appattic

LOW

maintainer maci 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Downloads a large prebuilt Swift toolchain from the official download.swift.org domain (not a personal/swappable host) with a pinned sha256 checksum, and builds the project's own source from its official GitHub repo; the sourced build script (scripts/swift-build.sh) runs from the project's own checked-out source tree, so no unreviewed remote code execution occurs beyond normal compilation.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a large prebuilt Swift toolchain from the official download.swift.org domain (not a personal/swappable host) with a pinned sha256 checksum, and builds the project's own source from its official GitHub repo; the sourced build script (scripts/swift-build.sh) runs from the project's own checked-out source tree, so no unreviewed remote code execution occurs beyond normal compilation.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "https://download.swift.org/swift-5.10.1-release/ubuntu2204/swift-5.10.1-RELEASE/swift-5.10.1-RELEASE-ubuntu22.04.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Marcel W. Wysocki <maci.stgn@gmail.com>
    
      2pkgname=appattic
    
      3pkgver=3.3.0
    
      4pkgrel=1
    
      5pkgdesc="Leftovers, stale apps, unused packages, and disk usage (command line)"
    
      6arch=('x86_64')
    
      7url="https://github.com/maci0/appattic"
    
      8license=('LicenseRef-proprietary')
    
      9depends=('glibc' 'gcc-libs' 'curl' 'libxml2')
    
      10makedepends=('ncurses' 'patchelf')
    
      11source=(
    
      12  "appattic-${pkgver}.tar.gz::https://github.com/maci0/appattic/archive/refs/tags/v${pkgver}.tar.gz"
    
      13  "https://download.swift.org/swift-5.10.1-release/ubuntu2204/swift-5.10.1-RELEASE/swift-5.10.1-RELEASE-ubuntu22.04.tar.gz"
    
      14)
    
      15sha256sums=(
    
      16  'cae5f1194edd44d1b10e3dba5d1bbcbfb0e0d30e216f54b1d312d0e1a4ad9eb9'
    
      17  'cab1bfffd33b79ebd49f4b7475bef6c7eb2d60cf3948cbc693d61afabd23c282'
    
      18)
    
      19
    
      20prepare() {
    
      21  # The 5.10.1 driver was linked against libncurses.so.6. Arch ships that
    
      22  # SONAME as libncursesw.so.6. The symlink is for the compiler only.
    
      23  ln -sf /usr/lib/libncursesw.so.6 \
    
      24    "${srcdir}/swift-5.10.1-RELEASE-ubuntu22.04/usr/lib/swift/linux/libncurses.so.6"
    
      25}
    
      26
    
      27build() {
    
      28  # .swift-version is 5.10.1. Arch extra has no Swift, and the Ubuntu 22.04
    
      29  # toolchain is the pin scripts/dep-checksums.sha256 already records.
    
      30  export PATH="${srcdir}/swift-5.10.1-RELEASE-ubuntu22.04/usr/bin:${PATH}"
    
      31  cd "appattic-${pkgver}"
    
      32  source scripts/swift-build.sh
    
      33  # Linux Package.swift has no dependencies. Static stdlib keeps the Swift
    
      34  # runtime out of the package; curl and libxml2 stay dynamic.
    
      35  appattic_swift_build release --product appattic --static-swift-stdlib
    
      36}
    
      37
    
      38package() {
    
      39  cd "appattic-${pkgver}"
    
      40  local bin="" candidate
    
      41  for candidate in \
    
      42    ".build/release/appattic" \
    
      43    ".build/x86_64-unknown-linux-gnu/release/appattic"
    
      44  do
    
      45    if [[ -x "$candidate" ]]; then
    
      46      bin="$candidate"
    
      47      break
    
      48    fi
    
      49  done
    
      50  [[ -n "$bin" ]]
    
      51
    
      52  # Bundle.module reads AppAttic_AppAtticScan.resources beside the real
    
      53  # binary. /usr/bin/appattic is a symlink, so the file lives with the binary.
    
      54  install -Dm755 "$bin" "${pkgdir}/usr/lib/appattic/appattic"
    
      55  install -Dm644 Sources/AppAtticScan/linux-system-names.txt \
    
      56    "${pkgdir}/usr/lib/appattic/AppAttic_AppAtticScan.resources/linux-system-names.txt"
    
      57  patchelf --remove-rpath "${pkgdir}/usr/lib/appattic/appattic"
    
      58  install -d "${pkgdir}/usr/bin"
    
      59  ln -s ../lib/appattic/appattic "${pkgdir}/usr/bin/appattic"
    
      60  install -Dm644 packaging/appattic.1 "${pkgdir}/usr/share/man/man1/appattic.1"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 11:16:06	Medium	2
2026-10-16 07:17:56	Low	3
2026-10-16 07:15:06	Medium	3