xwxapt

LOW

maintainer not_anonymous 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a tarball from a personal domain (qsl.net) not on the standard whitelist, but it is the project's own source code being built, with provided and matching checksums, and no evidence of executable payloads or malicious behavior.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a personal domain (qsl.net) not on the standard whitelist, but it is the project's own source code being built, with provided and matching checksums, and no evidence of executable payloads or malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=(http://www.qsl.net/5b4az/pkg/$_pkgname/$pkgname/$pkgname-$pkgver.tar.bz2

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: not_anonymous <nmlibertarian@gmail.com>
    
      2# Contributor: WB2FKO <mph at sportscliche dot com>
    
      3# Original Contributor: Bob Finch <w9ya@arrl.net>
    
      4
    
      5pkgname=xwxapt
    
      6_pkgname=apt
    
      7pkgver=3.4.2
    
      8pkgrel=1
    
      9pkgdesc="Ham Radio - Weather Satellite APT format image decoder using X/GTK+"
    
      10arch=('i686' 'x86_64')
    
      11url="http://www.qsl.net/5b4az/pkg/$pkgname/$pkgname.html"
    
      12license=(GPL)
    
      13depends=('gtk3' 'rtl-sdr' 'hamradio-menus')
    
      14makedepends=('autoconf' 'automake' 'intltool' 'pkg-config')
    
      15source=(http://www.qsl.net/5b4az/pkg/$_pkgname/$pkgname/$pkgname-$pkgver.tar.bz2
    
      16	$pkgname.desktop
    
      17	$pkgname.1
    
      18	xdemorse.png
    
      19	diff.Makefile.am
    
      20)
    
      21
    
      22prepare() {
    
      23	cd $srcdir/$pkgname-$pkgver
    
      24
    
      25	patch -p0 < ../diff.Makefile.am
    
      26}
    
      27
    
      28build() {
    
      29	cd $srcdir/$pkgname-$pkgver
    
      30
    
      31#	export LDFLAGS="-lm $LDFLAGS"
    
      32	./autogen.sh
    
      33	./configure --prefix=/usr
    
      34	make
    
      35}
    
      36
    
      37check() {
    
      38	cd $srcdir/$pkgname-$pkgver
    
      39
    
      40#	make check
    
      41	make -i check	# sadly the intl. files. are not correct (sigh)
    
      42}
    
      43
    
      44package() {
    
      45	cd $srcdir/$pkgname-$pkgver
    
      46
    
      47	mkdir -p $pkgdir/usr/share/doc/$pkgname/examples/
    
      48	mkdir -p $pkgdir/usr/share/man/man1/
    
      49	mkdir -p $pkgdir/usr/share/{$pkgname,applications,pixmaps}
    
      50	make DESTDIR=$pkgdir install
    
      51
    
      52	mkdir -p $pkgdir/usr/bin
    
      53	mv $pkgdir/usr/bin/$pkgname $pkgdir/usr/bin/$pkgname.1
    
      54	install -Dm755 ../$pkgname.1 $pkgdir/usr/bin/$pkgname
    
      55
    
      56	mv $pkgdir/usr/share/doc/$pkgname/$pkgname.1.gz $pkgdir/usr/share/man/man1/$pkgname.1.gz
    
      57
    
      58	install -Dm644 $pkgname/xwxapt.glade $pkgdir/usr/share/$pkgname/xwxapt.glade
    
      59	install -Dm644 $pkgname/xwxaptrc $pkgdir/usr/share/doc/$pkgname/examples/xwxaptrc.example
    
      60	install -Dm644 ../$pkgname.desktop $pkgdir/usr/share/applications/$pkgname.desktop
    
      61	install -Dm644 ../xdemorse.png $pkgdir/usr/share/pixmaps/$pkgname.png
    
      62}
    
      63md5sums=('03eb85c9a8876cbeda21a22a2c8d7d99'
    
      64         '5b913f35d6cad963dec99c5fc0a0d5ad'
    
      65         'be4e387a7844b355742b622a48220f08'
    
      66         'edcd3f301ec8ea95453d40534beb6ede'
    
      67         '8b6dea74de28f7a6abbb2825eef521b7')
    
      68sha256sums=('a4d92cd966ae3bb466b603f1faa91566df3dcc30c067bc683d796284aa40be0e'
    
      69            '51671884532f68f9ededadbbdfdcd801827bc9b543ae5cb1b5c414336b7cab07'
    
      70            '43013c654e218d68232bb0ae53038f4d13fcfb63aca6002c54d9695f434f7b28'
    
      71            '857eb46c32c12333a7110fb3ea99d2246084724856638f2e04324fc2a576626d'
    
      72            'f938d59dd58219ae292927e2c49de6330f1f9ae07f55011bcba5b4e9804a9753')
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2