pigz-replace-gzip-static

LOW

maintainer Aleksej 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package builds from source tarballs hosted on the project's official domain (zlib.net) and a trusted GNU mirror; both sources are verifiable and used to compile the software, not execute prebuilt binaries.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source tarballs hosted on the project's official domain (zlib.net) and a trusted GNU mirror; both sources are verifiable and used to compile the software, not execute prebuilt binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=(https://www.zlib.net/$_pkgname/$_pkgname-$pkgver.tar.gz
PKGBUILD:21 https://mirror.truenetwork.ru/gnu/gzip/gzip-${gzip_ver}.tar.gz

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Aleksej Kovura <aur-b1a3 at mekboy dot ru>
    
      2
    
      3pkgname=pigz-replace-gzip-static
    
      4_pkgname=pigz
    
      5gzip_ver=1.14
    
      6pkgver=2.8
    
      7pkgrel=3
    
      8pkgdesc='Parallel gzip compressor, replaces gzip'
    
      9arch=('aarch64' 'x86_64')
    
      10url='https://www.zlib.net/pigz'
    
      11license=('custom')
    
      12makedepends=('zlib-ng-compat-static' 'musl' 'gcc' 'make' 'gzip')
    
      13optdepends=('diffutils: zdiff/zcmp support'
    
      14  'grep: zegrep/zfgrep/zforce/zgrep support'
    
      15  'less: zless support'
    
      16  'util-linux: zmore support'
    
      17  'sh: running zgrep, zless etc')
    
      18conflicts=('gzip' 'pigz')
    
      19provides=('gzip' 'pigz')
    
      20source=(https://www.zlib.net/$_pkgname/$_pkgname-$pkgver.tar.gz
    
      21  https://mirror.truenetwork.ru/gnu/gzip/gzip-${gzip_ver}.tar.gz
    
      22  makefile.patch)
    
      23sha256sums=('eb872b4f0e1f0ebe59c9f7bd8c506c4204893ba6a8492de31df416f0d5170fd0'
    
      24            '613d6ea44f1248d7370c7ccdeee0dd0017a09e6c39de894b3c6f03f981191c6b'
    
      25            'ce30449bea773f266e07ce1d2ca5e790646307f49965b5fff2a526f0fc65b4ab')
    
      26prepare() {
    
      27  cd $_pkgname-$pkgver
    
      28  patch -p1 <../makefile.patch
    
      29  ln -s /usr/include/zlib-ng-compat-static/zconf.h
    
      30  ln -s /usr/include/zlib-ng-compat-static/zlib.h
    
      31  ln -s /usr/include/zlib-ng-compat-static/zlib_name_mangling.h
    
      32  ln -s /usr/lib/zlib-ng-compat-static/libz.a
    
      33}
    
      34build() {
    
      35  make -C $_pkgname-$pkgver CFL="$CFLAGS" LDF="$LDFLAGS" -j $(nproc) pigz
    
      36}
    
      37check() {
    
      38  make -C $_pkgname-$pkgver test
    
      39}
    
      40package() {
    
      41  cd $_pkgname-$pkgver
    
      42  ./pigz pigz.1
    
      43  install -Dm644  -t "$pkgdir"/usr/share/man/man1 pigz.1.gz
    
      44  install -Dm644  -t "$pkgdir"/usr/share/licenses/$_pkgname README
    
      45  install -sDm755 -t "$pkgdir"/usr/bin pigz
    
      46  cd "$pkgdir"/usr/bin
    
      47  ln -s pigz gzip
    
      48  ln -s pigz unpigz
    
      49  cd "$pkgdir"/usr/share/man/man1/
    
      50  ln -s pigz.1.gz gzip.1.gz
    
      51  ln -s pigz.1.gz gunzip.1.gz
    
      52  cd "$srcdir"/gzip-${gzip_ver}
    
      53  ./configure --prefix="$pkgdir"/usr # "build" sh scripts to replace @STUFF@
    
      54  make install-binSCRIPTS
    
      55}
    
      56

Changes since previous scan

--- PKGBUILD @ 2026-09-12 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -4,12 +4,12 @@
 _pkgname=pigz
 gzip_ver=1.14
 pkgver=2.8
-pkgrel=1
+pkgrel=3
 pkgdesc='Parallel gzip compressor, replaces gzip'
 arch=('aarch64' 'x86_64')
 url='https://www.zlib.net/pigz'
 license=('custom')
-makedepends=('zlib' 'musl' 'gcc' 'make' 'gzip')
+makedepends=('zlib-ng-compat-static' 'musl' 'gcc' 'make' 'gzip')
 optdepends=('diffutils: zdiff/zcmp support'
   'grep: zegrep/zfgrep/zforce/zgrep support'
   'less: zless support'
@@ -22,13 +22,14 @@
   makefile.patch)
 sha256sums=('eb872b4f0e1f0ebe59c9f7bd8c506c4204893ba6a8492de31df416f0d5170fd0'
             '613d6ea44f1248d7370c7ccdeee0dd0017a09e6c39de894b3c6f03f981191c6b'
-            'fd1d169755fe351de29461bff3063956bbecded4855c7ebed08e63a9c3ae1eb5')
+            'ce30449bea773f266e07ce1d2ca5e790646307f49965b5fff2a526f0fc65b4ab')
 prepare() {
   cd $_pkgname-$pkgver
   patch -p1 <../makefile.patch
-  ln -s /usr/include/zconf.h
-  ln -s /usr/include/zlib.h
-  ln -s /usr/lib/libz.a
+  ln -s /usr/include/zlib-ng-compat-static/zconf.h
+  ln -s /usr/include/zlib-ng-compat-static/zlib.h
+  ln -s /usr/include/zlib-ng-compat-static/zlib_name_mangling.h
+  ln -s /usr/lib/zlib-ng-compat-static/libz.a
 }
 build() {
   make -C $_pkgname-$pkgver CFL="$CFLAGS" LDF="$LDFLAGS" -j $(nproc) pigz

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 15:12:25	Medium	1
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2