qemu-3dfx

maintainer kharovtobi · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source uses a non-whitelisted host (download.qemu.org) for the QEMU tarball, but this is the official upstream release site; the package builds from verifiable source and the checksum is provided, so the risk is low despite the analyzer flag.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source uses a non-whitelisted host (download.qemu.org) for the QEMU tarball, but this is the official upstream release site; the package builds from verifiable source and the checksum is provided, so the risk is low despite the analyzer flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:103 "https://download.qemu.org/qemu-${_pkgver}.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kharovtobi <tugboat_khatov at outlook dot com>
    
      2
    
      3pkgname=qemu-3dfx
    
      4_pkgver=9.2.2
    
      5pkgver=9.2.2.r466.a2d25b3
    
      6pkgrel=1
    
      7pkgdesc="MESA GL/3Dfx Glide pass-through for QEMU"
    
      8arch=('x86_64')
    
      9url="https://github.com/kjliew/qemu-3dfx"
    
      10license=('GPL-2.0')
    
      11depends=('qemu-base' 'seabios')
    
      12makedepends=(
    
  "alsa-lib"
    
  "brltty"
    
  "bzip2"
    
  "cairo"
    
  "capstone"
    
  "cdrtools"
    
  "coreutils"
    
  "curl"
    
  "djgpp-binutils"
    
  "djgpp-djcrx"
    
  "djgpp-gcc"
    
  "dos2unix"
    
  "dtc"
    
  "fuse3"
    
  "gcc-libs"
    
  "gdk-pixbuf2"
    
  "git"
    
  "glib2"
    
  "glibc"
    
  "glib2-devel"
    
  "glusterfs"
    
  "gnutls"
    
  "gtk3"
    
  "jack"
    
  "keyutils"
    
  "libaio"
    
  "libbpf"
    
  "libcacard"
    
  "libcap-ng"
    
  "libepoxy"
    
  "libiscsi"
    
  "libnfs"
    
  "libpipewire"
    
  "libpng"
    
  "libpulse"
    
  "libsasl"
    
  "libseccomp"
    
  "libslirp"
    
  "libssh"
    
  "liburing"
    
  "libusb"
    
  "libx11"
    
  "libxdp"
    
  "libxkbcommon"
    
  "libxml2"
    
  "lzo"
    
  "mesa"
    
  "meson"
    
  "multipath-tools"
    
  "mingw-w64-binutils"
    
  "mingw-w64-gcc"
    
  "mingw-w64-tools"
    
  "ncurses"
    
  "ninja"
    
  "ndctl"
    
  "openwatcom-v2"
    
  "numactl"
    
  "patch"
    
  "pam"
    
  "pcre2"
    
  "python"
    
  "python-setuptools"
    
  "python-distlib"
    
  "python-pip"
    
  "python-sphinx"
    
  "python-sphinx_rtd_theme"
    
  "pixman"
    
  "rsync"
    
  "sdl2"
    
  "sdl2_image"
    
  "snappy"
    
  "spice"
    
  "spice-protocol"
    
  "systemd"
    
  "usbredir"
    
  "vde2"
    
  "virglrenderer"
    
  "vte3"
    
  "xxd"
    
  "zlib"
    
  "zstd"
    
      94)
    
      95optdepends=(
    
  "qemu-docs: for documentation and learning invocation"
    
  "openglide-3dfx: for host openglide support"
    
      98)
    
      99provides=('qemu-3dfx')
    
      100conflicts=('qemu-3dfx')
    
      101source=(
    
  "git+https://github.com/kjliew/qemu-3dfx.git"
    
  "https://download.qemu.org/qemu-${_pkgver}.tar.xz"
    
  "${pkgname}.install"
    
      105)
    
      106noextract=("qemu-${_pkgver}.tar.xz")
    
      107sha256sums=(
    
  'SKIP'
    
  '752eaeeb772923a73d536b231e05bcc09c9b1f51690a41ad9973d900e4ec9fbf'
    
