zig-mach
LOW
maintainer vitaliikuzhdin
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a source tarball from a non-whitelisted host (pkg.hexops.org), but verifies its integrity using minisign with a trusted public key from the official Zig project, ensuring authenticity and mitigating supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from a non-whitelisted host (pkg.hexops.org), but verifies its integrity using minisign with a trusted public key from the official Zig project, ensuring authenticity and mitigating supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:53
"https://pkg.hexops.org/zig/${_pkgsrc}.tar.xz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
2
3
_llvm=21
4
_basename="zig"
5
_suffix="-mach"
6
pkgname="${_basename}${_suffix}"
7
pkgver=0.16.0dev.3142+5ccfeb926
8
_pkgver="${pkgver//dev/-dev}"
9
pkgrel=1
10
pkgdesc="General-purpose programming language and toolchain for maintaining robust, optimal, and reusable software"
11
arch=(
12
# 'aarch64' # 'aarch64'
13
# 'armv7h' # 'arm'
14
# 'loong64' # 'loongarch64'
15
# 'powerpc64le' # 'powerpc64le'
16
# 'riscv64' # 'riscv64'
17
# 's390x' # 's390x'
18
# 'i686' # 'x86'
19
'x86_64' # 'x86_64'
20
)
21
url="https://machengine.org/docs/nominated-zig/"
22
license=(
23
'MIT'
24
)
25
depends=(
26
'glibc'
27
'libstdc++'
28
29
# "clang>=${_llvm}"
30
# "lld>=${_llvm}"
31
# "llvm-libs>=${_llvm}"
32
"clang${_llvm}"
33
"lld${_llvm}"
34
"llvm${_llvm}-libs"
35
)
36
makedepends=(
37
'cmake>=3.15'
38
'minisign'
39
40
# "llvm>=${_llvm}"
41
"llvm${_llvm}"
42
)
43
# checkdepends=( # checkdepends_x86_64
44
# 'lib32-glibc'
45
# )
46
options=(
47
'emptydirs'
48
'!lto'
49
'!strip'
50
)
51
_pkgsrc="${_basename}-${_pkgver}"
52
source=(
53
"https://pkg.hexops.org/zig/${_pkgsrc}.tar.xz"
54
"https://pkg.hexops.org/zig/${_pkgsrc}.tar.xz.minisig"
55
)
56
sha256sums=('7f0fcafcad7b32c0959b374bad725e9b9d120223ee517988ea9a067efce26a20'
57
'SKIP')
58
59
verify() {
60
# https://ziglang.org/download/
61
local ziglang_minisign="RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U"
62
63
minisign -V \
64
-P "${ziglang_minisign}" \
65
-m "${_pkgsrc}.tar.xz"
66
}
67
68
build() {
69
local cmake_options=(
70
-B "${_pkgsrc}/build"
71
-S "${_pkgsrc}"
72
-G 'Unix Makefiles'
73
-W no-dev
74
-D CMAKE_BUILD_TYPE:STRING='None'
75
-D CMAKE_INSTALL_PREFIX:PATH='/usr'
76
77
-D ZIG_VERSION:STRING="${_pkgver}"
78
-D ZIG_PIE:BOOL=ON
79
-D ZIG_SHARED_LLVM:BOOL=ON
80
-D ZIG_USE_LLVM_CONFIG:BOOL=ON
81
# -D ZIG_TARGET_TRIPLE:STRING='native-linux.6.6-gnu.2.42'
82
-D ZIG_TARGET_MCPU:STRING='baseline'
83
)
84
85
cd "${srcdir}"
86
cmake "${cmake_options[@]}"
87
cmake --build "${cmake_options[1]}"
88
89
cd "${_pkgsrc}"
90
DESTDIR="./fakeinstall" cmake --install "build"
91
}
92
93
# check() {
94
# cd "${srcdir}/${_pkgsrc}"
95
# # ugly workaround until test target is provided
96
# # https://github.com/ziglang/zig/issues/14240
97
# ./fakeinstall/usr/bin/zig build test \
98
# -Dconfig_h=build/config.h \
99
# -Dstatic-llvm=false \
100
# -Denable-llvm=true \
101
# -Dskip-non-native=true
102
# }
103
104
package() {
105
cd "${srcdir}/${_pkgsrc}"
106
install -vDm644 "README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
107
install -vDm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
108
109
install -vd "${pkgdir}/opt/${pkgname}/lib" "${pkgdir}/usr/bin" "${pkgdir}/usr/lib"
110
111
cd "fakeinstall/usr"
112
cp -va --no-preserve=ownership "bin" -T "${pkgdir}/opt/${pkgname}"
113
cd "lib"
114
cp -a --no-preserve=ownership "${_basename}" -T "${pkgdir}/opt/${pkgname}/lib"
115
116
ln -vsf "/opt/${pkgname}/${_basename}" "${pkgdir}/usr/bin/${pkgname}"
117
ln -vsf "/opt/${pkgname}/lib" "${pkgdir}/usr/lib/${pkgname}"
118
}
119
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |