p2c

maintainer severach · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads the source code from a non-whitelisted but plausible personal academic host (users.fred.net) for a legitimate software project; it builds from source without executing untrusted binaries, and the worst case of a malicious swap would be code execution during build, which is typical for AUR packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the source code from a non-whitelisted but plausible personal academic host (users.fred.net) for a legitimate software project; it builds from source without executing untrusted binaries, and the worst case of a malicious swap would be code execution during build, which is typical for AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 source=("http://users.fred.net/tds/lab/p2c/${_srcdir}.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Chris Severance aur.severach aATt spamgourmet dott com
    
      2# Contributor: tardo <tardo@nagi-fanboi.net>
    
      3# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
    
      4
    
      5_opt_32bit=0
    
      6
    
      7set -u
    
      8pkgname='p2c'
    
      9pkgver='2.02'
    
      10pkgrel='1'
    
      11pkgdesc='Pascal to C/C++ translator converter'
    
      12arch=('x86_64')
    
      13#url="http://packages.debian.org/sid/p2c"
    
      14#url='https://schneider.ncifcrf.gov/p2c/'
    
      15url='http://users.fred.net/tds/lab/p2c/'
    
      16license=('GPL')
    
      17depends=('perl')
    
      18if [ "${_opt_32bit}" -ne 0 ]; then
    
      19  depends_x86_64+=('lib32-glibc')
    
      20  makedepends_x86_64+=('lib32-gcc-libs')
    
      21fi
    
      22#  http://ftp.debian.org/debian/pool/main/p/p2c/p2c_${pkgver}-3.diff.gz)
    
      23#source=("http://www.ccrnp.ncifcrf.gov/~toms/p2c/p2c-${pkgver}.tar.gz")
    
      24#source=('https://alum.mit.edu/www/toms/p2c/p2c-2.01.tar.gz
    
      25_srcdir="${pkgname}-${pkgver}"
    
      26#source=("https://schneider.ncifcrf.gov/p2c/${_srcdir}.tar.gz")
    
      27#source=("https://alum.mit.edu/www/toms/p2c/${_srcdir}.tar.gz")
    
      28source=("http://users.fred.net/tds/lab/p2c/${_srcdir}.zip")
    
      29_srcdir="${_srcdir/./-ZIPPERDOT-}"
    
      30source+=(
    
      31  '0000-make-install.patch'
    
      32  '0000-make-install-again.patch'
    
      33  '0001-trans.c-unistd.h-link-unlink.patch'
    
      34  '0002-makefile-32bit-compile.patch'
    
      35  '0003-sys.p2crc-MainType-int.patch'
    
      36  '1000-examples-Makefile-change-binaries.patch'
    
      37  '0004-_OutMem-64-bit-compile.patch'
    
      38)
    
      39#options=('!strip')
    
      40md5sums=('b379caf316c357ab5c0bc4934aa6ae25'
    
      41         '3cf28ada6f5935e5ce7eb6515fd429ef'
    
      42         'c52f03457709e7e968debd3b9c93a7a6'
    
      43         'bd21f009fbbf835ac2803efd44bb280f'
    
      44         'e460eaf157a46f8411eec730e05aea24'
    
      45         '0cccd2e48b606e9299a3938103a373b6'
    
      46         '488836c68b8abd8bd1f6ca91d1ced545'
    
      47         '85a7f53c671145bb9bc85fbbe80f53d2')
    
      48sha256sums=('baa322b12e477af38c767be0406b5e7ca2fa4c26ae2f80f4bc2889bf36d0069f'
    
      49            'a1dd6995cb13e87bbf6f707224c1a58fbebe9101aeccd7ba3aca0e760950773a'
    
      50            '174664a05674b4cc86d995d520c9d67caf6fe5b81c920666deb4b7b30571f8c1'
    
      51            'cceb0a5fbb104741c75cca10ed9a7389d14ae428f3dc957a2b442cf6d45f4685'
    
      52            '5b70fbfbc0a6c922bc3c2e1e339fcbe727cfccec037e04bc792c5cd72289f884'
    
      53            'ecdc91610006f5ae75a1fa4cf9cbfe4a492a99704034d33fd72a71bb8378adc5'
    
      54            '1e06200380e6350b083c94d6b90a24a41fad8b6f0f8b9d2d9c3d8131ea50a49f'
    
      55            '1ae3ce087e662ffd8807139343f6835ca916beb88e819f459c4994de980d3883')
    
      56_checkdir="${_srcdir}/check"
    
      57
    
      58prepare() {
    
      59  set -u
    
      60  cd "${_srcdir}"
    
      61
    
      62  # Fix the permissions
    
      63  find -type 'd' -exec chmod 755 '{}' '+'
    
      64  find -type 'f' -exec chmod 644 '{}' '+'
    
      65
    
      66  # Remove supplied binaries
    
      67  make -C 'src' clean # this deletes p2c.hdrs which we need
    
      68  rm -f 'src/makeproto' 'src/p2cc' 'src/libp2c.a'
    
