python-gdal-ecw

maintainer olivervbk · 4 votes · base gdal-ecw · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a standard upstream tarball from the official OSGeo download server, which is a plausible project host; building from this source is normal AUR packaging behavior and poses no inherent risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a standard upstream tarball from the official OSGeo download server, which is a plausible project host; building from this source is normal AUR packaging behavior and poses no inherent risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 source=(https://download.osgeo.org/${_pkgbase}/${pkgver}/${_pkgbase}-${pkgver}.tar.xz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sylvain POULAIN <sylvain dot poulain at giscan dot com>
    
      2# Contributor: Jaroslav Lichtblau <svetlemodry@archlinux.org>
    
      3# Contributor: dibblethewrecker dibblethewrecker.at.jiwe.dot.org
    
      4# Contributor: William Rea <sillywilly@gmail.com>
    
      5# Contributor: Luigi Ranghetti <ggranga@gmail.com>
    
      6# Contributor: Oliver Kuster <olivervbk (at) gmail>
    
      7#
    
      8# Original can be found at:
    
      9# https://github.com/archlinux/svntogit-community/blob/packages/gdal/trunk/PKGBUILD
    
      10
    
      11pkgbase=gdal-ecw
    
      12_pkgbase=gdal
    
      13provides=('gdal=3.13.0')
    
      14conflicts=('gdal')
    
      15pkgname=('gdal-ecw' 'python-gdal-ecw')
    
      16pkgver=3.13.0
    
      17pkgrel=1
    
      18pkgdesc="A translator library for raster and vector geospatial data formats, with support to ECW format. Based on gdal-hdf4 AUR package."
    
      19arch=(x86_64)
    
      20url="https://gdal.org/"
    
      21license=(custom)
    
      22depends=('curl' 'geos' 'giflib' 'hdf5' 'libgeotiff' 'libjpeg-turbo' 'libpng' 'libspatialite' 'libtiff' 'netcdf'
    
       'openjpeg2' 'poppler' 'cfitsio' 'sqlite' 'mariadb-libs' 'postgresql-libs' 'xerces-c' 'json-c' 'arrow' 'pcre2'
    
       'libecwj2' 
    
       'sfcgal'
    
       'libkml-git'
    
       )
    
      28
    
      29makedepends=(cmake opencl-headers python-setuptools python-numpy
    
           proj arrow blosc cfitsio curl crypto++ libdeflate expat libfreexl
    
           libgeotiff geos giflib libheif hdf5 libjpeg-turbo json-c libjxl xz
    
           libxml2 lz4 mariadb-libs netcdf unixodbc ocl-icd openexr openjpeg2
    
           openssl pcre2 libpng podofo poppler postgresql-libs qhull
    
           libspatialite sqlite swig libtiff libwebp xerces-c zlib zstd libaec 
    
           sfcgal
    
           )
    
           # armadillo basisu brunsli lerc qb3 rasterlite2 tiledb
    
           # ogdi
    
      39changelog=$_pkgbase.changelog
    
      40source=(https://download.osgeo.org/${_pkgbase}/${pkgver}/${_pkgbase}-${pkgver}.tar.xz)
    
      41b2sums=('f8136f226bf2201a732e7acc61d23024a9f65fc9037386f18b3db4edb85672c054ac29703df1404a33efd97b266f0e40e716b0880e619dea3256e14afd366aaa')
    
      42
    
      43build() {
    
opt_libs=""
    
[[ "$(ldconfig -p | grep kml)" ]] && { echo "Found libkml"; opt_libs+=" -DGDAL_USE_LIBKML=ON"; }
    
