appflowy

maintainer itsme · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged pattern involves installing files into system directories, which is standard for AUR packages; the build uses a local Flutter clone and project-owned sources, with no evidence of privilege escalation or self-modification at runtime.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves installing files into system directories, which is standard for AUR packages; the build uses a local Flutter clone and project-owned sources, with no evidence of privilege escalation or self-modification at runtime.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:62 rustup toolchain install --no-self-update

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sergey Kanafyev <sergeykanafyev@gmail.com>
    
      2# Automation: https://github.com/its-me/aur.appflowy
    
      3
    
      4pkgname=appflowy
    
      5pkgver=0.13.0
    
      6pkgrel=1
    
      7pkgdesc="Open-source alternative to Notion – you own your data and customizations"
    
      8arch=('x86_64')
    
      9url="https://appflowy.com"
    
      10license=('AGPL-3.0-or-later')
    
      11conflicts=('appflowy-bin' 'appflowy-git')
    
      12depends=(
    
      13    'glib2>=2.80'
    
      14    'gst-plugins-base-libs'
    
      15    'gtk3'
    
      16    'hicolor-icon-theme'
    
      17    'libkeybinder3'
    
      18    'libnotify'
    
      19    'rocksdb'
    
      20)
    
      21_flutter_ver=3.27.4
    
      22makedepends=(
    
      23    'clang'
    
      24    'cmake'
    
      25    'git'
    
      26    'ninja'
    
      27    'pkg-config'
    
      28    'sqlite'
    
      29    'openssl'
    
      30    'unzip'
    
      31    'protobuf'
    
      32    'rsync'
    
      33    'rustup'
    
      34    'cargo-make'
    
      35)
    
      36optdepends=(
    
      37    'kdialog: file picker on KDE Plasma'
    
      38    'zenity: file picker on GNOME/GTK'
    
      39)
    
      40options=('!lto' '!debug' '!buildflags')
    
      41source=(
    
      42    "${pkgname}-${pkgver}.tar.gz::https://github.com/AppFlowy-IO/AppFlowy/archive/refs/tags/${pkgver}.tar.gz"
    
      43    "flutter::git+https://github.com/flutter/flutter.git#tag=${_flutter_ver}"
    
      44    "appflowy.desktop"
    
      45)
    
      46sha256sums=(
    
      47    'f0e84458b9d5fb9f478ada38c69c1d4da4c9e400a138dfb6c857a1036f7ef2b8'
    
      48    'SKIP'
    
      49    '55c02d13249b333088ee452e76c8f36254e510651023549dc7e35efca02ca821'
    
      50)
    
      51
    
      52prepare() {
    
      53    export PATH="${srcdir}/flutter/bin:${PATH}"
    
      54
    
      55    cd "AppFlowy-${pkgver}/frontend"
    
      56
    
      57    # Upstream sets the real version at release time; the tag still carries a stale one
    
      58    sed -i "s/^APPFLOWY_VERSION = .*/APPFLOWY_VERSION = \"${pkgver}\"/" Makefile.toml
    
      59    sed -i "s/^version: .*/version: ${pkgver}/" appflowy_flutter/pubspec.yaml
    
      60
    
      61    # Install the Rust toolchain declared in rust-toolchain.toml (channel = "1.85")
    
      62    rustup toolchain install --no-self-update
    
      63    rustup target add ${CARCH}-unknown-linux-gnu
    
      64
    
      65    # Pre-fetch Rust crate dependencies
    
      66    cargo fetch --manifest-path=rust-lib/Cargo.toml
    
      67
    
      68    # Fetch Flutter package dependencies
    
      69    cd appflowy_flutter
    
      70    flutter pub get
    
      71
    
      72    # Run code generation explicitly so it runs visibly and before cargo-make
    
      73    cd ..
    
      74    ./scripts/code_generation/generate.sh --skip-pub-get
    
      75}
    
      76
    
      77build() {
    
      78    export PATH="${srcdir}/flutter/bin:${HOME}/.pub-cache/bin:${PATH}"
    
      79    export CC=clang
    
      80    export CXX=clang++
    
      81    export ROCKSDB_LIB_DIR=/usr/lib
    
      82    # hotkey_manager plugin has uninitialized variables that clang promotes to errors
    
      83    export CXXFLAGS="-Wno-error=sometimes-uninitialized"
    
      84
    
      85    cd "AppFlowy-${pkgver}/frontend"
    
      86    cargo make --profile production-linux-${CARCH} appflowy
    
      87}
    
      88
    
      89package() {
    
      90    cd "AppFlowy-${pkgver}/frontend"
    
      91
    
      92    # APPFLOWY_VERSION in Makefile.toml determines the product subdirectory name
    
      93    local _appver
    
      94    _appver=$(sed -n 's/^APPFLOWY_VERSION = "\(.*\)"/\1/p' Makefile.toml)
    
      95    local _product="appflowy_flutter/product/${_appver}/linux/Release/AppFlowy"
    
      96
    
      97    # Install AppFlowy bundle
    
      98    install -dm755 "${pkgdir}/usr/lib/AppFlowy"
    
      99    cp -r "${_product}/." "${pkgdir}/usr/lib/AppFlowy/"
    
      100    chmod 755 "${pkgdir}/usr/lib/AppFlowy/AppFlowy"
    
      101
    
      102    # Symlink into PATH
    
      103    install -dm755 "${pkgdir}/usr/bin"
    
      104    ln -s "/usr/lib/AppFlowy/AppFlowy" "${pkgdir}/usr/bin/appflowy"
    
      105
    
      106    # Desktop entry
    
      107    install -Dm644 "${srcdir}/appflowy.desktop" \
    
      108        "${pkgdir}/usr/share/applications/appflowy.desktop"
    
      109
    
      110    # Icons
    
      111    install -Dm644 "appflowy_flutter/linux/packaging/assets/logo.png" \
    
      112        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/appflowy.png"
    
      113    install -Dm644 "appflowy_flutter/assets/images/flowy_logo.svg" \
    
      114        "${pkgdir}/usr/share/icons/hicolor/scalable/apps/appflowy.svg"
    
      115
    
      116    install -Dm644 "../LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      117}
    
      118

Changes since previous scan

--- PKGBUILD @ 2026-07-24 00:02
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 # Automation: https://github.com/its-me/aur.appflowy
 
 pkgname=appflowy
-pkgver=0.12.5
+pkgver=0.13.0
 pkgrel=1
 pkgdesc="Open-source alternative to Notion – you own your data and customizations"
 arch=('x86_64')
@@ -44,7 +44,7 @@
     "appflowy.desktop"
 )
 sha256sums=(
-    'c51e995d2c84ac71b5d6c1cb15583280567ffac9a52b2fc57823e766bbc71353'
+    'f0e84458b9d5fb9f478ada38c69c1d4da4c9e400a138dfb6c857a1036f7ef2b8'
     'SKIP'
     '55c02d13249b333088ee452e76c8f36254e510651023549dc7e35efca02ca821'
 )

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 17:28:09	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2