swift-bin

maintainer susurri · 96 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads official Swift binary releases from the project's own domain (download.swift.org), which is a legitimate source despite not being on the analyzer's whitelist; the downloaded tarballs are checksum-verified and contain prebuilt executables that are standard for the project, posing no additional supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official Swift binary releases from the project's own domain (download.swift.org), which is a legitimate source despite not being on the analyzer's whitelist; the downloaded tarballs are checksum-verified and contain prebuilt executables that are standard for the project, posing no additional supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=("https://download.swift.org/swift-$pkgver-release/ubi9/swift-$pkgver-RELEASE/swift-$pkgver-RELEASE-ubi9.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Susurri <susurrus dot silent at gmail dot com>
    
      2# Contributor: Miten <git dot pub at icloud dot com>
    
      3# Contributor: Ryan Gonzalez <rymg19 at gmail dot com>
    
      4# Contributor: Frederic Bezies <fredbezies at gmail dot com>, youngunix <>
    
      5
    
      6pkgname=swift-bin
    
      7pkgver=6.3.2
    
      8pkgrel=1
    
      9pkgdesc="Binary builds of the Swift programming language"
    
      10arch=('x86_64' 'aarch64')
    
      11url="https://www.swift.org/"
    
      12license=('apache')
    
      13depends=('util-linux-libs' 'libxml2-legacy' 'ncurses')
    
      14makedepends=('patchelf')
    
      15optdepends=('python39: required for REPL')
    
      16options=('!strip')
    
      17provides=('swift-language')
    
      18replaces=('swift-language-bin')
    
      19source_x86_64=("https://download.swift.org/swift-$pkgver-release/ubi9/swift-$pkgver-RELEASE/swift-$pkgver-RELEASE-ubi9.tar.gz")
    
      20source_aarch64=("https://download.swift.org/swift-$pkgver-release/ubi9-aarch64/swift-$pkgver-RELEASE/swift-$pkgver-RELEASE-ubi9-aarch64.tar.gz")
    
      21sha256sums_x86_64=('0853e2e95f3f56cfbdca97d075e803b44f15f8ab8c49989e37164e8ef0e7d66d')
    
      22sha256sums_aarch64=('d149f60f2c4ad624ddc22e26a7f7967de738af41a9a39b88207a47b7265d399b')
    
      23
    
      24package() {
    
      25  find_elf_only() {
    
      26    find "${pkgdir}/usr/lib/swift" \
    
      27      -executable -type f \
    
      28      '(' -path '*/bin/*' -o -name '*.so*' ')' \
    
      29      -not '(' -name '*.py' -o -name 'hwasan_symbolize' ')' \
    
      30      "$@"
    
      31  }
    
      32
    
      33  _archsuffix=""
    
      34  if [[ $CARCH == "aarch64" ]]; then
    
      35    _archsuffix="-aarch64"
    
      36  fi
    
      37  mkdir -p "${pkgdir}/usr/lib/swift"
    
      38  cp -Ppr "${srcdir}/swift-$pkgver-RELEASE-ubi9${_archsuffix}"/usr/* "${pkgdir}/usr/lib/swift"
    
      39
    
      40  # Symlink the desired binaries to /usr/bin
    
      41  mkdir -p "${pkgdir}/usr/bin"
    
      42  for bin in sourcekit-lsp swift swiftc; do
    
      43    ln -s "/usr/lib/swift/bin/$bin" "${pkgdir}/usr/bin/$bin"
    
      44  done
    
      45
    
      46  # Patch the binaries to use the changed ncurses names
    
      47  patchelf=(patchelf)
    
      48  for lib in ncurses panel form; do
    
      49    patchelf+=(--replace-needed "lib${lib}.so.6" "lib${lib}w.so")
    
      50  done
    
      51  find_elf_only -exec "${patchelf[@]}" {} \;
    
      52
    
      53  install -dm755 "${pkgdir}/etc/ld.so.conf.d"
    
      54  echo '/usr/lib/swift/lib/swift/linux' >> "${pkgdir}/etc/ld.so.conf.d/swift.conf"
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2