zig-mach
LOW
maintainer vitaliikuzhdin
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source is a tarball from a non-whitelisted host, but it is verified using minisign with a trusted public key from the official Zig project, ensuring authenticity and integrity; the package builds from verifiable source code, not a prebuilt binary, and the host, while not standard, is used consistently by the project maintainer for distribution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is a tarball from a non-whitelisted host, but it is verified using minisign with a trusted public key from the official Zig project, ensuring authenticity and integrity; the package builds from verifiable source code, not a prebuilt binary, and the host, while not standard, is used consistently by the project maintainer for distribution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:53
"https://pkg.hexops.org/zig/${_pkgsrc}.tar.xz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
2
3
_llvm=22
4
_basename="zig"
5
_suffix="-mach"
6
pkgname="${_basename}${_suffix}"
7
pkgver=0.17.0dev.2228+955228b68
8
_pkgver="${pkgver//dev/-dev}"
9
pkgrel=1
10
pkgdesc="General-purpose programming language and toolchain for maintaining robust, optimal, and reusable software"
11
arch=(
12
# 'aarch64' # 'aarch64'
13
# 'armv7h' # 'arm'
14
# 'loong64' # 'loongarch64'
15
# 'powerpc64le' # 'powerpc64le'
16
# 'riscv64' # 'riscv64'
17
# 's390x' # 's390x'
18
# 'i686' # 'x86'
19
'x86_64' # 'x86_64'
20
)
21
url="https://machengine.org/docs/nominated-zig/"
22
license=(
23
'MIT'
24
)
25
depends=(
26
'glibc'
27
'libstdc++'
28
29
"clang>=${_llvm}"
30
"lld>=${_llvm}"
31
"llvm-libs>=${_llvm}"
32
# "clang${_llvm}"
33
# "lld${_llvm}"
34
# "llvm${_llvm}-libs"
35
)
36
makedepends=(
37
'cmake>=3.15'
38
'minisign'
39
40
"llvm>=${_llvm}"
41
# "llvm${_llvm}"
42
)
43
# checkdepends=( # checkdepends_x86_64
44
# 'lib32-glibc'
45
# )
46
options=(
47
'emptydirs'
48
'!lto'
49
'!strip'
50
)
51
_pkgsrc="${_basename}-${_pkgver}"
52
source=(
53
"https://pkg.hexops.org/zig/${_pkgsrc}.tar.xz"
54
"https://pkg.hexops.org/zig/${_pkgsrc}.tar.xz.minisig"
55
)
56
sha256sums=('fa2bf6c72194fd311b72f7cc77ef9df409a7cf2e886f8a0edd04b46cd2e232d5'
57
'SKIP')
58
59
verify() {
60
# https://ziglang.org/download/
61
local ziglang_minisign="RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U"
62
63
minisign -V \
64
-P "${ziglang_minisign}" \
65
-m "${_pkgsrc}.tar.xz"
66
}
67
68
build() {
69
local cmake_options=(
70
-B "${_pkgsrc}/build"
71
-S "${_pkgsrc}"
72
-G 'Unix Makefiles'
73
-W no-author
74
-D CMAKE_BUILD_TYPE:STRING='None'
75
-D CMAKE_INSTALL_PREFIX:PATH='/usr'
76
77
-D ZIG_VERSION:STRING="${_pkgver}"
78
-D ZIG_PIE:BOOL=ON
79
-D ZIG_SHARED_LLVM:BOOL=ON
80
-D ZIG_USE_LLVM_CONFIG:BOOL=ON
81
# -D ZIG_TARGET_TRIPLE:STRING='native-linux.6.6-gnu.2.42'
82
-D ZIG_TARGET_MCPU:STRING='baseline'
83
)
84
85
cd "${srcdir}"
86
cmake "${cmake_options[@]}"
87
cmake --build "${cmake_options[1]}"
88
89
cd "${_pkgsrc}"
90
DESTDIR="./fakeinstall" cmake --install "build"
91
}
92
93
# check() {
94
# cd "${srcdir}/${_pkgsrc}"
95
# # ugly workaround until test target is provided
96
# # https://github.com/ziglang/zig/issues/14240
97
# ./fakeinstall/usr/bin/zig build test \
98
# -Dconfig_h=build/config.h \
99
# -Dstatic-llvm=false \
100
# -Denable-llvm=true \
101
# -Dskip-non-native=true
102
# }
103
104
package() {
105
cd "${srcdir}/${_pkgsrc}"
106
install -vDm644 "README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
107
install -vDm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
108
109
install -vd "${pkgdir}/opt/${pkgname}/lib" "${pkgdir}/usr/bin" "${pkgdir}/usr/lib"
110
111
cd "fakeinstall/usr"
112
cp -va --no-preserve=ownership "bin" -T "${pkgdir}/opt/${pkgname}"
113
cd "lib"
114
cp -a --no-preserve=ownership "${_basename}" -T "${pkgdir}/opt/${pkgname}/lib"
115
116
ln -vsf "/opt/${pkgname}/${_basename}" "${pkgdir}/usr/bin/${pkgname}"
117
ln -vsf "/opt/${pkgname}/lib" "${pkgdir}/usr/lib/${pkgname}"
118
}
119
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |