sh3eb-elf-gcc
The source uses a non-whitelisted but legitimate mirror (sourceforge.io) for isl, a standard build dependency; this is normal build behavior with no code execution or supply-chain risk beyond typical source compilation.
Triggered rules
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source uses a non-whitelisted but legitimate mirror (sourceforge.io) for isl, a standard build dependency; this is normal build behavior with no code execution or supply-chain risk beyond typical source compilation.
1 higher static finding superseded - not the current verdict (shown for transparency)
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
"https://libisl.sourceforge.io/isl-${_islver}.tar.xz")
PKGBUILD
1 offending line(s) highlighted# Maintainer: HurricanePootis <hurricanepootis@protonmail.com>
# Contributor: CoiledSpring
# Contributor: Julien Savard <juju@juju2143.ca>
# Based on msp430-elf-gcc
_target="sh3eb-elf"
pkgname=${_target}-gcc
pkgver=16.1.0
pkgrel=1
_islver=0.27
pkgdesc="The GNU Compiler Collection for the ${_target} target."
arch=(i686 x86_64)
license=(GPL-3.0-with-GCC-exception GFDL-1.3-or-later)
url="http://gcc.gnu.org"
depends=("${_target}-binutils" 'libmpc' 'elfutils' 'zlib' 'gmp' 'zstd' 'glibc' 'mpfr' 'bash')
options=('staticlibs' '!buildflags' '!libtool' '!emptydirs')
source=("https://ftpmirror.gnu.org/gcc/gcc-${pkgver}/gcc-${pkgver}.tar.xz"
"https://libisl.sourceforge.io/isl-${_islver}.tar.xz")
sha256sums=('50efb4d94c3397aff3b0d61a5abd748b4dd31d9d3f2ab7be05b171d36a510f79'
'6d8babb59e7b672e8cb7870e874f3f7b813b6e00e6af3f8b04f7579965643d5c')
prepare() {
cd "${srcdir}/gcc-${pkgver/+/-}"
ln -s ../isl-$_islver isl
[[ -d gcc-build ]] && rm -rf gcc-build
mkdir gcc-build
}
build() {
cd "${srcdir}/gcc-${pkgver/+/-}"
echo ${pkgver} > gcc/BASE-VER
cd gcc-build
[ $NOEXTRACT -eq 1 ] || ../configure \
--prefix=/usr \
--program-prefix=${_target}- \
--target=${_target} \
--host=$CHOST \
--build=$CHOST \
--enable-languages=c,c++ \
--enable-multilib \
--with-system-zlib \
--with-local-prefix=/usr/${_target} \
--with-as=/usr/bin/${_target}-as \
--with-ld=/usr/bin/${_target}-ld \
--disable-libgomp \
--enable-interwork \
--enable-addons \
--enable-sjlj-exceptions \
--disable-hosted-libstdcxx \
--with-gnu-as \
--with-gnu-ld \
--disable-libssp \
--disable-__cxa_atexit \
--enable-lto
make all-gcc all-target-libgcc
}
package() {
cd "${srcdir}/gcc-${pkgver/+/-}/gcc-build"
make DESTDIR="${pkgdir}" install-gcc install-target-libgcc
rm -rf "${pkgdir}/usr/share/man/man7/"
rm -rf "${pkgdir}/usr/share/info"
rm -rf "${pkgdir}/usr/share/locale"
cp -r "${pkgdir}"/usr/libexec/* "${pkgdir}/usr/lib/"
rm -rf "${pkgdir}/usr/libexec"
# strip it manually
strip "${pkgdir}"/usr/bin/* 2>/dev/null || true
find "${pkgdir}"/usr/lib -type f -exec /usr/bin/${_target}-strip \
--strip-unneeded {} \; 2>/dev/null || true
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |