ednition-catapult

MEDIUM

maintainer coastgrd 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt binary from a non-whitelisted host (dl.catapultapp.io), which is not a common forge or vendor domain, and the checksums are provided but the source is not verifiable or reproducible, creating a supply-chain risk if the host is compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("https://dl.catapultapp.io/cli/v0.27.0/catapult_0.27.0_linux_x86_64.tar.gz")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary from a non-whitelisted host (dl.catapultapp.io), which is not a common forge or vendor domain, and the checksums are provided but the source is not verifiable or reproducible, creating a supply-chain risk if the host is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ednition <noreply@ednition.com>
    
      2
    
      3pkgname=ednition-catapult
    
      4pkgver=0.27.0
    
      5pkgrel=1
    
      6pkgdesc="Catapult CLI — deploy and manage containerized apps on AWS (prebuilt binary)"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://catapultapp.io"
    
      9license=('custom')
    
      10provides=('catapult')
    
      11conflicts=('catapult')
    
      12source_x86_64=("https://dl.catapultapp.io/cli/v0.27.0/catapult_0.27.0_linux_x86_64.tar.gz")
    
      13sha256sums_x86_64=('da1694be11a85966707021fb6fabf48632c0aa3b8d8d69a86daff7c74fb3bc01')
    
      14source_aarch64=("https://dl.catapultapp.io/cli/v0.27.0/catapult_0.27.0_linux_arm64.tar.gz")
    
      15sha256sums_aarch64=('0890e6e44fba71c42b21f4b630f994108599cb0bdcd4a60ebe7364343d7caa3f')
    
      16
    
      17package() {
    
      18  install -Dm755 "./catapult" "${pkgdir}/usr/bin/catapult"
    
      19  install -Dm644 "./README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      20}
    
      21

Changes since previous scan

--- PKGBUILD @ 2026-10-27 00:23
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: Ednition <noreply@ednition.com>
 
 pkgname=ednition-catapult
-pkgver=0.25.0
+pkgver=0.27.0
 pkgrel=1
 pkgdesc="Catapult CLI — deploy and manage containerized apps on AWS (prebuilt binary)"
 arch=('x86_64' 'aarch64')
@@ -9,10 +9,10 @@
 license=('custom')
 provides=('catapult')
 conflicts=('catapult')
-source_x86_64=("https://dl.catapultapp.io/cli/v0.25.0/catapult_0.25.0_linux_x86_64.tar.gz")
-sha256sums_x86_64=('7b59a79e86e1e987a225fc9aa3439c7008929901304901019d160057390f4a94')
-source_aarch64=("https://dl.catapultapp.io/cli/v0.25.0/catapult_0.25.0_linux_arm64.tar.gz")
-sha256sums_aarch64=('a8dbc878d1c7abe5ebb2443a60a48c4fc8536a295d8238da1ada8215d202a7cd')
+source_x86_64=("https://dl.catapultapp.io/cli/v0.27.0/catapult_0.27.0_linux_x86_64.tar.gz")
+sha256sums_x86_64=('da1694be11a85966707021fb6fabf48632c0aa3b8d8d69a86daff7c74fb3bc01')
+source_aarch64=("https://dl.catapultapp.io/cli/v0.27.0/catapult_0.27.0_linux_arm64.tar.gz")
+sha256sums_aarch64=('0890e6e44fba71c42b21f4b630f994108599cb0bdcd4a60ebe7364343d7caa3f')
 
 package() {
   install -Dm755 "./catapult" "${pkgdir}/usr/bin/catapult"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 21:48:49	Medium	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2