tetgen

maintainer entshuld · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the official project host (wias-berlin.de), which is plausibly the project's own infrastructure; building from source is standard practice, and the host, while not on a common whitelist, is legitimate for the software.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official project host (wias-berlin.de), which is plausibly the project's own infrastructure; building from source is standard practice, and the host, while not on a common whitelist, is legitimate for the software.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("http://wias-berlin.de/software/tetgen/1.6/src/${pkgname}${pkgver}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Dylon Edwards <deltaecho at archlinux dot us>
    
      2# Contributor: Stefan Husmann <stefan-husmann@t-online.de>
    
      3# Contributor: haawda
    
      4# Maintainer: eDgar <edgar `not@` openmail cc>
    
      5
    
      6pkgname=tetgen
    
      7pkgver=1.6.0
    
      8pkgrel=4
    
      9pkgdesc='A Quality Tetrahedral Mesh Generator and a 3D Delaunay Triangulator'
    
      10arch=('x86_64')
    
      11url='http://wias-berlin.de/software/index.jsp?id=TetGen&lang=1'
    
      12license=('AGPL3')
    
      13#  You must accept the licensing terms before downloading the source archive:
    
      14#    http://wias-berlin.de/software/tetgen/download2.jsp
    
      15#  Place the downloaded archive in $SRCDEST of your /etc/makepkg.conf
    
      16source=("http://wias-berlin.de/software/tetgen/1.6/src/${pkgname}${pkgver}.tar.gz")
    
      17sha256sums=('87b5e61ebd3a471fc4f2cdd7124c2b11dd6639f4feb1f941a5d2f5110d05ce39')
    
      18options=('!staticlibs')
    
      19makedepends=('cmake')
    
      20
    
      21[ ! -f ${pkgname}${pkgver}.tar.gz ] &&
    
      22  printf "1. Visit http://wias-berlin.de/software/tetgen/download2.jsp\n" &&
    
      23  printf "2. Place the downloaded tar.gz in \$SRCDEST (/etc/makepkg.conf;\n" &&
    
      24  printf "   right now SRCDEST=$SRCDEST)\n" &&
    
      25  printf "3. When ready, try again.\n" && exit
    
      26
    
      27#  From UPC: Building And Using Static And Shared "C"
    
      28#  Libraries.html
    
      29# #+begin_QUOTE
    
      30# we need that all jump calls ("goto", in assembly speak)
    
      31# and subroutine calls will use relative addresses, and not
    
      32# absolute addresses. Thus, we need to use ... ~-fPIC~ or
    
      33# ~-fpic~
    
      34# #+end_QUOTE
    
      35#
    
      36#  From makepkg.conf
    
      37# -march (or -mcpu) builds exclusively for an architecture
    
      38# -mtune optimizes for an architecture, but builds for
    
      39#  whole processor family
    
      40#
    
      41# -O3 optimises
    
      42#
    
      43# -D-FORTIFY-SOURCE=2
    
      44# | https://stackoverflow.com/a/16604146
    
      45# |- man 7 feature_test_macros
    
      46# checks to be performed to detect some buffer overflow
    
      47# errors when employing various string and memory
    
      48# manipulation functions ... some  conforming programs
    
      49# might fail
    
      50#
    
      51# -fcf-protection
    
      52# | Info pages for gcc (gnu compiler collection)
    
      53# intended to protect against such threats as
    
      54# Return-oriented Programming (ROP), and similarly
    
      55# call/jmp-oriented programming (COP/JOP)
    
      56#
    
      57# -pipe
    
      58# | Info pages for gcc (controlling the kind of output)
    
      59# Use pipes rather than temporary files for communication
    
      60# between the various stages of compilation
    
      61#
    
      62# -fno-plt
    
      63# | Info pages for gcc (code generation conventions)
    
      64# leads to more efficient code by eliminating PLT stubs and
    
      65# exposing GOT loads to optimizations
    
      66#
    
      67# -fopenmp
    
      68# | Info pages for gcc (controlling c dialect)
    
      69# Enable handling of OpenMP directives
    
      70#
    
      71
    
      72safe_flags="-Wp,-D_FORTIFY_SOURCE=2,-D_GLIBCXX_ASSERTIONS"
    
      73safe_flags+=" -fcf-protection -fno-plt"
    
      74safe_flags+=" -fstack-clash-protection -Wformat"
    
      75safe_flags+=" -Werror=format-security"
    
      76generic_flags="-pipe -fno-plt -fPIC -fopenmp"
    
      77generic_flags+=" -march=native"
    
      78generic_flags+=" -mtune=native ${safe_flags}"
    
      79opt_flags="${generic_flags} -O3"
    
      80generic_flags="${generic_flags} -O2"
    
      81
    
      82export COPTFLAGS="${opt_flags}"
    
      83export CXXOPTFLAGS="$COPTFLAGS"
    
      84export FOPTFLAGS="$COPTFLAGS"
    
      85export CPPFLAGS="$generic_flags"
    
      86export CXXFLAGS="$CPPFLAGS"
    
      87export CFLAGS="$generic_flags"
    
      88export FFLAGS="$generic_flags"
    
      89export FCFLAGS="$generic_flags"
    
      90export F90FLAGS="$generic_flags"
    
      91export F77FLAGS="$generic_flags"
    
      92
    
      93export CC=mpicc
    
      94export CXX=mpicxx
    
      95export FC=mpif90
    
      96export F90=mpif90
    
      97
    
      98export LANG=en_IE.UTF-8
    
      99export LC_ALL=en_IE.UTF-8
    
      100
    
      101prepare() {
    
      102  sed -i 's/tet STATIC/tet SHARED/g' "${pkgname}${pkgver}"/CMakeLists.txt
    
      103}
    
      104
    
      105build() {
    
      106  [[ -d build ]] && rm -rf build
    
      107  mkdir build
    
      108  cd build
    
      109  CONFOPTS=(
    
      110    -DCMAKE_INSTALL_PREFIX=/usr
    
      111    -DCMAKE_BUILD_TYPE=Release
    
      112	-DCMAKE_CXX_FLAGS_RELEASE="$CXXOPTFLAGS"
    
      113	-DCMAKE_C_FLAGS_RELEASE="$COPTFLAGS"
    
      114  )
    
      115  cmake ../"${pkgname}${pkgver}"
    
      116  make
    
      117}
    
      118
    
      119package() {
    
      120  cd build
    
      121  install -m 755 -D -t "${pkgdir}/usr/bin" tetgen
    
      122  install -m 644 -D -t "${pkgdir}/usr/lib" libtet.so
    
      123  install -m 644 -D -t "${pkgdir}/usr/include" ../"${pkgname}${pkgver}/tetgen.h"
    
      124}
    
      125

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2