wxparaver

maintainer gamezelda · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is downloaded from a project-owned domain (bsc.es) used by the Barcelona Supercomputing Center for official releases; despite the non-standard host triggering a static rule, this is a legitimate build of the project's own source code, not an unverifiable or third-party executable.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from a project-owned domain (bsc.es) used by the Barcelona Supercomputing Center for official releases; despite the non-standard host triggering a static rule, this is a legitimate build of the project's own source code, not an unverifiable or third-party executable.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://ftp.tools.bsc.es/$pkgname/$pkgname-${pkgver%.*}-src.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Joan Bruguera Micó <joanbrugueram@gmail.com>
    
      2pkgname='wxparaver'
    
      3pkgdesc='Expressive powerful and flexible trace visualizer for post-mortem trace analysis (from BSC).'
    
      4pkgver='4.12.0.20241204'
    
      5pkgrel='5'
    
      6arch=('x86_64')
    
      7url='https://www.bsc.es/discover-bsc/organisation/scientific-structure/performance-tools'
    
      8license=('LGPL-2.1-or-later')
    
      9depends=(wxwidgets-gtk3 boost libxml2 zlib)
    
      10source=("https://ftp.tools.bsc.es/$pkgname/$pkgname-${pkgver%.*}-src.tar.bz2"
    
      11        "wxparaver-tutorialsdownload-Fix-Boost-ASIO-1.87.0-removals.patch"
    
      12        "wxParaver.desktop")
    
      13sha512sums=(9d44e08cb0372d1bda5d859c8cdc3aa17e4ea211694969b520c85b79fb70cc9584a9f408403ca3f3153404cf66c3484c6891fa16d09fde3d297366b11fd684c1
    
      14            942fd0f3df5fb8fed60b5a56e29b3b5b3c8e84d1c81de254824224aa584fbd367371556c9b38ae7f6db97f1025919ba2ff8c6bf121d31e68e429693e431c4806
    
      15            50dd3ff677895b9aad9b17a67c6791f96acc2b9c5bf65b3991a1b92cb17c6567735a740188aaedcf211ca9bfbfb7ef758109d57296315afdd35707b49955cb3c)
    
      16
    
      17prepare() {
    
      18	cd "$srcdir/$pkgname-${pkgver%.*}"
    
      19
    
      20	# WORKAROUND: By default, it seems that the wxParaver depends on an existing -kernel/-api installation
    
      21	#             We want to use the ones we just built, so replace the references to point to them instead
    
      22	cd src/wxparaver
    
      23	sed -i \
    
      24	    -e 's|-lparaver-api -lparaver-kernel|-L../../paraver-kernel/src/.libs -L../../paraver-kernel/api/.libs -lparaver-api -lparaver-kernel|g' \
    
      25	    -e '$awxparaver_bin_CXXFLAGS = @CXXFLAGS@ -I../../paraver-kernel -I../../paraver-kernel/api' \
    
      26	    src/Makefile.am
    
      27	# shellcheck disable=SC2016
    
      28	sed -i 's| -L$PARAVER_LIBDIR||g' configure.ac
    
      29
    
      30	patch -Np1 -i "$srcdir/wxparaver-tutorialsdownload-Fix-Boost-ASIO-1.87.0-removals.patch"
    
      31
    
      32	autoreconf -i -f
    
      33}
    
      34
    
      35build() {
    
      36	cd "$srcdir/$pkgname-${pkgver%.*}"
    
      37
    
      38	# Arch's wx-config is named differently for GTK2/GTK3
    
      39	./configure \
    
      40		--prefix=/usr \
    
      41		--with-wx-config=/bin/wx-config
    
      42
    
      43	make
    
      44}
    
      45
    
      46package() {
    
      47	cd "$srcdir/$pkgname-${pkgver%.*}"
    
      48
    
      49	make DESTDIR="$pkgdir/" install
    
      50
    
      51	# Create a shortcut to execute the application easily from the user's desktop environment
    
      52	mkdir -p "$pkgdir/usr/share/applications"
    
      53	install -o root -g root -m 644 "$srcdir/wxParaver.desktop" "$pkgdir/usr/share/applications/wxParaver.desktop"
    
      54}
    
      55

Changes since previous scan

--- PKGBUILD @ 2026-07-25 00:13
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 pkgname='wxparaver'
 pkgdesc='Expressive powerful and flexible trace visualizer for post-mortem trace analysis (from BSC).'
 pkgver='4.12.0.20241204'
-pkgrel='4'
+pkgrel='5'
 arch=('x86_64')
 url='https://www.bsc.es/discover-bsc/organisation/scientific-structure/performance-tools'
 license=('LGPL-2.1-or-later')
@@ -12,7 +12,7 @@
         "wxParaver.desktop")
 sha512sums=(9d44e08cb0372d1bda5d859c8cdc3aa17e4ea211694969b520c85b79fb70cc9584a9f408403ca3f3153404cf66c3484c6891fa16d09fde3d297366b11fd684c1
             942fd0f3df5fb8fed60b5a56e29b3b5b3c8e84d1c81de254824224aa584fbd367371556c9b38ae7f6db97f1025919ba2ff8c6bf121d31e68e429693e431c4806
-            f1b000ea660765bbd454d9ae54d360233389121e54f8bcab241420b42aefa4f679735500efd43afdcd932f3a7bd339f00ff299f755a62163c1c3e34bd6920f6e)
+            50dd3ff677895b9aad9b17a67c6791f96acc2b9c5bf65b3991a1b92cb17c6567735a740188aaedcf211ca9bfbfb7ef758109d57296315afdd35707b49955cb3c)
 
 prepare() {
 	cd "$srcdir/$pkgname-${pkgver%.*}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 15:29:50	MEDIUM	1
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2