cfait-bin

maintainer brandond · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a prebuilt binary tarball from the project's own release page on a non-whitelisted but plausibly project-owned host (git.disroot.org); the worst case of a swapped source is code execution, but it is distributed as a standard AUR package with a verifiable checksum, reducing supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt binary tarball from the project's own release page on a non-whitelisted but plausibly project-owned host (git.disroot.org); the worst case of a swapped source is code execution, but it is distributed as a standard AUR package with a verifiable checksum, reducing supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 source=("https://git.disroot.org/trougnouf/cfait/releases/download/v1.1.1/cfait-linux-v1.1.1.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Brandon Doornbos <b.doornbos at pm dot me>
    
      2# Co-maintainer: Benoit Brummer (Trougnouf) <trougnouf@gmail.com>
    
      3pkgname=cfait-bin
    
      4pkgver=1.1.1
    
      5pkgrel=1
    
      6pkgdesc="Powerful, fast and elegant task / TODO manager. (GUI & TUI, CalDAV & local)"
    
      7arch=('x86_64')
    
      8url="https://git.disroot.org/trougnouf/cfait"
    
      9license=('GPL-3.0-or-later')
    
      10depends=(
    
      11    'gcc-libs'
    
      12    'glibc'
    
      13    'fontconfig'              # Required by the GUI for system font discovery
    
      14    'libxkbcommon'            # Required by the GUI for keyboard handling (especially on Wayland)
    
      15    'vulkan-icd-loader'       # Required by the GUI to load Vulkan drivers for rendering
    
      16    'org.freedesktop.secrets' # Required to store the CalDAV password
    
      17)
    
      18# Optional dependencies for the GUI and specific features
    
      19optdepends=(
    
      20    'vulkan-driver: Required by the GUI for hardware-accelerated rendering'
    
      21    'wayland: Required by the GUI for Wayland session support'
    
      22    'libx11: Required by the GUI for X11 session support'
    
      23    'libxcursor: Required by the GUI for X11 cursor support'
    
      24    'libxi: Required by the GUI for X11 input devices'
    
      25    'libxrandr: Required by the GUI for X11 monitor layout support'
    
      26    'xdg-desktop-portal: Required by the GUI for the file picker (export/import)'
    
      27)
    
      28
    
      29options=('!strip' '!emptydirs')
    
      30source=("https://git.disroot.org/trougnouf/cfait/releases/download/v1.1.1/cfait-linux-v1.1.1.tar.xz")
    
      31sha256sums=('8f9d9d9e28f7da0388ae240d93d3364eddb647c5c8f4b7bbea6df0bf19e5c880')
    
      32replaces=('rustycal' 'rustache' 'fairouille')
    
      33provides=('cfait' 'cfait-gui')
    
      34conflicts=('cfait')
    
      35
    
      36package() {
    
      37    cd "cfait-linux-${pkgver}"
    
      38
    
      39    install -Dm755 cfait -t "${pkgdir}/usr/bin/"
    
      40    install -Dm755 cfait-gui -t "${pkgdir}/usr/bin/"
    
      41    install -Dm644 cfait.desktop -t "${pkgdir}/usr/share/applications/"
    
      42    install -Dm644 cfait.svg -t "${pkgdir}/usr/share/icons/hicolor/scalable/apps/"
    
      43    install -Dm644 README.md -t "${pkgdir}/usr/share/doc/${pkgname}/"
    
      44    install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      45}
    
      46

Changes since previous scan

--- PKGBUILD @ 2026-07-27 13:35
+++ PKGBUILD @ 2026-08-03 00:08
@@ -28,7 +28,7 @@
 
 options=('!strip' '!emptydirs')
 source=("https://git.disroot.org/trougnouf/cfait/releases/download/v1.1.1/cfait-linux-v1.1.1.tar.xz")
-sha256sums=('044d3e89a0fb585811eb56b37fbad91a0539f2d908dabf1a149e3c16a3346fe8')
+sha256sums=('8f9d9d9e28f7da0388ae240d93d3364eddb647c5c8f4b7bbea6df0bf19e5c880')
 replaces=('rustycal' 'rustache' 'fairouille')
 provides=('cfait' 'cfait-gui')
 conflicts=('cfait')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 15:35:03	MEDIUM	1
2026-07-27 13:35:00	MEDIUM	1
2026-07-27 11:35:00	MEDIUM	1
2026-07-27 03:34:02	MEDIUM	1
2026-07-27 00:24:32	LOW	2
2026-07-26 21:33:42	MEDIUM	1
2026-06-25 10:22:06	CLEAN	0
2026-06-18 16:11:54	CLEAN	0