◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

powerpc-none-eabi-toolchain

maintainer CalebW · 1 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package builds a toolchain from source using official GNU project Git repositories with pinned commits; the non-whitelisted hosts are legitimate project forges, and SKIP'd checksums are acceptable for Git sources, making this a standard AUR build with low risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds a toolchain from source using official GNU project Git repositories with pinned commits; the non-whitelisted hosts are legitimate project forges, and SKIP'd checksums are acceptable for Git sources, making this a standard AUR build with low risk.

2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:20 source=(git+https://sourceware.org/git/binutils-gdb.git#commit=${_binutils_commit}
MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Caleb Whitmer <caleb.s.whitmer+aur@gmail.com>
2
3_arch=powerpc
4_target=$_arch-none-eabi
5pkgname=$_target-toolchain
6pkgver=20230502
7pkgrel=2
8pkgdesc="A complete gcc/binutils/newlib toolchain for $_target"
9depends=('zlib' 'bash' 'libmpc' 'libisl')
10url="http://www.gnu.org"
11arch=('x86_64')
12depends=(libelf)
13makedepends=(git)
14license=('GPL' 'BSD')
15options=('!strip')
16_binutils_commit=594dcc92e8d1f6bb30e3dfa4eb343febcda66f1a
17_gcc_commit=ffc6b225c955a3d8478de1beba5ad08a7396648c
18_newlib_commit=ab49db3a8c08e2240e53d8f12d6a14fd285def4e
19
20source=(git+https://sourceware.org/git/binutils-gdb.git#commit=${_binutils_commit}
21 git+https://gcc.gnu.org/git/gcc.git#commit=${_gcc_commit}
22 git+https://sourceware.org/git/newlib-cygwin.git#commit=${_newlib_commit}
23)
24sha256sums=('SKIP'
25 'SKIP'
26 'SKIP')
27
28CFLAGS=${CFLAGS/-Werror=format-security/}
29CXXFLAGS=${CXXFLAGS/-Werror=format-security/}
30CFLAGS=${CFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}
31CXXFLAGS=${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}
32CFLAGS=${CFLAGS/-D_GLIBCXX_ASSERTIONS/}
33CXXFLAGS=${CXXFLAGS/-D_GLIBCXX_ASSERTIONS/}
34
35prepare() {
36 cd "${srcdir}"/binutils-gdb
37
38 # Fix Python 3.13+ compatibility by using stable GIL APIs instead of deprecated internal variables
39 if [ -f gdb/python/py-gdb-readline.c ]; then
40 sed -i 's/PyEval_RestoreThread (_PyOS_ReadlineTState);/PyGILState_STATE gil_state = PyGILState_Ensure ();/' gdb/python/py-gdb-readline.c
41 sed -i 's/PyEval_SaveThread ();/PyGILState_Release (gil_state);/' gdb/python/py-gdb-readline.c
42 fi
43
44 # Force Autoconf's C++11 macros to always report success
45 find "$srcdir" -name configure -exec sed -i 's/ax_cv_cxx_compile_cxx11=no/ax_cv_cxx_compile_cxx11=yes/g' {} +
46 find "$srcdir" -name configure -exec sed -i 's/as_fn_error $? "C++11 is required"/echo "Bypassing C++11 check"/g' {} +
47
48 # Cleanly sequence gnulib and local configs at the top of every simulator file
49 # This satisfies gnulib's ordering rule and prevents macro collisions
50 find sim/ppc -name "*.c" -exec sed -i '1s/^/#include "..\/..\/gnulib\/config.h"\n#undef PACKAGE_NAME\n#undef PACKAGE_STRING\n#undef PACKAGE_TARNAME\n#undef PACKAGE_VERSION\n#include "config.h"\n/' {} +
51
52 # Neutralize WERROR variables inside the legacy PPC simulator's Makefile template
53 if [ -f sim/ppc/Makefile.in ]; then
54 sed -i 's/WERROR_CFLAGS =.*/WERROR_CFLAGS = -Wno-error/g' sim/ppc/Makefile.in
55 fi
56
57 for i in gcc fixincludes libcody libcpp libgcc libstdc++-v3; do ln -snfv ../gcc/$i; done
58 for i in newlib libgloss; do ln -snfv ../newlib-cygwin/$i; done
59
60 # Revert any messy edits from previous runs
61 git checkout -- include/safe-ctype.h 2>/dev/null || true
62 (cd ../gcc && git checkout -- include/safe-ctype.h 2>/dev/null) || true
63
