Digital

Permissions

3 permissions weaken the sandbox. Flatsonar asks before installing.

• all devices (/dev): webcams, disks, raw hardware

  --device=all
• X11 display: X11 lets apps read input and windows of other apps

  --socket=x11
• full access to your home folder

  --filesystem=home
• Wayland display

  --socket=wayland
• network

  --share=network

Who publishes this

Nobody has confirmed that the publisher controls this app id. Flatsonar warns before installing.

• packaged by github.com/egrath, not by the com.github namespace owner; it does build the owner's code from https://github.com/steveicarus/iverilog/archive/refs/tags/v11_0.tar.gz

  publisher:namespace
• fetches from ftp.gnu.org over unencrypted http: anyone on the path can swap the bytes (x2)

  source:insecure-url
• git source tracks a moving branch: what gets built can change without the manifest changing (x2)

  source:unpinned
• the build has network access: it can download things the manifest does not list

  xdot:build-options:--share=network
• fetches from the network during the build (nothing to audit beforehand): pip3 install --prefix=/app xdot numpy

  xdot:build-commands

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.