      46
    
cmake -B build -S $_pkgbase-$pkgver \
    
  -DCMAKE_INSTALL_PREFIX=/usr \
    
  -DENABLE_IPO=ON \
    
  -DBUILD_PYTHON_BINDINGS=ON \
    
  -DGDAL_ENABLE_PLUGINS=ON \
    
  -DGDAL_USE_ARROW=ON \
    
  -DGDAL_USE_BLOSC=ON \
    
  -DGDAL_USE_CFITSIO=ON \
    
  -DGDAL_USE_CURL=ON \
    
  -DGDAL_USE_CRYPTOPP=ON \
    
  -DGDAL_USE_DEFLATE=ON \
    
  -DGDAL_USE_EXPAT=ON \
    
  -DGDAL_USE_FREEXL=ON \
    
  -DGDAL_USE_GEOTIFF=ON \
    
  -DGDAL_USE_GEOS=ON \
    
  -DGDAL_USE_GIF=ON \
    
  -DGDAL_USE_HEIF=ON \
    
  -DGDAL_USE_HDF5=ON \
    
  -DGDAL_USE_ICONV=ON \
    
  -DGDAL_USE_JPEG=ON \
    
  -DGDAL_USE_JSONC=ON \
    
  -DGDAL_USE_JXL=ON \
    
  -DGDAL_USE_LIBLZMA=ON \
    
  -DGDAL_USE_LIBXML2=ON \
    
  -DGDAL_USE_LZ4=ON \
    
  -DGDAL_USE_MYSQL=ON \
    
  -DGDAL_USE_NETCDF=ON \
    
  -DGDAL_USE_ODBC=ON \
    
  -DGDAL_USE_OPENEXR=ON \
    
  -DGDAL_USE_OPENJPEG=ON \
    
  -DGDAL_USE_OPENSSL=ON \
    
  -DGDAL_USE_PARQUET=ON \
    
  -DGDAL_USE_PCRE2=ON \
    
  -DGDAL_USE_PNG=ON \
    
  -DGDAL_USE_POPPLER=ON \
    
  -DGDAL_USE_POSTGRESQL=ON \
    
  -DGDAL_USE_QHULL=ON \
    
  -DGDAL_USE_SPATIALITE=ON \
    
  -DGDAL_USE_SQLITE3=ON \
    
  -DGDAL_USE_TIFF_INTERNAL=ON \
    
  -DGDAL_USE_GEOTIFF_INTERNAL=ON \
    
  -DGDAL_USE_TIFF=ON \
    
  -DGDAL_USE_WEBP=ON \
    
  -DGDAL_USE_XERCESC=ON \
    
  -DGDAL_USE_ZLIB=ON \
    
  -DGDAL_USE_ZSTD=ON \
    
  $opt_libs
    
make -C build
    
      95}
    
      96
    
      97package_gdal-ecw () {
    
depends=(proj blosc crypto++ curl libdeflate expat libfreexl geos libgeotiff
    
         giflib libjpeg-turbo json-c xz libxml2 lz4 unixodbc ocl-icd openssl
    
         pcre2 libpng qhull libspatialite sqlite libtiff xerces-c zlib zstd libaec
    
         arrow cfitsio hdf5 libheif mariadb-libs netcdf openexr openjpeg2
    
         podofo poppler postgresql-libs libwebp libecwj2 
    
         )
    
optdepends=('arrow: Arrow/Parquet support'
    
            'cfitsio: FITS support'
    
            'hdf5: HDF5 support'
    
            'libheif: HEIF support'
    
            'libjxl: JPEG XL support'
    
            'libkml-git: Full KML/KMZ support'
    
            'mariadb-libs: MySQL support'
    
            'netcdf: netCDF support'
    
            'openexr: EXR support'
    
            'openjpeg2: JP2 support'
    
            'podofo: PDF support'
    
            'poppler: PDF support'
    
            'postgresql-libs: PostgreSQL support'
    
            'perl: perl binding support'
    
            'unixodbc: when present while building, will add odbc support'
    
            'libwebp: WebP support')
    
      120
    
make -C build DESTDIR="${pkgdir}" install
    
install -Dm644 ${_pkgbase}-${pkgver}/LICENSE.TXT -t "${pkgdir}"/usr/share/licenses/$_pkgbase/
    
# Move python stuff
    
mkdir -p {bin,lib}
    
mv "${pkgdir}"/usr/bin/*py bin
    
mv "${pkgdir}"/usr/lib/python* lib
    
      127}
    
      128
    
      129package_python-gdal-ecw () {
    
pkgdesc="Python bindings for GDAL, with support to ECW format"
    
provides=("python-gdal")
    
conflicts=("python-gdal")
    
depends=("gdal-ecw=$pkgver" 'python-numpy')
    
      134
    
install -d "${pkgdir}"/usr/{bin,lib}
    
mv bin/* "${pkgdir}"/usr/bin
    
mv lib/* "${pkgdir}"/usr/lib
    
install -dm755 "${pkgdir}"/usr/share/licenses
    
ln -s $_pkgbase "${pkgdir}"/usr/share/licenses/$pkgname
    
# byte-compile python modules since the CMake build does not do it.
    
local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
    
python -m compileall -o 0 -o 1 -o 2 --hardlink-dupes -s "${pkgdir}" "${pkgdir}"${site_packages}
    
      143}
    
      144

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2