xfhell-gtk3
LOW
maintainer not_anonymous
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a tarball from a personal domain (qsl.net) not on the whitelist, but it is the project's own source code being built normally; checksums are provided and the package does not execute remote code or install prebuilt binaries.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a personal domain (qsl.net) not on the whitelist, but it is the project's own source code being built normally; checksums are provided and the package does not execute remote code or install prebuilt binaries.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
source=("http://www.qsl.net/5b4az/pkg/$_pkgname/$_pkgname-$pkgver.tar.bz2"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: not_anonymous <nmlibertarian@gmail.com>
2
# Original Contributor: Bob Finch <w9ya@arrl.net>
3
4
pkgname=xfhell-gtk3
5
_pkgname=xfhell
6
pkgver=3.5.2
7
pkgrel=1
8
pkgdesc="Ham Radio - GTK3 app - de/en-codes Hellschreiber signals."
9
arch=('i686' 'x86_64')
10
url="http://www.qsl.net/5b4az/pkg/xfhell/xfhell.html"
11
license=(GPL3)
12
depends=('gtk3' 'alsa-lib' 'hamradio-menus')
13
makedepends=('autoconf' 'automake' 'intltool' 'imagemagick' 'pkg-config')
14
options=('!emptydirs')
15
provides=(xfhell)
16
conflicts=(xfhell)
17
source=("http://www.qsl.net/5b4az/pkg/$_pkgname/$_pkgname-$pkgver.tar.bz2"
18
$_pkgname.desktop
19
$_pkgname.1)
20
21
build() {
22
cd $srcdir/$_pkgname-$pkgver
23
24
./autogen.sh
25
./configure --prefix=/usr
26
make
27
}
28
29
check() {
30
cd $srcdir/$_pkgname-$pkgver
31
32
make check
33
}
34
35
package() {
36
cd $srcdir/$_pkgname-$pkgver
37
38
mkdir -p $pkgdir/usr/share/doc/$_pkgname/examples/
39
mkdir -p $pkgdir/usr/share/{applications,pixmaps,man/man1}
40
make DESTDIR=$pkgdir install
41
42
mkdir -p $pkgdir/usr/bin
43
mv $pkgdir/usr/bin/$_pkgname $pkgdir/usr/bin/$_pkgname.1
44
install -D -m 755 ../$_pkgname.1 $pkgdir/usr/bin/$_pkgname
45
46
install -Dm644 $_pkgname/xfhellrc $pkgdir/usr/share/doc/$_pkgname/examples/xfhellrc.example
47
48
rm $pkgdir/usr/share/doc/$_pkgname/$_pkgname.1.gz
49
50
install -Dm755 ../$_pkgname.desktop $pkgdir/usr/share/applications/$_pkgname.desktop
51
install -Dm755 $_pkgname/$_pkgname.svg $pkgdir/usr/share/pixmaps/$_pkgname.svg
52
}
53
md5sums=('0a2ea20cc8fd6a2225ef09b9810818bb'
54
'9a3568a6dbdd2bfb90aa76adf2dc531f'
55
'4c8296c0475d78d5fd3de879c4742648')
56
sha256sums=('7b16ecdaa425ebc19f7e555fe28473e0228ea344e0203062a4e408346e75b209'
57
'a4bdba7b601bace48e15bd2dc6f0daadd8a10511242cbb2fdc17bf78a19647b5'
58
'f0beac04651d70dd27fe021894665967b1531a6f90e6402dee77b3005f63cd3e')
59
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |