bitty-bin
LOW
maintainer Xuepoo
0 votes
scanned 2026-10-27 00:23:28.674093
Why flagged
The package downloads a prebuilt binary from a project-controlled CDN (cdn.bitty.run), which is byte-identical to GitHub Releases; the binary is verified with a fixed, versioned checksum, and installs only static assets and icons, posing low risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from a project-controlled CDN (cdn.bitty.run), which is byte-identical to GitHub Releases; the binary is verified with a fixed, versioned checksum, and installs only static assets and icons, posing low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:46
"${_bitty_src}::https://cdn.bitty.run/releases/v${pkgver}/${_bitty_asset}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Bitty Maintainers <maintainers@bitty-terminal.dev>
2
# AUR package `bitty-bin`: prebuilt release binary, no user-side compile.
3
# Keep `bitty` as the source package per Arch convention; this `-bin`
4
# variant downloads the release asset mirrored to the R2-backed CDN by
5
# `.github/workflows/release.yml` ("Rename artifact" plus `r2-mirror` steps)
6
# and installs it to `/usr/bin/bitty` together with the `.desktop` entry and
7
# icons from the release source tarball.
8
#
9
# Template note: the release workflow (`aur-bin` job) copies this file to the
10
# AUR `bitty-bin` repository as `PKGBUILD`, substitutes `pkgver` with the
11
# release tag version, and replaces `63d7380523d1c3d1bc369347117990df6e4c08b0562211aee8d2b5eec7409363` below with
12
# the real sha256 from the published `.sha256` asset. The binary checksum must
13
# never be `SKIP` in a published package.
14
#
15
# Asset-name dependency (CTX-0164, issue #264): the inner binary rename
16
# `bitty-terminal` -> `bitty` changes `target/<triple>/release/<name>` inside the
17
# build, but the published dist name `_bitty_asset` below is constructed by
18
# the release workflow (`dist/bitty-${TARGET}`) and stays stable across that
19
# rename (verified against the 0164 worktree). If the dist name ever changes,
20
# update `_bitty_asset` here and in `release.yml` together.
21
#
22
# Download source (CTX-1413, #1847): the release binary comes from the
23
# R2-backed CDN, which is the preferred source for every package-manager
24
# channel. Every mirrored asset is byte-identical to GitHub Releases, which
25
# stays the documented fallback:
26
# https://github.com/bitty-terminal/bitty/releases/download/v${pkgver}/${_bitty_asset}
27
# The metadata tarball below is not mirrored (only dist/* is), so it keeps the
28
# GitHub archive URL. The binary sha256 is always verified by makepkg.
29
pkgname=bitty-bin
30
pkgver=0.0.28
31
pkgrel=1
32
pkgdesc="Bitty pre-alpha terminal workspace minimal correct terminal (prebuilt binary)"
33
arch=('x86_64')
34
url="https://github.com/bitty-terminal/bitty"
35
license=('MIT' 'Apache-2.0')
36
depends=('fontconfig' 'freetype2')
37
makedepends=('ncurses')
38
optdepends=('noto-fonts: fallback font')
39
provides=('bitty')
40
conflicts=('bitty' 'bitty-nightly' 'bitty-git')
41
_bitty_asset="bitty-${pkgver}-x86_64-unknown-linux-gnu.tar.zst"
42
# Version the local cached filename so package managers cannot reuse a
43
# previous release's download when the published asset name is stable.
44
_bitty_src="bitty-${pkgver}-x86_64-unknown-linux-gnu.tar.zst"
45
source_x86_64=(
46
"${_bitty_src}::https://cdn.bitty.run/releases/v${pkgver}/${_bitty_asset}"
47
)
48
sha256sums_x86_64=(
49
'63d7380523d1c3d1bc369347117990df6e4c08b0562211aee8d2b5eec7409363'
50
)
51
52
package() {
53
cd "${srcdir}/bitty-${pkgver}-x86_64-unknown-linux-gnu"
54
install -Dm755 bin/bitty "${pkgdir}/usr/bin/bitty"
55
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
56
install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
57
install -Dm644 CHANGELOG.md "${pkgdir}/usr/share/doc/${pkgname}/CHANGELOG.md"
58
install -Dm644 share/applications/run.bitty.Bitty.desktop "${pkgdir}/usr/share/applications/run.bitty.Bitty.desktop"
59
install -Dm644 share/metainfo/run.bitty.Bitty.metainfo.xml "${pkgdir}/usr/share/metainfo/run.bitty.Bitty.metainfo.xml"
60
for size in 16 32 64 128 256 512; do
61
install -Dm644 "share/icons/hicolor/${size}x${size}/apps/bitty.png" "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/bitty.png"
62
done
63
install -Dm644 share/icons/hicolor/scalable/apps/bitty.svg "${pkgdir}/usr/share/icons/hicolor/scalable/apps/bitty.svg"
64
# Terminfo (CTX-1121 #1764): compile canonical source; never install raw .ti.
65
tic -x -o "$pkgdir/usr/share/terminfo" terminfo/bitty.ti
66
}
67
Changes since previous scan
--- PKGBUILD @ 2026-10-24 00:14+++ PKGBUILD @ 2026-10-27 00:23@@ -8,7 +8,7 @@ # # Template note: the release workflow (`aur-bin` job) copies this file to the # AUR `bitty-bin` repository as `PKGBUILD`, substitutes `pkgver` with the-# release tag version, and replaces `238b43c8fc0472cace67be32b261b30ebd8ee84cc630662fd1bdfbdb6602eade` below with+# release tag version, and replaces `63d7380523d1c3d1bc369347117990df6e4c08b0562211aee8d2b5eec7409363` below with # the real sha256 from the published `.sha256` asset. The binary checksum must # never be `SKIP` in a published package. #@@ -27,7 +27,7 @@ # The metadata tarball below is not mirrored (only dist/* is), so it keeps the # GitHub archive URL. The binary sha256 is always verified by makepkg. pkgname=bitty-bin-pkgver=0.0.26+pkgver=0.0.28 pkgrel=1 pkgdesc="Bitty pre-alpha terminal workspace minimal correct terminal (prebuilt binary)" arch=('x86_64')@@ -46,7 +46,7 @@ "${_bitty_src}::https://cdn.bitty.run/releases/v${pkgver}/${_bitty_asset}" ) sha256sums_x86_64=(- '238b43c8fc0472cace67be32b261b30ebd8ee84cc630662fd1bdfbdb6602eade'+ '63d7380523d1c3d1bc369347117990df6e4c08b0562211aee8d2b5eec7409363' ) package() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 17:43:03 | Medium | 1 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 17:41:05 | Medium | 1 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 17:38:05 | Medium | 1 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 17:35:31 | Medium | 1 |
| 2026-10-21 15:32:06 | Clean | 0 |
| 2026-10-20 15:28:05 | Clean | 0 |
| 2026-10-16 07:15:06 | Clean | 0 |
| 2026-10-15 23:13:54 | Clean | 0 |
| 2026-10-08 12:08:47 | Clean | 0 |
| 2026-09-25 00:03:36 | Clean | 2 |
| 2026-09-24 17:43:55 | Low | 1 |
| 2026-09-13 00:19:54 | Clean | 2 |
| 2026-09-12 09:11:25 | Low | 1 |