appattic-qt

LOW

maintainer maci 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from source hosted on GitHub and includes prebuilt zig and wasmtime binaries from their official domains; these are used as build tools and bundled libraries, not executed remotely, and the final package installs only the project's own compiled code and data, posing minimal risk despite non-whitelisted hosts and low votes.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on GitHub and includes prebuilt zig and wasmtime binaries from their official domains; these are used as build tools and bundled libraries, not executed remotely, and the final package installs only the project's own compiled code and data, posing minimal risk despite non-whitelisted hosts and low votes.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "https://ziglang.org/download/0.17.0/zig-x86_64-linux-0.17.0.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Marcel W. Wysocki <maci.stgn@gmail.com>
    
      2pkgname=appattic-qt
    
      3pkgver=3.4.0
    
      4pkgrel=1
    
      5pkgdesc="Leftovers, stale apps, unused packages, and disk usage"
    
      6arch=('x86_64')
    
      7url="https://github.com/maci0/appattic"
    
      8license=('LicenseRef-proprietary' 'Apache-2.0' 'OFL-1.1')
    
      9depends=('glibc' 'gcc-libs' 'qt6-base' 'hicolor-icon-theme')
    
      10makedepends=('cmake' 'ninja' 'pkgconf' 'clang' 'patchelf')
    
      11conflicts=('appattic-bin')
    
      12# The tree compiles with -Werror and its own _FORTIFY_SOURCE. Makepkg's
    
      13# CFLAGS define the macro again, and -march=native would tie the binary
    
      14# to the builder's CPU. CMake keeps those flags after the first configure.
    
      15options=('!buildflags')
    
      16source=(
    
      17  "appattic-${pkgver}.tar.gz::https://github.com/maci0/appattic/archive/refs/tags/v${pkgver}.tar.gz"
    
      18  "https://ziglang.org/download/0.17.0/zig-x86_64-linux-0.17.0.tar.xz"
    
      19  "https://github.com/bytecodealliance/wasmtime/releases/download/v28.0.0/wasmtime-v28.0.0-x86_64-linux-c-api.tar.xz"
    
      20)
    
      21sha256sums=(
    
      22  '9da91b25123a807abbd6458564a5f9de0dac5ac7baf4ca314727280618c6d8eb'
    
      23  '1cbe9df9f27e6b78d14ccbca43b6703a404ef79ef1c463de901d7f088d4e2026'
    
      24  '23f282f333f07ec82a838928cbc86355cc4978c3618080d1a2e5714fec8411bf'
    
      25)
    
      26
    
      27build() {
    
      28  # .zig-version is 0.17.0 and the Wasmtime C API pin is v28.0.0. Neither is
    
      29  # the distro package, and the link script rejects a different zig.
    
      30  unset CPPFLAGS CFLAGS CXXFLAGS LDFLAGS
    
      31  export PATH="${srcdir}/zig-x86_64-linux-0.17.0:${PATH}"
    
      32  export WASMTIME_DIR="${srcdir}/wasmtime-v28.0.0-x86_64-linux-c-api"
    
      33  cd "appattic-${pkgver}"
    
      34  rm -rf ui/linux-qt/build-release
    
      35  # Release compiles out --dev-check. linux-qt-link.sh still runs those
    
      36  # gates after offscreen --smoke, and that is the check the binary ships.
    
      37  # The || keeps makepkg's ERR trap from aborting on that exit.
    
      38  local log="${srcdir}/linux-qt-link.log" rc=0
    
      39  bash scripts/linux-qt-link.sh release >"$log" 2>&1 || rc=$?
    
      40  cat "$log"
    
      41  if [[ "$rc" -ne 0 ]]; then
    
      42    grep -q '^SMOKE=ok$' "$log"
    
      43    grep -q 'error: --dev-check is a debug-build gate' "$log"
    
      44  fi
    
      45  rm -f "$log"
    
      46}
    
      47
    
      48package() {
    
      49  cd "appattic-${pkgver}"
    
      50  cmake --install ui/linux-qt/build-release --prefix "${pkgdir}/usr"
    
      51  # DT_NEEDED is libwasmtime.so and the tarball ships no SONAME. The library
    
      52  # lives under /usr/lib/appattic so it does not take the system name.
    
      53  install -Dm755 "${srcdir}/wasmtime-v28.0.0-x86_64-linux-c-api/lib/libwasmtime.so" \
    
      54    "${pkgdir}/usr/lib/appattic/libwasmtime.so"
    
      55  patchelf --set-rpath '$ORIGIN/../lib/appattic' "${pkgdir}/usr/bin/appattic-qt"
    
      56  install -Dm644 "${srcdir}/wasmtime-v28.0.0-x86_64-linux-c-api/LICENSE" \
    
      57    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-wasmtime"
    
      58  install -Dm644 ui/linux-qt/fonts/Michroma-OFL.txt \
    
      59    "${pkgdir}/usr/share/licenses/${pkgname}/Michroma-OFL.txt"
    
      60}
    
      61

Changes since previous scan

--- PKGBUILD @ 2026-10-16 07:17
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,6 +1,6 @@
 # Maintainer: Marcel W. Wysocki <maci.stgn@gmail.com>
 pkgname=appattic-qt
-pkgver=3.3.0
+pkgver=3.4.0
 pkgrel=1
 pkgdesc="Leftovers, stale apps, unused packages, and disk usage"
 arch=('x86_64')
@@ -15,20 +15,20 @@
 options=('!buildflags')
 source=(
   "appattic-${pkgver}.tar.gz::https://github.com/maci0/appattic/archive/refs/tags/v${pkgver}.tar.gz"
-  "https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz"
+  "https://ziglang.org/download/0.17.0/zig-x86_64-linux-0.17.0.tar.xz"
   "https://github.com/bytecodealliance/wasmtime/releases/download/v28.0.0/wasmtime-v28.0.0-x86_64-linux-c-api.tar.xz"
 )
 sha256sums=(
-  'cae5f1194edd44d1b10e3dba5d1bbcbfb0e0d30e216f54b1d312d0e1a4ad9eb9'
-  '70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00'
+  '9da91b25123a807abbd6458564a5f9de0dac5ac7baf4ca314727280618c6d8eb'
+  '1cbe9df9f27e6b78d14ccbca43b6703a404ef79ef1c463de901d7f088d4e2026'
   '23f282f333f07ec82a838928cbc86355cc4978c3618080d1a2e5714fec8411bf'
 )
 
 build() {
-  # .zig-version is 0.16.0 and the Wasmtime C API pin is v28.0.0. Neither is
+  # .zig-version is 0.17.0 and the Wasmtime C API pin is v28.0.0. Neither is
   # the distro package, and the link script rejects a different zig.
   unset CPPFLAGS CFLAGS CXXFLAGS LDFLAGS
-  export PATH="${srcdir}/zig-x86_64-linux-0.16.0:${PATH}"
+  export PATH="${srcdir}/zig-x86_64-linux-0.17.0:${PATH}"
   export WASMTIME_DIR="${srcdir}/wasmtime-v28.0.0-x86_64-linux-c-api"
   cd "appattic-${pkgver}"
   rm -rf ui/linux-qt/build-release

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 11:16:06	Medium	2
2026-10-16 07:17:56	Low	3
2026-10-16 07:15:06	Medium	2