      69
    
      70  #patch -Np2 -i '../p2c_${pkgver}-3.diff'
    
      71  #sed -e 's:getline:xgetline:' -i *.c *.hdrs
    
      72
    
      73  if [ "$(vercmp "${pkgver}" "2.01")" -le 0 ]; then
    
      74    # Add includes to get rid of some warnings
    
      75    sed -e '/^#include <stdio.h>/ a #include <stdlib.h>' -i 'src/makeproto.c'
    
      76  fi
    
      77
    
      78  local _patches=()
    
      79  # _patches+=("0000-make-install.patch") # The mess in make install is too big to fix with sed
    
      80  # Make package compatible
    
      81  # Fix high thread count make
    
      82  # Set LDFLAGS
    
      83  _patches+=('0000-make-install-again.patch')
    
      84  _patches+=('0001-trans.c-unistd.h-link-unlink.patch') # Switch to built in link,unlink declarations
    
      85  if [ "${_opt_32bit}" -ne 0 ]; then
    
      86    _patches+=('0002-makefile-32bit-compile.patch')
    
      87  fi
    
      88  _patches+=('0003-sys.p2crc-MainType-int.patch') # Get rid of a generated code warning
    
      89  _patches+=('0004-_OutMem-64-bit-compile.patch') # Fix warning in 64 bit generated code
    
      90
    
      91  # get rid of home for make test examples check()
    
      92  rm -r "../${_srcdir}/home/"
    
      93
    
      94  # make clean for examples
    
      95  rm 'examples/basic' 'examples/cref' 'examples/e' 'examples/fact' 'examples/self' examples/*.c
    
      96  rm -r 'examples/c/'
    
      97
    
      98  _patches+=('1000-examples-Makefile-change-binaries.patch') # point examples check to the just compiled test version
    
      99
    
      100  local _pt _ptf=() _pts=()
    
      101  for _pt in "${_patches[@]}"; do
    
      102    set +u; msg2 "Patch ${_pt}"; set -u
    
      103    if patch -Nufp1 --no-backup-if-mismatch -i "${srcdir}/${_pt}"; then
    
      104      _pts+=("${_pt}")
    
      105    else
    
      106      _ptf+=("${_pt}")
    
      107    fi
    
      108  done
    
      109  if [ "${#_ptf[@]}" -gt 0 ]; then
    
      110     if [ "${#_pts[@]}" -gt 0 ]; then
    
      111       printf 'Patch success %s\n' "${_pts[@]}"
    
      112       printf 'Warning: Some old patches may need to be removed even if they are successful\n'
    
      113     fi
    
      114     printf 'Patch failed %s\n' "${_ptf[@]}"
    
      115     set +x
    
      116     false
    
      117  fi
    
      118  #cd '..'; cp -pr "${_srcdir}" 'a'; ln -s "${_srcdir}" 'b'; false
    
      119  # diff -pNaru5 'a' 'b' > "0000-$RANDOM.patch"
    
      120
    
      121  if [ "${_opt_32bit}" -ne 0 ]; then
    
      122    sed -e '# 32 bit compile' \
    
      123        -e 's:\$(CC) :&-m32 :g' \
    
      124    -i 'examples/Makefile'
    
      125  fi
    
      126  sed -e '# Reduce standard for gets' \
    
      127      -e 's:\$(CC) :&-ansi -Wno-deprecated-declarations :g' \
    
      128  -i 'examples/Makefile'
    
      129 set +u
    
      130}
    
      131
    
      132build() {
    
      133  set -u
    
      134  cd "${_srcdir}"
    
      135  local _opts='-Wno-error=incompatible-pointer-types -std=gnu17'
    
      136  set +u; msg2 'make check() executable'; set -u
    
      137  make -C 'src' OPT="-O2 -s ${_opts}" ABSHOMEDIR="${srcdir}/${_checkdir}/usr/lib/p2c"
    
      138  mv src/p2c{,_test}
    
      139  make -C 'src' newhome
    
      140  set +u; msg2 'make package() executable'; set -u
    
      141  make -C 'src' OPT="-O2 -s ${_opts}"
    
      142  set +u
    
      143}
    
      144
    
      145check() {
    
      146  cd "${_srcdir}"
    
      147  # switching from /usr/include/p2c to any other dir unhides warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
    
      148  # we fix this by compiling -m32 where sizeof(int)==sizeof(void *)
    
      149  make -C 'src' install DESTDIR="${srcdir}/${_checkdir}"
    
      150  install -p 'src/p2c_test' "${srcdir}/${_checkdir}/usr/bin/p2c"
    
      151  make -C 'examples'
    
      152  rm -r "${srcdir}/${_checkdir}"
    
      153}
    
      154
    
      155package() {
    
      156  set -u
    
      157  cd "${_srcdir}"
    
      158  make -j1 -C 'src' install DESTDIR="${pkgdir}"
    
      159  chmod 644 "${pkgdir}/usr/lib"/*.a
    
      160  set +u
    
      161}
    
      162set +u
    
      163

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2