xtensa-elf-gcc
LOW
maintainer mak1
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source URL for isl is from sourceforge.io, a legitimate and widely used open-source hosting platform; the 'non-standard host' flag is a false positive, and the package builds from verifiable upstream sources with proper PGP verification for GCC.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URL for isl is from sourceforge.io, a legitimate and widely used open-source hosting platform; the 'non-standard host' flag is a false positive, and the package builds from verifiable upstream sources with proper PGP verification for GCC.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
https://libisl.sourceforge.io/isl-$_islver.tar.bz2
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: whiteman808 <whiteman808 at paraboletancza dot org>
2
# Contributor: David P. <megver83@parabola.nu>
3
4
_target=xtensa-elf
5
pkgname=$_target-gcc
6
_pkgver=15.2.0
7
pkgver=$_pkgver
8
_islver=0.27
9
pkgrel=1
10
pkgdesc='The GNU Compiler Collection - cross compiler for Xtensa (bare-metal) target'
11
arch=(x86_64 i686 armv7h)
12
url='http://gcc.gnu.org/'
13
license=(GPL LGPL FDL)
14
depends=($_target-binutils libmpc zlib)
15
makedepends=(gmp mpfr)
16
options=(!emptydirs !strip)
17
source=(https://gcc.gnu.org/pub/gcc/releases/gcc-$_pkgver/gcc-$_pkgver.tar.xz{,.sig}
18
https://libisl.sourceforge.io/isl-$_islver.tar.bz2
19
gcc.patch)
20
sha512sums=('89047a2e07bd9da265b507b516ed3635adb17491c7f4f67cf090f0bd5b3fc7f2ee6e4cc4008beef7ca884b6b71dffe2bb652b21f01a702e17b468cca2d10b2de'
21
'SKIP'
22
'e14ab1a622d3f6219b264b8e2512487aecd6725b7b88f40bc8f31651bfe7d89db4649aae12eaa0052dd904bac21607f63c83fbab73251767425d91989a969f7e'
23
'7637408259cef4b14a2f41690bbc769ad0dc6cf4d1c782405526aeb58f68193269af6882b23fb57c3521174e45709ed2d54f0af1f835646e70a3bfd9f626aad9')
24
validpgpkeys=(33C235A34C46AA3FFB293709A328C3A2C3C45C06 # Jakub Jelinek <jakub@redhat.com>
25
13975A70E63C361C73AE69EF6EEB81F8981C74C7) # Richard Guenther <richard.guenther@gmail.com>
26
if [ -n "$_snapshot" ]; then
27
_basedir=gcc-$_snapshot
28
else
29
_basedir=gcc-$_pkgver
30
fi
31
32
prepare() {
33
cd $_basedir
34
35
patch -Np1 -i ../gcc.patch
36
37
# link isl for in-tree builds
38
ln -sf ../isl-$_islver isl
39
40
echo $_pkgver >gcc/BASE-VER
41
42
# hack! - some configure tests for header files using "$CPP $CPPFLAGS"
43
sed -i "/ac_cpp=/s/\$CPPFLAGS/\$CPPFLAGS -O2/" "$srcdir"/$_basedir/{libiberty,gcc}/configure
44
45
mkdir $srcdir/gcc-build
46
}
47
48
build() {
49
cd gcc-build
50
51
# using -pipe causes spurious test-suite failures
52
# http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48565
53
CFLAGS=${CFLAGS/-pipe/}
54
CXXFLAGS=${CXXFLAGS/-pipe/}
55
56
CFLAGS+=" -Wno-error=format-security"
57
CXXFLAGS+=" -Wno-error=format-security"
58
59
$srcdir/$_basedir/configure \
60
--target=$_target \
61
--prefix=/usr \
62
--libexecdir=/usr/lib \
63
--enable-languages=c,c++ \
64
--enable-plugins \
65
--enable-shared \
66
--disable-decimal-float \
67
--disable-libffi \
68
--disable-libgomp \
69
--disable-libmudflap \
70
--disable-libquadmath \
71
--disable-libssp \
72
--disable-libstdcxx-pch \
73
--disable-nls \
74
--disable-threads \
75
--disable-tls \
76
--disable-multilib \
77
--with-gnu-as \
78
--with-gnu-ld \
79
--with-system-zlib \
80
--with-gmp \
81
--with-mpfr \
82
--with-mpc \
83
--with-isl \
84
--with-libelf \
85
--enable-gnu-indirect-function
86
87
make all-gcc
88
}
89
90
package() {
91
make -C gcc-build DESTDIR="$pkgdir" install-gcc
92
93
# strip target binaries
94
find "$pkgdir"/usr/lib/gcc/$_target/ \
95
-type f -and \( -name \*.a -or -name \*.o \) \
96
-exec $_target-objcopy -R .comment -R .note -R .debug_info -R .debug_aranges \
97
-R .debug_pubnames -R .debug_pubtypes -R .debug_abbrev -R .debug_line \
98
-R .debug_str -R .debug_ranges -R .debug_loc '{}' \;
99
100
# strip host binaries
101
find "$pkgdir/usr/bin/" "$pkgdir/usr/lib/gcc/$_target/" -type f \
102
-and \( -executable \) -exec strip '{}' \;
103
104
# Remove files that conflict with host gcc package
105
rm -r "$pkgdir/usr/share/"{man/man7,info}
106
}
107
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |