sh-elf-gcc
LOW
maintainer lorenzolomartire
3 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds GCC from official sources; the non-whitelisted host (sourceforge.io) is a legitimate project host for isl, a required dependency, and the source is used for building, not remote code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds GCC from official sources; the non-whitelisted host (sourceforge.io) is a legitimate project host for isl, a required dependency, and the source is used for building, not remote code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
https://libisl.sourceforge.io/isl-$_islver.tar.bz2)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: whiteman808 <whiteman808 at paraboletancza dot org>
2
# Contributor: David P. <megver83 at parabola dot nu>
3
4
_target=sh-elf
5
pkgname=$_target-gcc
6
_pkgver=15.2.0
7
pkgver=$_pkgver
8
_islver=0.27
9
pkgrel=1
10
pkgdesc='The GNU Compiler Collection - cross compiler for SuperH (bare-metal) target'
11
arch=(x86_64 i686 armv7h)
12
url='http://gcc.gnu.org/'
13
license=(GPL LGPL FDL)
14
depends=($_target-binutils libmpc zlib)
15
makedepends=(gmp mpfr $_target-newlib)
16
optdepends=("$_target-newlib: Standard C library ($_target target)")
17
options=(!emptydirs !strip)
18
source=(https://gcc.gnu.org/pub/gcc/releases/gcc-$_pkgver/gcc-$_pkgver.tar.xz{,.sig}
19
https://libisl.sourceforge.io/isl-$_islver.tar.bz2)
20
sha512sums=('89047a2e07bd9da265b507b516ed3635adb17491c7f4f67cf090f0bd5b3fc7f2ee6e4cc4008beef7ca884b6b71dffe2bb652b21f01a702e17b468cca2d10b2de'
21
'SKIP'
22
'e14ab1a622d3f6219b264b8e2512487aecd6725b7b88f40bc8f31651bfe7d89db4649aae12eaa0052dd904bac21607f63c83fbab73251767425d91989a969f7e')
23
validpgpkeys=(33C235A34C46AA3FFB293709A328C3A2C3C45C06 # Jakub Jelinek <jakub@redhat.com>
24
13975A70E63C361C73AE69EF6EEB81F8981C74C7) # Richard Guenther <richard.guenther@gmail.com>
25
if [ -n "$_snapshot" ]; then
26
_basedir=gcc-$_snapshot
27
else
28
_basedir=gcc-$_pkgver
29
fi
30
31
prepare() {
32
cd $_basedir
33
34
# link isl for in-tree builds
35
ln -sf ../isl-$_islver isl
36
37
echo $_pkgver > gcc/BASE-VER
38
39
# hack! - some configure tests for header files using "$CPP $CPPFLAGS"
40
sed -i "/ac_cpp=/s/\$CPPFLAGS/\$CPPFLAGS -O2/" "$srcdir"/$_basedir/{libiberty,gcc}/configure
41
42
mkdir $srcdir/gcc-build
43
}
44
45
build() {
46
cd gcc-build
47
48
# using -pipe causes spurious test-suite failures
49
# http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48565
50
CFLAGS=${CFLAGS/-pipe/}
51
CXXFLAGS=${CXXFLAGS/-pipe/}
52
53
CFLAGS+=' -Wno-error=format-security'
54
CXXFLAGS+=' -Wno-error=format-security'
55
56
$srcdir/$_basedir/configure \
57
--target=$_target \
58
--prefix=/usr \
59
--libexecdir=/usr/lib \
60
--with-sysroot=/usr/$_target \
61
--with-native-system-header-dir=/include \
62
--enable-languages=c,c++ \
63
--enable-plugins \
64
--enable-shared \
65
--disable-decimal-float \
66
--disable-libffi \
67
--disable-libgomp \
68
--disable-libmudflap \
69
--disable-libquadmath \
70
--disable-libssp \
71
--disable-libstdcxx-pch \
72
--disable-nls \
73
--disable-threads \
74
--disable-tls \
75
--with-gnu-as \
76
--with-gnu-ld \
77
--with-system-zlib \
78
--with-newlib \
79
--with-python-dir=share/gcc-$_target \
80
--with-gmp \
81
--with-mpfr \
82
--with-mpc \
83
--with-isl \
84
--with-libelf \
85
--enable-gnu-indirect-function
86
87
make
88
}
89
90
package() {
91
make -C gcc-build DESTDIR="$pkgdir" install-gcc install-target-{libgcc,libstdc++-v3}
92
93
# strip target binaries
94
find "$pkgdir"/usr/lib/gcc/$_target/ "$pkgdir"/usr/$_target/lib \
95
-type f -and \( -name \*.a -or -name \*.o \) \
96
-exec $_target-objcopy -R .comment -R .note -R .debug_info -R .debug_aranges \
97
-R .debug_pubnames -R .debug_pubtypes -R .debug_abbrev -R .debug_line \
98
-R .debug_str -R .debug_ranges -R .debug_loc '{}' \;
99
100
# strip host binaries
101
find "$pkgdir/usr/bin/" "$pkgdir/usr/lib/gcc/$_target/" -type f \
102
-and \( -executable \) -exec strip '{}' \;
103
104
# Remove files that conflict with host gcc package
105
rm -r "$pkgdir/usr/share/"{man/man7,info}
106
}
107
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |