velus-git

LOW

maintainer mJolimaitre 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package builds from source using opam to install project-specific dependencies; this is normal for OCaml projects and does not involve untrusted remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using opam to install project-specific dependencies; this is normal for OCaml projects and does not involve untrusted remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:35 opam install --jobs=$JOBS --yes coq.8.9.1 menhir.20200624 coq-menhirlib.20200624

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: JOLIMAITRE Matthieu <matthieu@imagevo.fr>
    
      2pkgname="velus-git"
    
      3pkgver=3.0.0
    
      4pkgrel=1
    
      5pkgdesc="The Velus Lustre compiler."
    
      6url="https://github.com/INRIA/velus"
    
      7arch=("x86_64")
    
      8license=("Inria Non-Commercial License Agreement")
    
      9makedepends=()
    
      10optdepends=()
    
      11depends=('opam' 'git' 'make' 'ocamlbuild' 'coreutils')
    
      12source=("https://github.com/INRIA/velus/archive/refs/tags/v$pkgver.tar.gz")
    
      13sha256sums=("f61ea2b36acf83759aa10b3a2c11696b912b9926a44862c5d678e46f3ac3602d")
    
      14
    
      15build() {
    
      16	# install sources
    
      17	cd "$srcdir/velus-3.0.0"
    
      18	rm -fr CompCert
    
      19	git clone https://github.com/inria-parkas/CompCert.git CompCert
    
      20	( cd CompCert && git checkout e19f81cecf4a7cca67d8491fcb4c0a259c232bfb )
    
      21
    
      22	VELUS_DIR="$PWD"
    
      23	export TMP="$PWD/opam_workdir"
    
      24	export TMPDIR="$PWD/opam_workdir"
    
      25	JOBS=$(nproc)
    
      26
    
      27	# setup opam
    
      28	rm -fr   opam opam_workdir
    
      29	mkdir -p opam opam_workdir
    
      30	opam init --jobs=$JOBS --root=opam --compiler=4.07.1 --no
    
      31	eval $(opam config env --root=$VELUS_DIR/opam --set-root)
    
      32
    
      33	# install opam build deps
    
      34	opam repo add coq-released https://coq.inria.fr/opam/released
    
      35	opam install --jobs=$JOBS --yes coq.8.9.1 menhir.20200624 coq-menhirlib.20200624
    
      36
    
      37	# run actual build process
    
      38	./configure x86_64-linux
    
      39	make --jobs=$JOBS
    
      40}
    
      41
    
      42package() {
    
      43	cd "$srcdir/velus-3.0.0/_build"
    
      44	install -D      src/veluslib.o                    "$pkgdir/usr/share/velus/veluslib.o"
    
      45	install -D      src/veluslib.cmo                  "$pkgdir/usr/share/velus/veluslib.cmo"
    
      46	install -D      src/veluscommon.cmo               "$pkgdir/usr/share/velus/veluscommon.cmo"
    
      47	install -D      src/velusmain.cmi                 "$pkgdir/usr/share/velus/velusmain.cmi"
    
      48	install -D      src/velusmain.ml.depends          "$pkgdir/usr/share/velus/velusmain.ml.depends"
    
      49	install -D      src/veluscommon.ml.depends        "$pkgdir/usr/share/velus/veluscommon.ml.depends"
    
      50	install -D      src/compcert.ini                  "$pkgdir/usr/share/velus/compcert.ini"
    
      51	install -D      src/veluslib.cmx                  "$pkgdir/usr/share/velus/veluslib.cmx"
    
      52	install -D      src/veluscommon.cmi               "$pkgdir/usr/share/velus/veluscommon.cmi"
    
      53	install -D      src/velusmain.ml                  "$pkgdir/usr/share/velus/velusmain.ml"
    
      54	install -D      src/veluslib.ml                   "$pkgdir/usr/share/velus/veluslib.ml"
    
      55	install -D      src/veluslib.ml.depends           "$pkgdir/usr/share/velus/veluslib.ml.depends"
    
      56	install -D      src/velusmain.cmo                 "$pkgdir/usr/share/velus/velusmain.cmo"
    
      57	install -D      src/veluscommon.cmx               "$pkgdir/usr/share/velus/veluscommon.cmx"
    
      58	install -D      src/veluslib.cmi                  "$pkgdir/usr/share/velus/veluslib.cmi"
    
      59	install -D      src/veluscommon.o                 "$pkgdir/usr/share/velus/veluscommon.o"
    
      60	install -D      src/veluscommon.ml                "$pkgdir/usr/share/velus/veluscommon.ml"
    
      61	install -D      src/velusmain.o                   "$pkgdir/usr/share/velus/velusmain.o"
    
      62	install -D      src/velusmain.cmx                 "$pkgdir/usr/share/velus/velusmain.cmx"
    
      63	install -Dm 755 src/velusmain.native              "$pkgdir/usr/share/velus/velusmain.native"
    
      64	mkdir -p                                          "$pkgdir/usr/bin"
    
      65	ln -s           /usr/share/velus/velusmain.native "$pkgdir/usr/bin/velus"
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2