ednition-catapult

MEDIUM

maintainer coastgrd 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary from a non-whitelisted host (dl.catapultapp.io), which presents a supply-chain risk if the host were compromised or the download redirected, though the binary is checksum-verified.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("https://dl.catapultapp.io/cli/v0.22.0/catapult_0.22.0_linux_x86_64.tar.gz")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary from a non-whitelisted host (dl.catapultapp.io), which presents a supply-chain risk if the host were compromised or the download redirected, though the binary is checksum-verified.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ednition <noreply@ednition.com>
    
      2
    
      3pkgname=ednition-catapult
    
      4pkgver=0.22.0
    
      5pkgrel=1
    
      6pkgdesc="Catapult CLI — deploy and manage containerized apps on AWS (prebuilt binary)"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://catapultapp.io"
    
      9license=('custom')
    
      10provides=('catapult')
    
      11conflicts=('catapult')
    
      12source_x86_64=("https://dl.catapultapp.io/cli/v0.22.0/catapult_0.22.0_linux_x86_64.tar.gz")
    
      13sha256sums_x86_64=('e419c958db6aa607dc2bfb728dbaf04cc148344d585e3913f431102073621ca3')
    
      14source_aarch64=("https://dl.catapultapp.io/cli/v0.22.0/catapult_0.22.0_linux_arm64.tar.gz")
    
      15sha256sums_aarch64=('ca67f3dd7e20530292a92418f0e5b6f0ec42d4baefdcaaeefea533fa77847630')
    
      16
    
      17package() {
    
      18  install -Dm755 "./catapult" "${pkgdir}/usr/bin/catapult"
    
      19  install -Dm644 "./README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      20}
    
      21

Changes since previous scan

--- PKGBUILD @ 2026-09-11 00:19
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 # Maintainer: Ednition <noreply@ednition.com>
 
 pkgname=ednition-catapult
-pkgver=0.21.0
+pkgver=0.22.0
 pkgrel=1
 pkgdesc="Catapult CLI — deploy and manage containerized apps on AWS (prebuilt binary)"
 arch=('x86_64' 'aarch64')
@@ -9,10 +9,10 @@
 license=('custom')
 provides=('catapult')
 conflicts=('catapult')
-source_x86_64=("https://dl.catapultapp.io/cli/v0.21.0/catapult_0.21.0_linux_x86_64.tar.gz")
-sha256sums_x86_64=('dc21ca1b649930b78c209479e3fa40c6e962ed6e617acbe0148061b7b1aea5bf')
-source_aarch64=("https://dl.catapultapp.io/cli/v0.21.0/catapult_0.21.0_linux_arm64.tar.gz")
-sha256sums_aarch64=('ee64e5f7a820b1a282573a3d9d1e61014102bfe30218caa5b159271d0a6ec3a8')
+source_x86_64=("https://dl.catapultapp.io/cli/v0.22.0/catapult_0.22.0_linux_x86_64.tar.gz")
+sha256sums_x86_64=('e419c958db6aa607dc2bfb728dbaf04cc148344d585e3913f431102073621ca3')
+source_aarch64=("https://dl.catapultapp.io/cli/v0.22.0/catapult_0.22.0_linux_arm64.tar.gz")
+sha256sums_aarch64=('ca67f3dd7e20530292a92418f0e5b6f0ec42d4baefdcaaeefea533fa77847630')
 
 package() {
   install -Dm755 "./catapult" "${pkgdir}/usr/bin/catapult"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 21:24:02	Medium	2
2026-09-11 17:22:59	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 23:18:28	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2