  'b94ec59a18f2fc8c0eda31860d2eeed2bf92fe66db773b917de311dece796bf0'
    
      111)
    
      112install=${pkgname}.install
    
      113
    
      114pkgver() {
    
  cd "$srcdir"/"$pkgname"
    
  echo ${_pkgver}.r$(git rev-list --count HEAD).$(git rev-parse --short=7 HEAD)
    
      117}
    
      118
    
      119prepare() {
    
  cd "$srcdir"/
    
  tar xf qemu-${_pkgver}.tar.xz -C "$pkgname"
    
  cd "$pkgname"/qemu-${_pkgver}
    
  rsync -r ../qemu-0/hw/3dfx ../qemu-1/hw/mesa ./hw/
    
      124
    
  # Change patch per major release
    
  patch -p0 -i  ../00-qemu92x-mesa-glide.patch
    
      127
    
  bash ../scripts/sign_commit
    
  rm -rf "$srcdir"/"$pkgname"/build
    
  mkdir -p "$srcdir"/"$pkgname"/build
    
      131}
    
      132
    
      133build() {
    
  # Build QEMU
    
  cd "$srcdir"/"$pkgname"/build
    
  ../qemu-${_pkgver}/configure --target-list="i386-softmmu" --prefix=/usr --disable-xen --extra-cflags="-march=native -mtune=native -O3 -flto=auto"
    
  make clean
    
  make qemu-system-i386
    
      139
    
  # Build Wrappers
    
  source /opt/watcom/owsetenv.sh
    
  cd ../wrappers/3dfx
    
  rm -rf build && mkdir build && cd build
    
  bash ../../../scripts/conf_wrapper
    
  sed -i 's/^DXEGEN=dxe3gen$/DXEGEN=i686-pc-msdosdjgpp-dxe3gen/' ../dxe/Makefile
    
  sed -i '/CFLAGS=/s/-mfpmath=sse /-mfpmath=sse -msse2 /' Makefile
    
  make && make clean
    
  cd ../../mesa
    
  rm -rf build && mkdir build && cd build
    
  bash ../../../scripts/conf_wrapper
    
      151
    
  # Add wglinfo.exe to makefile (and fix sse2 problem)
    
  sed -i 's/^TOOLS=$/TOOLS=wglinfo.exe/' Makefile
    
  sed -i '/CFLAGS=/s/-mfpmath=sse /-mfpmath=sse -msse2 /' Makefile
    
  make && make clean
    
      156
    
  # Package Wrappers
    
  cd ../../
    
  rm -rf iso && mkdir iso && cd iso
    
  mkdir wrapfx wrapgl
    
  cp -rf ../3dfx/build/*.{vxd,sys,dll,dxe,ovl,exe} ./wrapfx/
    
  cp -rf ../mesa/build/*.{dll,exe} ./wrapgl/
    
  cp ../../LICENSE license.txt
    
  echo ${pkgver} > commit\ id.txt
    
  unix2dos commit\ id.txt license.txt
    
  mkisofs -JR -V "VMWRAPPER-$(git log --format="%h" -n 1)" -o ../wrappers.iso ../iso
    
      167}
    
      168
    
      169package() {
    
  install -Dm644 "$srcdir"/"$pkgname"/LICENSE "$pkgdir"/usr/share/licenses/"$pkgname"/LICENSE
    
  install -Dm644 "$srcdir"/"$pkgname"/wrappers/wrappers.iso "$pkgdir"/usr/share/"$pkgname"/wrappers.iso
    
  install -Dm755 "$srcdir"/"$pkgname"/build/qemu-system-i386 "$pkgdir"/usr/bin/qemu-3dfx-system-i386
    
  mkdir -p "$pkgdir"/usr/share/man/man1/
    
  ln -sf /usr/share/man/man1/qemu.1.gz "$pkgdir"/usr/share/man/man1/qemu-3dfx-system-i386.1.gz
    
      175}
    
      176

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2