snort

maintainer robertfoster · 67 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code from the official project's GitHub and snort.org domains, which are plausibly legitimate; the non-whitelisted host is the project's own download infrastructure, and the build process compiles source code normally, posing minimal risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from the official project's GitHub and snort.org domains, which are plausibly legitimate; the non-whitelisted host is the project's own download infrastructure, and the build process compiles source code normally, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 "snort-openappid-${_openappid}.tar.gz::https://snort.org/downloads/openappid/${_openappid}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: robertfoster
    
      2# Contributor: Amish <contact at via dot aur>
    
      3# Contributor: Lukas Fleischer <archlinux at cryptocrack dot de>
    
      4# Contributor: Hugo Doria <hugo@archlinux.org>
    
      5# Contributor: Kessia 'even' Pinheiro <kessiapinheiro at gmail.com>
    
      6# Contributor: dorphell <dorphell@archlinux.org>
    
      7# Contributor: Gregor Ibic <gregor.ibic@intelicom.si>
    
      8# Contributor: Netboy3
    
      9
    
      10pkgname=snort
    
      11_pkgname=snort3
    
      12_openappid=33380
    
      13pkgver=3.12.2.0 # renovate: datasource=github-releases depName=snort3/snort3
    
      14pkgrel=1
    
      15pkgdesc='A lightweight network IDS /IPS with OpenAppID support.'
    
      16arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64' 'arm')
    
      17url='https://www.snort.org'
    
      18license=('GPL')
    
      19depends=('gperftools' 'hwloc' 'hyperscan' 'libdaq' 'libdnet' 'libmnl' 'libpcap' 'libunwind' 'luajit' 'lz4' 'openssl' 'pcre2' 'pulledpork' 'xz' 'zlib')
    
      20makedepends=('cmake' 'pkgconf')
    
      21backup=('etc/snort/snort.lua'
    
      22  'etc/snort/snort_defaults.lua'
    
      23  'etc/snort/local.lua'
    
      24  'etc/snort/homenet.lua'
    
      25  'etc/snort/rules/local.rules'
    
      26  'etc/snort/rules/snort.rules'
    
      27  'etc/snort/lists/default.blocklist'
    
      28  'etc/snort/lists/default.allowlist'
    
      29  'etc/logrotate.d/snort')
    
      30install='snort.install'
    
      31source=("${_pkgname}-${pkgver}.tar.gz::https://github.com/snort3/snort3/archive/refs/tags/${pkgver}.tar.gz"
    
      32  "snort-openappid-${_openappid}.tar.gz::https://snort.org/downloads/openappid/${_openappid}"
    
      33  'tcmjem.patch'
    
      34  'cstdint.patch'
    
      35  'local.lua'
    
      36  'snort.logrotate'
    
      37  'snort.sysusers'
    
      38  'snort.tmpfiles'
    
      39  'snort.service')
    
      40
    
      41prepare() {
    
      42  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      43  patch -p0 <"${srcdir}"/tcmjem.patch
    
      44  patch -p0 <"${srcdir}"/cstdint.patch
    
      45  # Workaround https://github.com/intel/hyperscan/issues/388
    
      46  sed -i '/HAVE_HS_COMPILE_LIT/d' config.cmake.h.in cmake/sanity_checks.cmake
    
      47}
    
      48
    
      49build() {
    
      50  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      51  ./configure_cmake.sh --prefix=/usr --enable-tcmalloc --with-daq-libraries=/usr/lib/daq/ --disable-static-daq
    
      52  make -C build
    
      53}
    
      54
    
      55package() {
    
      56  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      57  make -C build DESTDIR="${pkgdir}" install
    
      58
    
      59  mv "${pkgdir}"{/usr,}/etc
    
      60  install -D -m644 "${srcdir}"/local.lua "${pkgdir}"/etc/snort
    
      61  install -D -m644 "${srcdir}"/snort.logrotate "${pkgdir}"/etc/logrotate.d/snort
    
      62  install -D -m644 "${srcdir}"/snort.tmpfiles "${pkgdir}"/usr/lib/tmpfiles.d/snort.conf
    
      63  install -D -m644 "${srcdir}"/snort.sysusers "${pkgdir}"/usr/lib/sysusers.d/snort.conf
    
      64  install -D -m644 "${srcdir}"/snort.service "${pkgdir}"/usr/lib/systemd/system/snort.service
    
      65  install -D -m644 /dev/null "${pkgdir}"/etc/snort/rules/snort.rules
    
      66  install -D -m644 /dev/null "${pkgdir}"/etc/snort/lists/default.blocklist
    
      67  install -D -m644 /dev/null "${pkgdir}"/etc/snort/lists/default.allowlist
    
      68  echo "HOME_NET = [[ 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ]]" >"${pkgdir}"/etc/snort/homenet.lua
    
      69  echo -e '#pulledpork will put rules here in snort.rules\n#alert icmp any any -> any any ( msg:"ICMP Traffic Detected"; sid:10000001; metadata:policy security-ips alert; )' >"${pkgdir}"/etc/snort/rules/local.rules
    
      70  chmod 0644 "${pkgdir}"/etc/snort/{homenet.lua,rules/{local,snort}.rules}
    
      71
    
      72  # rule files and other settings
    
      73  sed -i -e "/^EXTERNAL_NET\\s\\+=/ a include 'homenet.lua'" \
    
      74    -e "/^HOME_NET\\s\\+=/ i -- we set HOME_NET and EXTERNAL_NET here or via an included file" \
    
      75    -e 's/^\(HOME_NET\s\+=\)/--\1/g' \
    
      76    -e 's/^\(EXTERNAL_NET\s\+=\)/--\1/g' \
    
      77    "${pkgdir}"/etc/snort/snort.lua
    
      78  sed -i -e "s/^\\(RULE_PATH\\s\\+=\\).*/\\1 'rules'/g" \
    
      79    -e "s/^\\(BUILTIN_RULE_PATH\\s\\+=\\).*/\\1 'builtin_rules'/g" \
    
      80    -e "s/^\\(PLUGIN_RULE_PATH\\s\\+=\\).*/\\1 'so_rules'/g" \
    
      81    -e "s/^\\(WHITE_LIST_PATH\\s\\+=\\).*/\\1 'lists'/g" \
    
      82    -e "s/^\\(BLACK_LIST_PATH\\s\\+=\\).*/\\1 'lists'/g" \
    
      83    "${pkgdir}"/etc/snort/snort_defaults.lua
    
      84
    
      85  # OpenAppID files
    
      86  install -d -m755 "${pkgdir}"/usr/lib/openappid/custom/{libs,lua,port}
    
      87  cp -a --no-preserve=ownership -t "${pkgdir}"/usr/lib/openappid/ "${srcdir}"/odp
    
      88
    
      89}
    
      90
    
      91sha256sums=(
    
      92  '43000d6b0e0307bc1a735874d00deb61e8b6a96d074f8cc9b2fe2cde0058720b'
    
      93  '3046c5af1dd81a104f13d8e895226ef64bca7fa358238fb5f29c659081eaee2a'
    
      94  'b7797a2479798c7c055173bb606fb537fb53f5c867f967d47477211193ffe86d'
    
      95  '1b21659bbf12389c8d322d939b6c849406c0845d98d771b6e295715a0042ceec'
    
      96  'b61d6492f86c7d79c1a76d1394d099403981aac7f371b1fe22ddd8a4bb15c87c'
    
      97  'a8a7684a676da5cd55c2b5ab012dac3d14c5a6c62f6e37c4913ba1dbe506088e'
    
      98  'ae3245c5de527fb487c459f2f4a9c78803ae6341e9c81b9a404277679cdee051'
    
      99  'bc4a02d184601faba5cd0f6cb454097a3b04a0c8fe56f5f8b36d24513484faa2'
    
      100  'cb1108ab0a6ad38981a6f308b0ae2b276b68d08bfa0e38c036eae277b38b28d8'
    
      101)
    
      102

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2