appflowy

LOW

maintainer itsme 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged pattern refers to a self-install via symlink in the package() function, which is standard for AUR packages to place binaries in PATH; no privileged operations, setuid, or sudoers modifications are present.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern refers to a self-install via symlink in the package() function, which is standard for AUR packages to place binaries in PATH; no privileged operations, setuid, or sudoers modifications are present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:60 rustup toolchain install --no-self-update

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sergey Kanafyev <sergeykanafyev@gmail.com>
    
      2# Automation: https://github.com/its-me/aur.appflowy
    
      3
    
      4pkgname=appflowy
    
      5pkgver=0.14.3
    
      6pkgrel=1
    
      7pkgdesc="Open-source alternative to Notion – you own your data and customizations"
    
      8arch=('x86_64')
    
      9url="https://appflowy.com"
    
      10license=('AGPL-3.0-or-later')
    
      11conflicts=('appflowy-bin' 'appflowy-git')
    
      12depends=(
    
      13    'glib2>=2.80'
    
      14    'gst-plugins-base-libs'
    
      15    'gtk3'
    
      16    'hicolor-icon-theme'
    
      17    'libkeybinder3'
    
      18    'libnotify'
    
      19    'rocksdb'
    
      20)
    
      21_flutter_ver=3.27.4
    
      22makedepends=(
    
      23    'clang'
    
      24    'cmake'
    
      25    'git'
    
      26    'ninja'
    
      27    'pkg-config'
    
      28    'sqlite'
    
      29    'openssl'
    
      30    'unzip'
    
      31    'protobuf'
    
      32    'rsync'
    
      33    'rustup'
    
      34    'cargo-make'
    
      35)
    
      36optdepends=(
    
      37    'kdialog: file picker on KDE Plasma'
    
      38    'zenity: file picker on GNOME/GTK'
    
      39)
    
      40options=('!lto' '!debug' '!buildflags')
    
      41source=(
    
      42    "${pkgname}-${pkgver}.tar.gz::https://github.com/AppFlowy-IO/AppFlowy/archive/refs/tags/${pkgver}.tar.gz"
    
      43    "flutter::git+https://github.com/flutter/flutter.git#tag=${_flutter_ver}"
    
      44    "appflowy.desktop"
    
      45)
    
      46sha256sums=('d638d16074e677047d0e28ff2b7593e5c3210bb0d70c41a0225fc1c32c510981'
    
      47            '41d2ef9589b0ff14b4c55a614933fb8f68307738882c8e6c454fc334d4952ce3'
    
      48            '55c02d13249b333088ee452e76c8f36254e510651023549dc7e35efca02ca821')
    
      49
    
      50prepare() {
    
      51    export PATH="${srcdir}/flutter/bin:${PATH}"
    
      52
    
      53    cd "AppFlowy-${pkgver}/frontend"
    
      54
    
      55    # Upstream sets the real version at release time; the tag still carries a stale one
    
      56    sed -i "s/^APPFLOWY_VERSION = .*/APPFLOWY_VERSION = \"${pkgver}\"/" Makefile.toml
    
      57    sed -i "s/^version: .*/version: ${pkgver}/" appflowy_flutter/pubspec.yaml
    
      58
    
      59    # Install the Rust toolchain declared in rust-toolchain.toml (channel = "1.85")
    
      60    rustup toolchain install --no-self-update
    
      61    rustup target add ${CARCH}-unknown-linux-gnu
    
      62
    
      63    # Pre-fetch Rust crate dependencies
    
      64    cargo fetch --manifest-path=rust-lib/Cargo.toml
    
      65
    
      66    # Fetch Flutter package dependencies
    
      67    cd appflowy_flutter
    
      68    flutter pub get
    
      69
    
      70    # Run code generation explicitly so it runs visibly and before cargo-make
    
      71    cd ..
    
      72    ./scripts/code_generation/generate.sh --skip-pub-get
    
      73}
    
      74
    
      75build() {
    
      76    export PATH="${srcdir}/flutter/bin:${HOME}/.pub-cache/bin:${PATH}"
    
      77    export CC=clang
    
      78    export CXX=clang++
    
      79    export ROCKSDB_LIB_DIR=/usr/lib
    
      80    # hotkey_manager plugin has uninitialized variables that clang promotes to errors
    
      81    export CXXFLAGS="-Wno-error=sometimes-uninitialized"
    
      82
    
      83    cd "AppFlowy-${pkgver}/frontend"
    
      84    cargo make --profile production-linux-${CARCH} appflowy
    
      85}
    
      86
    
      87package() {
    
      88    cd "AppFlowy-${pkgver}/frontend"
    
      89
    
      90    # APPFLOWY_VERSION in Makefile.toml determines the product subdirectory name
    
      91    local _appver
    
      92    _appver=$(sed -n 's/^APPFLOWY_VERSION = "\(.*\)"/\1/p' Makefile.toml)
    
      93    local _product="appflowy_flutter/product/${_appver}/linux/Release/AppFlowy"
    
      94
    
      95    # Install AppFlowy bundle
    
      96    install -dm755 "${pkgdir}/usr/lib/AppFlowy"
    
      97    cp -r "${_product}/." "${pkgdir}/usr/lib/AppFlowy/"
    
      98    chmod 755 "${pkgdir}/usr/lib/AppFlowy/AppFlowy"
    
      99
    
      100    # Symlink into PATH
    
      101    install -dm755 "${pkgdir}/usr/bin"
    
      102    ln -s "/usr/lib/AppFlowy/AppFlowy" "${pkgdir}/usr/bin/appflowy"
    
      103
    
      104    # Desktop entry
    
      105    install -Dm644 "${srcdir}/appflowy.desktop" \
    
      106        "${pkgdir}/usr/share/applications/appflowy.desktop"
    
      107
    
      108    # Icons
    
      109    install -Dm644 "appflowy_flutter/linux/packaging/assets/logo.png" \
    
      110        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/appflowy.png"
    
      111    install -Dm644 "appflowy_flutter/assets/images/flowy_logo.svg" \
    
      112        "${pkgdir}/usr/share/icons/hicolor/scalable/apps/appflowy.svg"
    
      113
    
      114    install -Dm644 "../LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      115}
    
      116

Changes since previous scan

--- PKGBUILD @ 2026-09-16 00:03
+++ PKGBUILD @ 2026-09-17 00:27
@@ -2,7 +2,7 @@
 # Automation: https://github.com/its-me/aur.appflowy
 
 pkgname=appflowy
-pkgver=0.14.2
+pkgver=0.14.3
 pkgrel=1
 pkgdesc="Open-source alternative to Notion – you own your data and customizations"
 arch=('x86_64')
@@ -43,7 +43,7 @@
     "flutter::git+https://github.com/flutter/flutter.git#tag=${_flutter_ver}"
     "appflowy.desktop"
 )
-sha256sums=('59c5373962ec7da73e0259bcc909779feed0aa0f916a926265c62fc6a385d7a7'
+sha256sums=('d638d16074e677047d0e28ff2b7593e5c3210bb0d70c41a0225fc1c32c510981'
             '41d2ef9589b0ff14b4c55a614933fb8f68307738882c8e6c454fc334d4952ce3'
             '55c02d13249b333088ee452e76c8f36254e510651023549dc7e35efca02ca821')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 07:21:35	Medium	1
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 07:22:16	Medium	1
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 05:52:26	Medium	1
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2