sh3eb-elf-gcc
The source uses a non-whitelisted but legitimate mirror (sourceforge.io) for isl, a standard build dependency; this is normal build behavior with no code execution or supply-chain risk beyond typical source compilation.
Triggered rules
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source uses a non-whitelisted but legitimate mirror (sourceforge.io) for isl, a standard build dependency; this is normal build behavior with no code execution or supply-chain risk beyond typical source compilation.
1 higher static finding superseded - not the current verdict (shown for transparency)
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
"https://libisl.sourceforge.io/isl-${_islver}.tar.xz")
PKGBUILD
1 offending line(s) highlighted# Maintainer: HurricanePootis <hurricanepootis@protonmail.com>
# Contributor: CoiledSpring
# Contributor: Julien Savard <juju@juju2143.ca>
# Based on msp430-elf-gcc
_target="sh3eb-elf"
pkgname=${_target}-gcc
pkgver=16.1.0
pkgrel=1
_islver=0.27
pkgdesc="The GNU Compiler Collection for the ${_target} target."
arch=(i686 x86_64)
license=(GPL-3.0-with-GCC-exception GFDL-1.3-or-later)
url="http://gcc.gnu.org"
depends=("${_target}-binutils" 'libmpc' 'elfutils' 'zlib' 'gmp' 'zstd' 'glibc' 'mpfr' 'bash')
options=('staticlibs' '!buildflags' '!libtool' '!emptydirs')
source=("https://ftpmirror.gnu.org/gcc/gcc-${pkgver}/gcc-${pkgver}.tar.xz"
"https://libisl.sourceforge.io/isl-${_islver}.tar.xz")
sha256sums=('50efb4d94c3397aff3b0d61a5abd748b4dd31d9d3f2ab7be05b171d36a510f79'
'6d8babb59e7b672e8cb7870e874f3f7b813b6e00e6af3f8b04f7579965643d5c')
prepare() {
cd "${srcdir}/gcc-${pkgver/+/-}"
ln -s ../isl-$_islver isl
[[ -d gcc-build ]] && rm -rf gcc-build
mkdir gcc-build
}
build() {
cd "${srcdir}/gcc-${pkgver/+/-}"
echo ${pkgver} > gcc/BASE-VER
cd gcc-build
[ $NOEXTRACT -eq 1 ] || ../configure \
--prefix=/usr \
--program-prefix=${_target}- \
--target=${_target} \
--host=$CHOST \
--build=$CHOST \
--enable-languages=c,c++ \
--enable-multilib \
--with-system-zlib \
--with-local-prefix=/usr/${_target} \
--with-as=/usr/bin/${_target}-as \
--with-ld=/usr/bin/${_target}-ld \
--disable-libgomp \
--enable-interwork \
--enable-addons \
--enable-sjlj-exceptions \
--disable-hosted-libstdcxx \
--with-gnu-as \
--with-gnu-ld \
--disable-libssp \
--disable-__cxa_atexit \
--enable-lto
make all-gcc all-target-libgcc
}
package() {
cd "${srcdir}/gcc-${pkgver/+/-}/gcc-build"
make DESTDIR="${pkgdir}" install-gcc install-target-libgcc
rm -rf "${pkgdir}/usr/share/man/man7/"
rm -rf "${pkgdir}/usr/share/info"
rm -rf "${pkgdir}/usr/share/locale"
cp -r "${pkgdir}"/usr/libexec/* "${pkgdir}/usr/lib/"
rm -rf "${pkgdir}/usr/libexec"
# strip it manually
strip "${pkgdir}"/usr/bin/* 2>/dev/null || true
find "${pkgdir}"/usr/lib -type f -exec /usr/bin/${_target}-strip \
--strip-unneeded {} \; 2>/dev/null || true
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |