sh3eb-elf-gcc

maintainer HurricanePootis · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source uses a non-whitelisted but legitimate mirror (sourceforge.io) for isl, a standard build dependency; this is normal build behavior with no code execution or supply-chain risk beyond typical source compilation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source uses a non-whitelisted but legitimate mirror (sourceforge.io) for isl, a standard build dependency; this is normal build behavior with no code execution or supply-chain risk beyond typical source compilation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "https://libisl.sourceforge.io/isl-${_islver}.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: HurricanePootis <hurricanepootis@protonmail.com>
    
      2# Contributor: CoiledSpring
    
      3# Contributor: Julien Savard <juju@juju2143.ca>
    
      4# Based on msp430-elf-gcc
    
      5
    
      6_target="sh3eb-elf"
    
      7pkgname=${_target}-gcc
    
      8pkgver=16.1.0
    
      9pkgrel=1
    
      10_islver=0.27
    
      11pkgdesc="The GNU Compiler Collection for the ${_target} target."
    
      12arch=(i686 x86_64)
    
      13license=(GPL-3.0-with-GCC-exception GFDL-1.3-or-later)
    
      14url="http://gcc.gnu.org"
    
      15depends=("${_target}-binutils" 'libmpc' 'elfutils' 'zlib' 'gmp' 'zstd' 'glibc' 'mpfr' 'bash')
    
      16options=('staticlibs' '!buildflags' '!libtool' '!emptydirs')
    
      17source=("https://ftpmirror.gnu.org/gcc/gcc-${pkgver}/gcc-${pkgver}.tar.xz"
    
      18	"https://libisl.sourceforge.io/isl-${_islver}.tar.xz")
    
      19sha256sums=('50efb4d94c3397aff3b0d61a5abd748b4dd31d9d3f2ab7be05b171d36a510f79'
    
      20            '6d8babb59e7b672e8cb7870e874f3f7b813b6e00e6af3f8b04f7579965643d5c')
    
      21
    
      22prepare() {
    
      23  cd "${srcdir}/gcc-${pkgver/+/-}"
    
      24  ln -s ../isl-$_islver isl
    
      25
    
      26  [[ -d gcc-build ]] && rm -rf gcc-build
    
      27  mkdir gcc-build
    
      28}
    
      29
    
      30build() {
    
      31  cd "${srcdir}/gcc-${pkgver/+/-}"
    
      32
    
      33  echo ${pkgver} > gcc/BASE-VER
    
      34
    
      35  cd gcc-build
    
      36
    
      37  [ $NOEXTRACT -eq 1 ] || ../configure \
    
      38    --prefix=/usr \
    
      39    --program-prefix=${_target}- \
    
      40    --target=${_target} \
    
      41    --host=$CHOST \
    
      42    --build=$CHOST \
    
      43    --enable-languages=c,c++ \
    
      44    --enable-multilib \
    
      45    --with-system-zlib \
    
      46    --with-local-prefix=/usr/${_target} \
    
      47    --with-as=/usr/bin/${_target}-as \
    
      48    --with-ld=/usr/bin/${_target}-ld \
    
      49    --disable-libgomp \
    
      50    --enable-interwork \
    
      51    --enable-addons \
    
      52    --enable-sjlj-exceptions \
    
      53    --disable-hosted-libstdcxx \
    
      54    --with-gnu-as \
    
      55    --with-gnu-ld \
    
      56    --disable-libssp \
    
      57    --disable-__cxa_atexit \
    
      58    --enable-lto
    
      59
    
      60  make all-gcc all-target-libgcc
    
      61}
    
      62
    
      63package() {
    
      64  cd "${srcdir}/gcc-${pkgver/+/-}/gcc-build"
    
      65
    
      66  make DESTDIR="${pkgdir}" install-gcc install-target-libgcc
    
      67
    
      68  rm -rf "${pkgdir}/usr/share/man/man7/"
    
      69  rm -rf "${pkgdir}/usr/share/info"
    
      70  rm -rf "${pkgdir}/usr/share/locale"
    
      71
    
      72  cp -r "${pkgdir}"/usr/libexec/* "${pkgdir}/usr/lib/"
    
      73  rm -rf "${pkgdir}/usr/libexec"
    
      74
    
      75  # strip it manually
    
      76  strip "${pkgdir}"/usr/bin/* 2>/dev/null || true
    
      77  find "${pkgdir}"/usr/lib -type f -exec /usr/bin/${_target}-strip \
    
      78    --strip-unneeded {} \; 2>/dev/null || true
    
      79}
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2