64 # Append undefs to the END of safe-ctype.h to protect C++ compilation units
65 for file in include/safe-ctype.h ../gcc/include/safe-ctype.h; do
66 if [ -f "$file" ]; then
67 cat << 'EOF' >> "$file"
68
69#ifdef __cplusplus
70# undef isalpha
71# undef isdigit
72# undef islower
73# undef isspace
74# undef isupper
75# undef isxdigit
76# undef isalnum
77# undef isprint
78# undef isgraph
79# undef iscntrl
80# undef isascii
81# undef tolower
82# undef toupper
83#endif
84EOF
85 fi
86 done
87
88 mkdir -p "${srcdir}/obj"
89}
90
91build()
92{
93 cd "${srcdir}"/obj
94
95 local DEF_CFLAGS="$CFLAGS -std=gnu17 -D_GNU_SOURCE -Wno-error -Wno-incompatible-pointer-types -Wno-int-conversion -Wno-implicit-function-declaration -Wno-discarded-qualifiers -Wno-old-style-definition -Wno-return-mismatch"
96 local DEF_CXXFLAGS="$CXXFLAGS -std=gnu++17 -D_GNU_SOURCE -Wno-error -Wno-template-id-cdtor -fno-char8_t"
97
98 export MAKEFLAGS="-j$(nproc)"
99
100 "${srcdir}"/binutils-gdb/configure \
101 --prefix=/usr \
102 --libexecdir=/usr/lib \
103 --target=${_target} \
104 --disable-werror \
105 --enable-languages=c,c++ \
106 --disable-libstdcxx-pch \
107 --with-newlib \
108 --with-libgloss \
109 --with-system-zlib \
110 --disable-nls \
111 --enable-plugins \
112 --enable-deterministic-archives \
113 --enable-relro \
114 --enable-__cxa_atexit \
115 --enable-linker-build-id \
116 --enable-plugin \
117 --enable-checking=release \
118 --enable-host-shared \
119 --disable-libssp \
120 --disable-libunwind-exceptions \
121 --disable-source-highlight \
122 --with-system-readline \
123 CC="gcc" \
124 CXX="g++" \
125 CFLAGS="$DEF_CFLAGS" \
126 CXXFLAGS="$DEF_CXXFLAGS" \
127 SIM_CFLAGS="-include config.h" \
128 WARN_CFLAGS="-include config.h"
129
130 make
131}
132
133package()
134{
135 cd "${srcdir}/obj"
136 make install DESTDIR="${pkgdir}" -j1
137 rm -rf "${pkgdir}"/usr/share
138 rm -rf "${pkgdir}"/usr/include
139 rm -rf "${pkgdir}"/usr/lib/libcc1.*
140 rm -rf "${pkgdir}"/usr/lib/bfd-plugins
141 find "${pkgdir}" -name '*.py' -delete
142
143
144 # local variable is scoped to the function, for general tidiness.
145 local regex='ELF ().*(executable|shared object).*'
146 # read null-terminated filenames from stdin, and use a while loop to operate on each one
147 # for each run of the loop, the filename is stored in the intuitive variable "filename". :)
148 while read -r -d '' filename; do
149 # test if the output of `file` matches the regular expression defined earlier
150 if [[ $(file -b "$filename") =~ $regex ]]; then
151 # awesome, it matches! So, do the standard strip routine since this isn't an $_target executable
152 strip --strip-unneeded "$filename"
153 fi
154 # this find command uses process substitution to pass the output of find into the `while read` loop
155 done < <(find "$pkgdir" -type f -print0)
156
157 find "${pkgdir}/usr/lib/gcc/${_target}" "${pkgdir}/usr/${_target}/lib" -type f -name '*.o' -o -name '*.a' -exec "${pkgdir}"/usr/bin/${_target}-strip -g {} +
158
159}
160

Changes since previous scan

--- PKGBUILD @ 2026-07-24 00:02
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,10 +1,10 @@
-# Maintainer: Christer Solskogen <christer.solskogen@gmail.com
+# Maintainer: Caleb Whitmer <caleb.s.whitmer+aur@gmail.com>
_arch=powerpc
_target=$_arch-none-eabi
pkgname=$_target-toolchain
pkgver=20230502
-pkgrel=1
+pkgrel=2
pkgdesc="A complete gcc/binutils/newlib toolchain for $_target"
depends=('zlib' 'bash' 'libmpc' 'libisl')
url="http://www.gnu.org"
@@ -18,8 +18,8 @@
_newlib_commit=ab49db3a8c08e2240e53d8f12d6a14fd285def4e
source=(git+https://sourceware.org/git/binutils-gdb.git#commit=${_binutils_commit}
- git+https://gcc.gnu.org/git/gcc.git#commit=${_gcc_commit}
- git+https://sourceware.org/git/newlib-cygwin.git#commit=${_newlib_commit}
+ git+https://gcc.gnu.org/git/gcc.git#commit=${_gcc_commit}
+ git+https://sourceware.org/git/newlib-cygwin.git#commit=${_newlib_commit}
)
sha256sums=('SKIP'
'SKIP'
@@ -27,52 +27,134 @@
CFLAGS=${CFLAGS/-Werror=format-security/}
CXXFLAGS=${CXXFLAGS/-Werror=format-security/}
+CFLAGS=${CFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}
+CXXFLAGS=${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}
+CFLAGS=${CFLAGS/-D_GLIBCXX_ASSERTIONS/}
+CXXFLAGS=${CXXFLAGS/-D_GLIBCXX_ASSERTIONS/}
prepare() {
- cd "${srcdir}"/binutils-gdb
-
- #for i in bfd binutils gas gold ld libctf libsframe opcodes; do ln -snfv ../binutils-gdb/$i; done
- for i in gcc fixincludes libcody libcpp libgcc libstdc++-v3; do ln -snfv ../gcc/$i; done
- for i in newlib libgloss; do ln -snfv ../newlib-cygwin/$i; done
+ cd "${srcdir}"/binutils-gdb
- mkdir -p "${srcdir}/obj"
+ # Fix Python 3.13+ compatibility by using stable GIL APIs instead of deprecated internal variables
+ if [ -f gdb/python/py-gdb-readline.c ]; then
+ sed -i 's/PyEval_RestoreThread (_PyOS_ReadlineTState);/PyGILState_STATE gil_state = PyGILState_Ensure ();/' gdb/python/py-gdb-readline.c
+ sed -i 's/PyEval_SaveThread ();/PyGILState_Release (gil_state);/' gdb/python/py-gdb-readline.c
+ fi
+
+ # Force Autoconf's C++11 macros to always report success
+ find "$srcdir" -name configure -exec sed -i 's/ax_cv_cxx_compile_cxx11=no/ax_cv_cxx_compile_cxx11=yes/g' {} +
+ find "$srcdir" -name configure -exec sed -i 's/as_fn_error $? "C++11 is required"/echo "Bypassing C++11 check"/g' {} +
+
+ # Cleanly sequence gnulib and local configs at the top of every simulator file
+ # This satisfies gnulib's ordering rule and prevents macro collisions
+ find sim/ppc -name "*.c" -exec sed -i '1s/^/#include "..\/..\/gnulib\/config.h"\n#undef PACKAGE_NAME\n#undef PACKAGE_STRING\n#undef PACKAGE_TARNAME\n#undef PACKAGE_VERSION\n#include "config.h"\n/' {} +
+
+ # Neutralize WERROR variables inside the legacy PPC simulator's Makefile template
+ if [ -f sim/ppc/Makefile.in ]; then
+ sed -i 's/WERROR_CFLAGS =.*/WERROR_CFLAGS = -Wno-error/g' sim/ppc/Makefile.in
+ fi
+
+ for i in gcc fixincludes libcody libcpp libgcc libstdc++-v3; do ln -snfv ../gcc/$i; done
+ for i in newlib libgloss; do ln -snfv ../newlib-cygwin/$i; done
+
+ # Revert any messy edits from previous runs
+ git checkout -- include/safe-ctype.h 2>/dev/null || true
+ (cd ../gcc && git checkout -- include/safe-ctype.h 2>/dev/null) || true
+
+ # Append undefs to the END of safe-ctype.h to protect C++ compilation units
+ for file in include/safe-ctype.h ../gcc/include/safe-ctype.h; do
+ if [ -f "$file" ]; then
+ cat << 'EOF' >> "$file"
+
+#ifdef __cplusplus
+# undef isalpha
+# undef isdigit
+# undef islower
+# undef isspace
+# undef isupper
+# undef isxdigit
+# undef isalnum
+# undef isprint
+# undef isgraph
+# undef iscntrl
+# undef isascii
+# undef tolower
+# undef toupper
+#endif
+EOF
+ fi
+ done
+
+ mkdir -p "${srcdir}/obj"
}
build()
{
- cd "${srcdir}"/obj
- "${srcdir}"/binutils-gdb/configure --prefix=/usr --libexecdir=/usr/lib --target=${_target} --enable-languages=c,c++ --disable-libstdcxx-pch \
- --with-newlib --with-libgloss --with-system-zlib --disable-nls --enable-plugins --enable-deterministic-archives --enable-relro --enable-__cxa_atexit \
- --enable-linker-build-id --enable-plugin --enable-checking=release --enable-host-shared --disable-libssp --disable-libunwind-exceptions --disable-source-highlight
+ cd "${srcdir}"/obj
- make
+ local DEF_CFLAGS="$CFLAGS -std=gnu17 -D_GNU_SOURCE -Wno-error -Wno-incompatible-pointer-types -Wno-int-conversion -Wno-implicit-function-declaration -Wno-discarded-qualifiers -Wno-old-style-definition -Wno-return-mismatch"
+ local DEF_CXXFLAGS="$CXXFLAGS -std=gnu++17 -D_GNU_SOURCE -Wno-error -Wno-template-id-cdtor -fno-char8_t"
+
+ export MAKEFLAGS="-j$(nproc)"
+
+ "${srcdir}"/binutils-gdb/configure \
+ --prefix=/usr \
+ --libexecdir=/usr/lib \
+ --target=${_target} \
+ --disable-werror \
+ --enable-languages=c,c++ \
+ --disable-libstdcxx-pch \
+ --with-newlib \
+ --with-libgloss \
+ --with-system-zlib \
+ --disable-nls \
+ --enable-plugins \
+ --enable-deterministic-archives \
+ --enable-relro \
+ --enable-__cxa_atexit \
+ --enable-linker-build-id \
+ --enable-plugin \
+ --enable-checking=release \
+ --enable-host-shared \
+ --disable-libssp \
+ --disable-libunwind-exceptions \
+ --disable-source-highlight \
+ --with-system-readline \
+ CC="gcc" \
+ CXX="g++" \
+ CFLAGS="$DEF_CFLAGS" \
+ CXXFLAGS="$DEF_CXXFLAGS" \
+ SIM_CFLAGS="-include config.h" \
+ WARN_CFLAGS="-include config.h"
+
+ make
}
package()
{
- cd "${srcdir}/obj"
- make install DESTDIR="${pkgdir}" -j1
- rm -rf "${pkgdir}"/usr/share
- rm -rf "${pkgdir}"/usr/include
- rm -rf "${pkgdir}"/usr/lib/libcc1.*
- rm -rf "${pkgdir}"/usr/lib/bfd-plugins
- find "${pkgdir}" -name '*.py' -delete
+ cd "${srcdir}/obj"
+ make install DESTDIR="${pkgdir}" -j1
+ rm -rf "${pkgdir}"/usr/share
+ rm -rf "${pkgdir}"/usr/include
+ rm -rf "${pkgdir}"/usr/lib/libcc1.*
+ rm -rf "${pkgdir}"/usr/lib/bfd-plugins
+ find "${pkgdir}" -name '*.py' -delete
- # local variable is scoped to the function, for general tidiness.
- local regex='ELF ().*(executable|shared object).*'
- # read null-terminated filenames from stdin, and use a while loop to operate on each one
- # for each run of the loop, the filename is stored in the intuitive variable "filename". :)
- while read -r -d '' filename; do
- # test if the output of `file` matches the regular expression defined earlier
- if [[ $(file -b "$filename") =~ $regex ]]; then
- # awesome, it matches! So, do the standard strip routine since this isn't an $_target executable
- strip --strip-unneeded "$filename"
- fi
- # this find command uses process substitution to pass the output of find into the `while read` loop
- done < <(find "$pkgdir" -type f -print0)
+ # local variable is scoped to the function, for general tidiness.
+ local regex='ELF ().*(executable|shared object).*'
+ # read null-terminated filenames from stdin, and use a while loop to operate on each one
+ # for each run of the loop, the filename is stored in the intuitive variable "filename". :)
+ while read -r -d '' filename; do
+ # test if the output of `file` matches the regular expression defined earlier
+ if [[ $(file -b "$filename") =~ $regex ]]; then
+ # awesome, it matches! So, do the standard strip routine since this isn't an $_target executable
+ strip --strip-unneeded "$filename"
+ fi
+ # this find command uses process substitution to pass the output of find into the `while read` loop
+ done < <(find "$pkgdir" -type f -print0)
- find "${pkgdir}/usr/lib/gcc/${_target}" "${pkgdir}/usr/${_target}/lib" -type f -name '*.o' -o -name '*.a' -exec "${pkgdir}"/usr/bin/${_target}-strip -g {} +
+ find "${pkgdir}/usr/lib/gcc/${_target}" "${pkgdir}/usr/${_target}/lib" -type f -name '*.o' -o -name '*.a' -exec "${pkgdir}"/usr/bin/${_target}-strip -g {} +
}

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 3
2026-08-02 00:16:08 LOW 3
2026-08-01 00:11:18 LOW 3
2026-07-31 00:14:10 LOW 3
2026-07-30 00:17:23 LOW 3
2026-07-29 00:25:53 LOW 3
2026-07-28 00:07:28 LOW 3
2026-07-27 00:24:32 LOW 3
2026-07-26 00:07:32 LOW 3
2026-07-25 00:13:44 LOW 3
2026-07-24 19:28:12 MEDIUM 2
2026-07-24 00:02:28 LOW 3
2026-07-23 00:14:47 LOW 3
2026-07-22 00:29:32 LOW 3
2026-07-21 00:24:15 LOW 3
2026-07-20 17:14:35 MEDIUM 2
2026-06-19 19:07:35 CLEAN 2
2026-06-18 16:11:54 MEDIUM 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion