ghastty-git
LOW
maintainer fuddlesworth
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The non-standard host (ziglang.org) is the official Zig project domain, used to download a legitimate build tool; the source is verified via checksum and used only to compile the project's own code, posing no remote code execution or supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host (ziglang.org) is the official Zig project domain, used to download a legitimate build tool; the source is verified via checksum and used only to compile the project's own code, posing no remote code execution or supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:44
"https://ziglang.org/download/${_zigver}/${_zig}.tar.xz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Nathan <nate0001@gmail.com>
2
3
pkgname=ghastty-git
4
pkgver=1.3.2.r18156.gaea7dac7c
5
pkgrel=1
6
pkgdesc="A Qt6 frontend for Ghostty that embeds libghostty (Wayland-only)"
7
arch=('x86_64')
8
url="https://github.com/fuddlesworth/ghastty"
9
license=('MIT')
10
depends=(
11
'ghostty-terminfo' # xterm-ghostty terminfo (TERM=xterm-ghostty)
12
'ghostty-shell-integration' # /usr/share/ghostty/shell-integration scripts
13
# libghostty climbs /usr/bin/ghastty -> /usr/share
14
# to find them, exporting GHOSTTY_RESOURCES_DIR/
15
# TERMINFO to the shell (resourcesdir.zig/Exec.zig)
16
'qt6-base'
17
'qt6-multimedia'
18
'qt6-svg'
19
'qt6-wayland'
20
'layer-shell-qt'
21
'wayland'
22
'libxkbcommon'
23
'libglvnd' # libEGL / libGL (OpenGL render path)
24
'vulkan-icd-loader' # libvulkan (runtime renderer selection)
25
)
26
makedepends=(
27
'git'
28
'cmake'
29
'pkgconf'
30
'vulkan-headers'
31
)
32
provides=('ghastty')
33
conflicts=('ghastty')
34
# !lto: the C++ frontend links a Zig-built libghostty.so; skip LTO to
35
# avoid mixing makepkg's LTO flags across the two toolchains.
36
# !debug: the Zig artifact isn't part of cmake's debug-split, so no -debug
37
# package is produced.
38
options=('!lto' '!debug')
39
40
_zigver=0.16.0
41
_zig="zig-x86_64-linux-${_zigver}"
42
source=(
43
"$pkgname::git+https://github.com/fuddlesworth/ghastty.git#branch=main"
44
"https://ziglang.org/download/${_zigver}/${_zig}.tar.xz"
45
)
46
sha256sums=(
47
'SKIP'
48
'70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00'
49
)
50
51
pkgver() {
52
cd "$srcdir/$pkgname"
53
local _ver
54
_ver="$(sed -n 's/.*\.version = "\([^"-]*\).*/\1/p' build.zig.zon | head -1)"
55
printf '%s.r%s.g%s' "${_ver:-0}" \
56
"$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
57
}
58
59
build() {
60
cd "$srcdir/$pkgname"
61
62
# Pinned toolchain: this tree requires the exact Zig release named in
63
# build.zig.zon (minimum_zig_version), and Arch's `zig` package moves
64
# independently of it. Use the bundled release from the source array
65
# (keep _zigver in sync with build.zig.zon) and keep Zig's package
66
# cache inside the build dir.
67
export PATH="$srcdir/$_zig:$PATH"
68
export ZIG_GLOBAL_CACHE_DIR="$srcdir/.zig-cache"
69
70
# 1. libghostty — ReleaseFast, app-runtime=none. The renderer is fixed
71
# at build time by -Drenderer= (opengl or vulkan; the Qt frontend
72
# compiles both host paths and asks the library which one it got).
73
# Produces zig-out/lib/ghostty-internal.so, which the Qt CMake links.
74
# Fetches Zig dependencies from deps.files.ghostty.org (needs network).
75
zig build -Dapp-runtime=none -Doptimize=ReleaseFast -Drenderer=opengl
76
77
# 2. Qt6 frontend. CMAKE_INSTALL_LIBDIR=lib/ghastty keeps the private
78
# libghostty.so out of the top-level /usr/lib; the CMakeLists derives
79
# INSTALL_RPATH from the same variable, so the binary still resolves
80
# it at $ORIGIN/../lib/ghastty.
81
cmake -S qt -B qt/build \
82
-DCMAKE_BUILD_TYPE=Release \
83
-DCMAKE_INSTALL_PREFIX=/usr \
84
-DCMAKE_INSTALL_LIBDIR=lib/ghastty \
85
-Wno-dev
86
cmake --build qt/build
87
}
88
89
package() {
90
cd "$srcdir/$pkgname"
91
DESTDIR="$pkgdir" cmake --install qt/build
92
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
93
}
94
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |