xfhell

LOW

maintainer not_anonymous 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a tarball from a personal website (qsl.net) not on the whitelist, but it is the project's own source code being built, with provided and matching checksums, posing low risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a personal website (qsl.net) not on the whitelist, but it is the project's own source code being built, with provided and matching checksums, posing low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("http://www.qsl.net/5b4az/pkg/$pkgname/$pkgname-$pkgver.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: not_anonymous <nmlibertarian@gmail.com>
    
      2# Original Contributor: Bob Finch <w9ya@arrl.net>
    
      3
    
      4pkgname=xfhell
    
      5pkgver=3.3
    
      6pkgrel=2
    
      7pkgdesc="Ham Radio - OLDER GTK2 version - de/en-codes Hellschreiber signals."
    
      8arch=('i686' 'x86_64')
    
      9url="http://www.qsl.net/5b4az/pkg/xfhell/xfhell.html"
    
      10license=(GPL3)
    
      11depends=('gtk2' 'alsa-lib' 'hamradio-menus')
    
      12makedepends=('autoconf' 'automake' 'intltool' 'pkg-config')
    
      13# 'imagemagick: used IF you want to convert icons/images')
    
      14options=('!emptydirs')
    
      15provides=(xfhell)
    
      16conflicts=(xfhell-gtk3)
    
      17source=("http://www.qsl.net/5b4az/pkg/$pkgname/$pkgname-$pkgver.tar.bz2"
    
      18	diff.autogen.sh
    
      19	diff.Makefile.am
    
      20	$pkgname.desktop
    
      21	xdemorse.png
    
      22	$pkgname.1)
    
      23
    
      24prepare() {
    
      25	cd $srcdir/$pkgname-$pkgver
    
      26
    
      27	patch -p0 < ../diff.autogen.sh
    
      28	patch -p0 < ../diff.Makefile.am
    
      29
    
      30	sed -i s:xpm:png: Makefile.am
    
      31	mkdir files/
    
      32#	convert files/$pkgname.xpm files/$pkgname.png
    
      33	install -m644 ../$pkgname.desktop files/$pkgname.desktop
    
      34	install -m644 ../xdemorse.png files/$pkgname.png
    
      35}
    
      36
    
      37build() {
    
      38	cd $srcdir/$pkgname-$pkgver
    
      39
    
      40	./autogen.sh
    
      41	./configure --prefix=/usr
    
      42	make
    
      43}
    
      44
    
      45check() {
    
      46	cd $srcdir/$pkgname-$pkgver
    
      47
    
      48#	make check
    
      49	make -i check	# sadly the intl. files. are not correct (sigh)
    
      50}
    
      51
    
      52package() {
    
      53	cd $srcdir/$pkgname-$pkgver
    
      54
    
      55	mkdir -p $pkgdir/usr/share/{applications,pixmaps,$pkgname,doc/$pkgname}
    
      56	make DESTDIR=$pkgdir install
    
      57
    
      58	mkdir -p $pkgdir/usr/bin
    
      59	mv $pkgdir/usr/bin/$pkgname $pkgdir/usr/bin/$pkgname.1
    
      60	install -D -m 755 ../$pkgname.1 $pkgdir/usr/bin/$pkgname
    
      61}
    
      62md5sums=('4bf34e4ba47ee886e47bd1d631f6a4c5'
    
      63         '0dc3caa8b1acd87b453bd0acef17b034'
    
      64         'f5b10bc9c510cb359b6cb626d628aab9'
    
      65         '9a3568a6dbdd2bfb90aa76adf2dc531f'
    
      66         'edcd3f301ec8ea95453d40534beb6ede'
    
      67         'f1b4aee1d96afc2a5aa2aed475914ce4')
    
      68sha256sums=('527f3139ece4596de6c83a8504da8c13b45359b25661d9a56c10eb30d3a92c21'
    
      69            '335a1b0407d45a2abd6260564ca50bea04e02485cc41c59a835341fa0e5dd1ee'
    
      70            '2484d70e867515fbe49fff2463a1ef8ecee02f1feb36ef4deec8fd24fcea0f7b'
    
      71            'a4bdba7b601bace48e15bd2dc6f0daadd8a10511242cbb2fdc17bf78a19647b5'
    
      72            '857eb46c32c12333a7110fb3ea99d2246084724856638f2e04324fc2a576626d'
    
      73            'e98727d5dd44ef65854b0735f45e7fbee19102d182b872bbd56b048d45a1f4a4')
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2