pigz-replace-gzip-static
maintainer Aleksej
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads source tarballs from the official zlib.net and a mirror of gnu.org (mirror.truenetwork.ru), both plausibly legitimate; the latter is not on a whitelist but hosts official GNU software, and the sources are verified via sha256sums, making supply-chain compromise unlikely.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source tarballs from the official zlib.net and a mirror of gnu.org (mirror.truenetwork.ru), both plausibly legitimate; the latter is not on a whitelist but hosts official GNU software, and the sources are verified via sha256sums, making supply-chain compromise unlikely.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:20
source=(https://www.zlib.net/$_pkgname/$_pkgname-$pkgver.tar.gz -
PKGBUILD:21
https://mirror.truenetwork.ru/gnu/gzip/gzip-${gzip_ver}.tar.gz
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Aleksej Kovura <aur-b1a3 at mekboy dot ru>
2
3
pkgname=pigz-replace-gzip-static
4
_pkgname=pigz
5
gzip_ver=1.14
6
pkgver=2.8
7
pkgrel=1
8
pkgdesc='Parallel gzip compressor, replaces gzip'
9
arch=('aarch64' 'x86_64')
10
url='https://www.zlib.net/pigz'
11
license=('custom')
12
makedepends=('zlib' 'musl' 'gcc' 'make' 'gzip')
13
optdepends=('diffutils: zdiff/zcmp support'
14
'grep: zegrep/zfgrep/zforce/zgrep support'
15
'less: zless support'
16
'util-linux: zmore support'
17
'sh: running zgrep, zless etc')
18
conflicts=('gzip' 'pigz')
19
provides=('gzip' 'pigz')
20
source=(https://www.zlib.net/$_pkgname/$_pkgname-$pkgver.tar.gz
21
https://mirror.truenetwork.ru/gnu/gzip/gzip-${gzip_ver}.tar.gz
22
makefile.patch)
23
sha256sums=('eb872b4f0e1f0ebe59c9f7bd8c506c4204893ba6a8492de31df416f0d5170fd0'
24
'613d6ea44f1248d7370c7ccdeee0dd0017a09e6c39de894b3c6f03f981191c6b'
25
'fd1d169755fe351de29461bff3063956bbecded4855c7ebed08e63a9c3ae1eb5')
26
prepare() {
27
cd $_pkgname-$pkgver
28
patch -p1 <../makefile.patch
29
ln -s /usr/include/zconf.h
30
ln -s /usr/include/zlib.h
31
ln -s /usr/lib/libz.a
32
}
33
build() {
34
make -C $_pkgname-$pkgver CFL="$CFLAGS" LDF="$LDFLAGS" -j $(nproc) pigz
35
}
36
check() {
37
make -C $_pkgname-$pkgver test
38
}
39
package() {
40
cd $_pkgname-$pkgver
41
./pigz pigz.1
42
install -Dm644 -t "$pkgdir"/usr/share/man/man1 pigz.1.gz
43
install -Dm644 -t "$pkgdir"/usr/share/licenses/$_pkgname README
44
install -sDm755 -t "$pkgdir"/usr/bin pigz
45
cd "$pkgdir"/usr/bin
46
ln -s pigz gzip
47
ln -s pigz unpigz
48
cd "$pkgdir"/usr/share/man/man1/
49
ln -s pigz.1.gz gzip.1.gz
50
ln -s pigz.1.gz gunzip.1.gz
51
cd "$srcdir"/gzip-${gzip_ver}
52
./configure --prefix="$pkgdir"/usr # "build" sh scripts to replace @STUFF@
53
make install-binSCRIPTS
54
}
55
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |