ghastty-git

maintainer fuddlesworth · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate project source on GitHub and uses a pinned Zig toolchain from the official ziglang.org domain; the non-whitelisted host is for a build tool (Zig) that is checksum-verified, and the main payload is a local build of the project's own code, posing no remote code execution or supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project source on GitHub and uses a pinned Zig toolchain from the official ziglang.org domain; the non-whitelisted host is for a build tool (Zig) that is checksum-verified, and the main payload is a local build of the project's own code, posing no remote code execution or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:44 "https://ziglang.org/download/${_zigver}/${_zig}.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nathan <nate0001@gmail.com>
    
      2
    
      3pkgname=ghastty-git
    
      4pkgver=1.3.2.r16705.g33613783f
    
      5pkgrel=3
    
      6pkgdesc="A Qt6 frontend for Ghostty that embeds libghostty (Wayland-only)"
    
      7arch=('x86_64')
    
      8url="https://github.com/fuddlesworth/ghastty"
    
      9license=('MIT')
    
      10depends=(
    
      11  'ghostty-terminfo'           # xterm-ghostty terminfo (TERM=xterm-ghostty)
    
      12  'ghostty-shell-integration'  # /usr/share/ghostty/shell-integration scripts
    
      13                               # libghostty climbs /usr/bin/ghastty -> /usr/share
    
      14                               # to find them, exporting GHOSTTY_RESOURCES_DIR/
    
      15                               # TERMINFO to the shell (resourcesdir.zig/Exec.zig)
    
      16  'qt6-base'
    
      17  'qt6-multimedia'
    
      18  'qt6-svg'
    
      19  'qt6-wayland'
    
      20  'layer-shell-qt'
    
      21  'wayland'
    
      22  'libxkbcommon'
    
      23  'libglvnd'           # libEGL / libGL (OpenGL render path)
    
      24  'vulkan-icd-loader'  # libvulkan (runtime renderer selection)
    
      25)
    
      26makedepends=(
    
      27  'git'
    
      28  'cmake'
    
      29  'pkgconf'
    
      30  'vulkan-headers'
    
      31)
    
      32provides=('ghastty')
    
      33conflicts=('ghastty')
    
      34# !lto: the C++ frontend links a Zig-built libghostty.so; skip LTO to
    
      35# avoid mixing makepkg's LTO flags across the two toolchains.
    
      36# !debug: the Zig artifact isn't part of cmake's debug-split, so no -debug
    
      37# package is produced.
    
      38options=('!lto' '!debug')
    
      39
    
      40_zigver=0.15.2
    
      41_zig="zig-x86_64-linux-${_zigver}"
    
      42source=(
    
      43  "$pkgname::git+https://github.com/fuddlesworth/ghastty.git#branch=main"
    
      44  "https://ziglang.org/download/${_zigver}/${_zig}.tar.xz"
    
      45)
    
      46sha256sums=(
    
      47  'SKIP'
    
      48  '02aa270f183da276e5b5920b1dac44a63f1a49e55050ebde3aecc9eb82f93239'
    
      49)
    
      50
    
      51pkgver() {
    
      52  cd "$srcdir/$pkgname"
    
      53  local _ver
    
      54  _ver="$(sed -n 's/.*\.version = "\([^"-]*\).*/\1/p' build.zig.zon | head -1)"
    
      55  printf '%s.r%s.g%s' "${_ver:-0}" \
    
      56    "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      57}
    
      58
    
      59build() {
    
      60  cd "$srcdir/$pkgname"
    
      61
    
      62  # Pinned toolchain: this tree requires Zig 0.15.2 (build.zig.zon
    
      63  # minimum_zig_version), but Arch's `zig` tracks 0.16+, which does not
    
      64  # compile it. Use the bundled 0.15.2 from the source array and keep
    
      65  # Zig's package cache inside the build dir.
    
      66  export PATH="$srcdir/$_zig:$PATH"
    
      67  export ZIG_GLOBAL_CACHE_DIR="$srcdir/.zig-cache"
    
      68
    
      69  # 1. libghostty — ReleaseFast, both renderers (Linux app-runtime=none).
    
      70  #    Produces zig-out/lib/ghostty-internal.so, which the Qt CMake links.
    
      71  #    Fetches Zig dependencies from deps.files.ghostty.org (needs network).
    
      72  zig build -Dapp-runtime=none -Doptimize=ReleaseFast
    
      73
    
      74  # 2. Qt6 frontend. CMAKE_INSTALL_LIBDIR=lib/ghastty keeps the private
    
      75  #    libghostty.so out of the top-level /usr/lib; the CMakeLists derives
    
      76  #    INSTALL_RPATH from the same variable, so the binary still resolves
    
      77  #    it at $ORIGIN/../lib/ghastty.
    
      78  cmake -S qt -B qt/build \
    
      79    -DCMAKE_BUILD_TYPE=Release \
    
      80    -DCMAKE_INSTALL_PREFIX=/usr \
    
      81    -DCMAKE_INSTALL_LIBDIR=lib/ghastty \
    
      82    -Wno-dev
    
      83  cmake --build qt/build
    
      84}
    
      85
    
      86package() {
    
      87  cd "$srcdir/$pkgname"
    
      88  DESTDIR="$pkgdir" cmake --install qt/build
    
      89  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2