x3270
LOW
maintainer tuftedocelot
36 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source is a tarball from the project's official host (x3270.bgp.nu), which is not on the whitelist but is plausibly the project's own; it is built from source, not a prebuilt binary, and no malicious behavior is present.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official host (x3270.bgp.nu), which is not on the whitelist but is plausibly the project's own; it is built from source, not a prebuilt binary, and no malicious behavior is present.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=(http://x3270.bgp.nu/download/$pkgpath/suite3270-$pkgver-src.tgz
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: tuftedocelot <tuftedocelot@fastmail.fm>
2
# Co-Maintainer: Davide Girardi <davidegirardi googlesmtp>
3
# Contributor: Davbo <dave@davbo.org>
4
pkgname=x3270
5
pkgver=4.5ga5
6
pkgrel=1
7
pkgpath=04.05
8
pkgdesc="An IBM 3270 terminal emulator for the X Window System"
9
arch=('i686' 'x86_64')
10
url="http://x3270.bgp.nu/"
11
license=('BSD' 'MIT')
12
depends=('openssl' 'libxaw' 'xorg-mkfontdir' 'tcl')
13
makedepends=('openssl' 'libx11' 'libxaw' 'libxt' 'xbitmaps' 'xorg-bdftopcf' 'readline' 'ncurses' 'm4')
14
backup=(etc/x3270/ibm_hosts)
15
install=x3270.install
16
source=(http://x3270.bgp.nu/download/$pkgpath/suite3270-$pkgver-src.tgz
17
x3270.desktop)
18
19
sha256sums=('01576fa58598ccdd3d366febfaef61e3d1de93eb60a93f9ac6ba5faf84144c6f'
20
'bb3f1a301ca4f6d6d4f4cafe451945a55a9af7995d712a0f314fc58dfb16da6f')
21
22
build() {
23
# Time of the last modification to the source code, see:
24
# - https://reproducible-builds.org/docs/source-date-epoch/
25
# - https://reproducible-builds.org/specs/source-date-epoch/
26
#
27
# It should be something like:
28
# export SOURCE_DATE_EPOCH=$(stat --format='%Y' $srcdir/suite3270-${pkgver:0:3}/configure)
29
#
30
# but there is a bug in `mkversion.py`. I sent a patch to the author.
31
# Let's use this workaround in the mean time.
32
unset SOURCE_DATE_EPOCH
33
34
cd $srcdir/suite3270-${pkgver:0:3}
35
./configure --enable-unix --enable-c3270 --prefix=/usr --bindir=/usr/bin --sysconfdir=/etc --with-fontdir=/usr/share/fonts/3270
36
make -j$(grep processor -c /proc/cpuinfo) all || return 1
37
}
38
39
package() {
40
cd $srcdir/suite3270-${pkgver:0:3}
41
make DESTDIR=$pkgdir/ install || return 1
42
make DESTDIR=$pkgdir/ install.man || return 1
43
44
chmod 644 $pkgdir/etc/x3270/ibm_hosts
45
46
mkdir $pkgdir/usr/share/applications
47
mkdir $pkgdir/usr/share/pixmaps
48
install -m644 $srcdir/x3270.desktop $pkgdir/usr/share/applications/
49
install -m644 $srcdir/suite3270-${pkgver:0:3}/Common/x3270-icon2.xpm $pkgdir/usr/share/pixmaps/
50
}
51
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |