cfait

maintainer trougnouf · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the project's own release page on a personal but project-associated Git host (git.disroot.org), building from verified source code; the non-whitelisted host is plausibly legitimate for this AUR package, and no untrusted executable is run.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's own release page on a personal but project-associated Git host (git.disroot.org), building from verified source code; the non-whitelisted host is plausibly legitimate for this AUR package, and no untrusted executable is run.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 source=("cfait-source-v1.1.1.tar.gz::https://git.disroot.org/trougnouf/cfait/releases/download/v1.1.1/cfait-source-v1.1.1.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Benoit Brummer (Trougnouf) <trougnouf@gmail.com>
    
      2pkgname=cfait
    
      3pkgver=1.1.1
    
      4pkgrel=1
    
      5pkgdesc="Powerful, fast and elegant task / TODO manager. (GUI & TUI, CalDAV & local)"
    
      6arch=('x86_64')
    
      7url="https://git.disroot.org/trougnouf/cfait"
    
      8license=('GPL-3.0-or-later')
    
      9depends=(
    
      10    'gcc-libs'
    
      11    'glibc'
    
      12    'fontconfig'        # Required by the GUI for system font discovery
    
      13    'libxkbcommon'      # Required by the GUI for keyboard handling (especially on Wayland)
    
      14    'vulkan-icd-loader' # Required by the GUI to load Vulkan drivers for rendering
    
      15    'org.freedesktop.secrets'  # Required to store the CalDAV password
    
      16)
    
      17makedepends=('cargo' 'pkgconf' 'git')  # git is needed as long as libdav > 0.10.3 is not released
    
      18# Optional dependencies for the GUI and specific features
    
      19optdepends=(
    
      20    'vulkan-driver: Required by the GUI for hardware-accelerated rendering'
    
      21    'wayland: Required by the GUI for Wayland session support'
    
      22    'libx11: Required by the GUI for X11 session support'
    
      23    'libxcursor: Required by the GUI for X11 cursor support'
    
      24    'libxi: Required by the GUI for X11 input devices'
    
      25    'libxrandr: Required by the GUI for X11 monitor layout support'
    
      26    'xdg-desktop-portal: Required by the GUI for the file picker (export/import)'
    
      27)
    
      28
    
      29options=('!lto' '!strip' '!debug')
    
      30source=("cfait-source-v1.1.1.tar.gz::https://git.disroot.org/trougnouf/cfait/releases/download/v1.1.1/cfait-source-v1.1.1.tar.gz")
    
      31sha256sums=('8121fac1482d17573075b29d2106a1d890cf6c1425d379d8c9f7c947c4049b8a')
    
      32replaces=('rustycal' 'rustache' 'fairouille')
    
      33provides=('cfait-tui' 'cfait-gui')
    
      34
    
      35build() {
    
      36  cd "$pkgname-$pkgver"
    
      37  # Set the target directory to be at the root of the makepkg build area
    
      38  export CARGO_TARGET_DIR="$srcdir/target"
    
      39  # Skip compiling the problematic fallback RNG.
    
      40  # Linux's native getrandom() is used instead.
    
      41  export AWS_LC_SYS_NO_JITTER_ENTROPY=1
    
      42
    
      43  # Build both TUI and GUI
    
      44  cargo build --release --features gui
    
      45}
    
      46
    
      47package() {
    
      48  cd "$pkgname-$pkgver"
    
      49
    
      50  install -Dm755 "$srcdir/target/release/cfait" "$pkgdir/usr/bin/cfait"
    
      51  install -Dm755 "$srcdir/target/release/cfait-gui" "$pkgdir/usr/bin/cfait-gui"
    
      52
    
      53  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      54  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      55
    
      56  install -Dm644 "assets/cfait.desktop" "$pkgdir/usr/share/applications/cfait.desktop"
    
      57  install -Dm644 "assets/cfait.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/cfait.svg"
    
      58}
    
      59

Changes since previous scan

--- PKGBUILD @ 2026-07-27 13:35
+++ PKGBUILD @ 2026-08-03 00:08
@@ -28,7 +28,7 @@
 
 options=('!lto' '!strip' '!debug')
 source=("cfait-source-v1.1.1.tar.gz::https://git.disroot.org/trougnouf/cfait/releases/download/v1.1.1/cfait-source-v1.1.1.tar.gz")
-sha256sums=('dd8998cdbee76f14a15fac92b673695fd8d459ed8e0f6ea4cf42b49d5b72e693')
+sha256sums=('8121fac1482d17573075b29d2106a1d890cf6c1425d379d8c9f7c947c4049b8a')
 replaces=('rustycal' 'rustache' 'fairouille')
 provides=('cfait-tui' 'cfait-gui')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 15:35:03	MEDIUM	1
2026-07-27 13:35:00	MEDIUM	1
2026-07-27 11:35:00	MEDIUM	1
2026-07-27 03:34:02	MEDIUM	1
2026-07-27 00:24:32	LOW	2
2026-07-26 21:33:42	MEDIUM	1
2026-06-25 10:22:06	CLEAN	0
2026-06-18 16:11:54	CLEAN	0