appflowy

LOW

maintainer itsme 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The flagged privileged install refers to creating a symlink in /usr/bin, which is standard for AUR packages to provide command access; this is a common, non-malicious practice and does not involve actual privilege escalation or self-update mechanisms.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged privileged install refers to creating a symlink in /usr/bin, which is standard for AUR packages to provide command access; this is a common, non-malicious practice and does not involve actual privilege escalation or self-update mechanisms.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:60 rustup toolchain install --no-self-update

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sergey Kanafyev <sergeykanafyev@gmail.com>
    
      2# Automation: https://github.com/its-me/aur.appflowy
    
      3
    
      4pkgname=appflowy
    
      5pkgver=0.14.11
    
      6pkgrel=1
    
      7pkgdesc="Open-source alternative to Notion – you own your data and customizations"
    
      8arch=('x86_64')
    
      9url="https://appflowy.com"
    
      10license=('AGPL-3.0-or-later')
    
      11conflicts=('appflowy-bin' 'appflowy-git')
    
      12depends=(
    
      13    'glib2>=2.80'
    
      14    'gst-plugins-base-libs'
    
      15    'gtk3'
    
      16    'hicolor-icon-theme'
    
      17    'libkeybinder3'
    
      18    'libnotify'
    
      19    'rocksdb'
    
      20)
    
      21_flutter_ver=3.27.4
    
      22makedepends=(
    
      23    'clang'
    
      24    'cmake'
    
      25    'git'
    
      26    'ninja'
    
      27    'pkg-config'
    
      28    'sqlite'
    
      29    'openssl'
    
      30    'unzip'
    
      31    'protobuf'
    
      32    'rsync'
    
      33    'rustup'
    
      34    'cargo-make'
    
      35)
    
      36optdepends=(
    
      37    'kdialog: file picker on KDE Plasma'
    
      38    'zenity: file picker on GNOME/GTK'
    
      39)
    
      40options=('!lto' '!debug' '!buildflags')
    
      41source=(
    
      42    "${pkgname}-${pkgver}.tar.gz::https://github.com/AppFlowy-IO/AppFlowy/archive/refs/tags/${pkgver}.tar.gz"
    
      43    "flutter::git+https://github.com/flutter/flutter.git#tag=${_flutter_ver}"
    
      44    "appflowy.desktop"
    
      45)
    
      46sha256sums=('c22295bea960b56fe8bed65d2678b8561da50c89ef2fbfe26fbf1581faef6279'
    
      47            '41d2ef9589b0ff14b4c55a614933fb8f68307738882c8e6c454fc334d4952ce3'
    
      48            '55c02d13249b333088ee452e76c8f36254e510651023549dc7e35efca02ca821')
    
      49
    
      50prepare() {
    
      51    export PATH="${srcdir}/flutter/bin:${PATH}"
    
      52
    
      53    cd "AppFlowy-${pkgver}/frontend"
    
      54
    
      55    # Upstream sets the real version at release time; the tag still carries a stale one
    
      56    sed -i "s/^APPFLOWY_VERSION = .*/APPFLOWY_VERSION = \"${pkgver}\"/" Makefile.toml
    
      57    sed -i "s/^version: .*/version: ${pkgver}/" appflowy_flutter/pubspec.yaml
    
      58
    
      59    # Install the Rust toolchain declared in rust-toolchain.toml (channel = "1.85")
    
      60    rustup toolchain install --no-self-update
    
      61    rustup target add ${CARCH}-unknown-linux-gnu
    
      62
    
      63    # Pre-fetch Rust crate dependencies
    
      64    cargo fetch --manifest-path=rust-lib/Cargo.toml
    
      65
    
      66    # Fetch Flutter package dependencies
    
      67    cd appflowy_flutter
    
      68    flutter pub get
    
      69
    
      70    # Run code generation explicitly so it runs visibly and before cargo-make
    
      71    cd ..
    
      72    ./scripts/code_generation/generate.sh --skip-pub-get
    
      73}
    
      74
    
      75build() {
    
      76    export PATH="${srcdir}/flutter/bin:${HOME}/.pub-cache/bin:${PATH}"
    
      77    export CC=clang
    
      78    export CXX=clang++
    
      79    export ROCKSDB_LIB_DIR=/usr/lib
    
      80    # hotkey_manager plugin has uninitialized variables that clang promotes to errors
    
      81    export CXXFLAGS="-Wno-error=sometimes-uninitialized"
    
      82
    
      83    cd "AppFlowy-${pkgver}/frontend"
    
      84    cargo make --profile production-linux-${CARCH} appflowy
    
      85}
    
      86
    
      87package() {
    
      88    cd "AppFlowy-${pkgver}/frontend"
    
      89
    
      90    # APPFLOWY_VERSION in Makefile.toml determines the product subdirectory name
    
      91    local _appver
    
      92    _appver=$(sed -n 's/^APPFLOWY_VERSION = "\(.*\)"/\1/p' Makefile.toml)
    
      93    local _product="appflowy_flutter/product/${_appver}/linux/Release/AppFlowy"
    
      94
    
      95    # Install AppFlowy bundle
    
      96    install -dm755 "${pkgdir}/usr/lib/AppFlowy"
    
      97    cp -r "${_product}/." "${pkgdir}/usr/lib/AppFlowy/"
    
      98    chmod 755 "${pkgdir}/usr/lib/AppFlowy/AppFlowy"
    
      99
    
      100    # Symlink into PATH
    
      101    install -dm755 "${pkgdir}/usr/bin"
    
      102    ln -s "/usr/lib/AppFlowy/AppFlowy" "${pkgdir}/usr/bin/appflowy"
    
      103
    
      104    # Desktop entry
    
      105    install -Dm644 "${srcdir}/appflowy.desktop" \
    
      106        "${pkgdir}/usr/share/applications/appflowy.desktop"
    
      107
    
      108    # Icons
    
      109    install -Dm644 "appflowy_flutter/linux/packaging/assets/logo.png" \
    
      110        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/appflowy.png"
    
      111    install -Dm644 "appflowy_flutter/assets/images/flowy_logo.svg" \
    
      112        "${pkgdir}/usr/share/icons/hicolor/scalable/apps/appflowy.svg"
    
      113
    
      114    install -Dm644 "../LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      115}
    
      116

Changes since previous scan

--- PKGBUILD @ 2026-10-26 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
 # Automation: https://github.com/its-me/aur.appflowy
 
 pkgname=appflowy
-pkgver=0.14.10
+pkgver=0.14.11
 pkgrel=1
 pkgdesc="Open-source alternative to Notion – you own your data and customizations"
 arch=('x86_64')
@@ -43,7 +43,7 @@
     "flutter::git+https://github.com/flutter/flutter.git#tag=${_flutter_ver}"
     "appflowy.desktop"
 )
-sha256sums=('9e68884f841d9fa70fe6d19cf62cf48914edde7c3c18b2744b2406257f456080'
+sha256sums=('c22295bea960b56fe8bed65d2678b8561da50c89ef2fbfe26fbf1581faef6279'
             '41d2ef9589b0ff14b4c55a614933fb8f68307738882c8e6c454fc334d4952ce3'
             '55c02d13249b333088ee452e76c8f36254e510651023549dc7e35efca02ca821')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 05:43:49	Medium	1
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 07:31:05	Medium	1
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2