123-bin

maintainer audunmg · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code from the project's own GitHub repository and additional data files from archive.org, which is a non-standard but generally trustworthy host; the primary build is from a legitimate project source, and the archive.org files are static data images with no indication of executable code or remote code execution risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from the project's own GitHub repository and additional data files from archive.org, which is a non-standard but generally trustworthy host; the primary build is from a legitimate project source, and the archive.org files are static data images with no indication of executable code or remote code execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "https://archive.org/download/123-unix/123UNIX1.IMG"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Audun-Marius Gangstø <audun@gangsto.org>
    
      2pkgname=123-bin
    
      3pkgver=3.0
    
      4pkgrel=4
    
      5epoch=
    
      6pkgdesc="Create, modify, and process financial or scientific models."
    
      7arch=("i386" "i686" "x86_64")
    
      8url="https://github.com/taviso/123elf"
    
      9license=('unknown')
    
      10groups=()
    
      11depends=("lib32-ncurses")
    
      12makedepends=('unzip' 'cpio' 'gcc' 'binutils' 'xz' 'git')
    
      13checkdepends=()
    
      14optdepends=()
    
      15provides=('123')
    
      16conflicts=()
    
      17replaces=()
    
      18backup=()
    
      19options=()
    
      20install=
    
      21changelog=
    
      22BINUTILS_DL="https://ftp.gnu.org/gnu/binutils"
    
      23BINUTILS_XZ="binutils-2.38.tar.xz"
    
      24source=("${pkgname}::git+https://github.com/taviso/123elf.git"
    
      25"https://archive.org/download/123-unix/123UNIX1.IMG"
    
      26"https://archive.org/download/123-unix/123UNIX2.IMG"
    
      27"https://archive.org/download/123-unix/123UNIX3.IMG"
    
      28"https://archive.org/download/123-unix/123UNIX4.IMG"
    
      29"https://archive.org/download/123-unix/123UNIX5.IMG"
    
      30"$BINUTILS_DL/$BINUTILS_XZ"
    
      31)
    
      32noextract=(
    
      33'123UNIX1.IMG'
    
      34'123UNIX2.IMG'
    
      35'123UNIX3.IMG'
    
      36'123UNIX4.IMG'
    
      37'123UNIX5.IMG'
    
      38"$BINUTILS_XZ"
    
      39)
    
      40sha256sums=(
    
      41    'SKIP'
    
      42    '09996c4e8e33f83cacbde257ad4b04ca6b1432102b1d6eef28e64bdf5d6b7315'
    
      43    '4bdc6559105fbf9e2237b06a896b2ea34ecadef086bdc08b1ee2b4928ad51239'
    
      44    '336a30d68115b4f2a51c8aee4605b5f95d7bfd22e43c6a5779b9938563929f87'
    
      45    '5a2fdc33cde7056522aa47740460cd44873e4b8c3bb4d3891b06610e95dd4218'
    
      46    '444d28234594436334231aaa06431bee3323ce7e300ba8e7c62fe16c87c11681'
    
      47    'e316477a914f567eccc34d5d29785b8b0f5a10208d36bbacedcc39048ecfe024'
    
      48    )
    
      49validpgpkeys=()
    
      50
    
      51prepare() {
    
      52    cp 123UNIX1.IMG 123UNIX2.IMG 123UNIX3.IMG 123UNIX4.IMG 123UNIX5.IMG "$BINUTILS_XZ" "$pkgname"/
    
      53	cd "$pkgname"
    
      54    y | ./extract.sh
    
      55}
    
      56
    
      57build() {
    
      58    cd "$pkgname"
    
      59    KEYMAPS=""
    
      60    for k in xterm rxvt-unicode-256color xterm-256color rxvt terminology; do
    
      61        [ -e /usr/share/terminfo/${k:0:1}/$k ] && KEYMAPS="${KEYMAPS} ${k}";
    
      62    done
    
      63    ./binutils.sh || true
    
      64    PATH="$PWD:$PATH" make KEYMAPS="$KEYMAPS"
    
      65}
    
      66
    
      67check() {
    
      68	cd "$pkgname"
    
      69	make -k check
    
      70}
    
      71
    
      72package() {
    
      73	cd "$pkgname"
    
      74    mkdir -p "$pkgdir/usr/bin"
    
      75    make prefix="$pkgdir/usr" KEYMAPS="$KEYMAPS" install
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2