > "$pkgdir/etc/ld.so.conf.d/osxcross.conf"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2