hakase-bin

LOW

maintainer amurrux 0 votes scanned 2026-08-24 00:17:16.992713

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official GitHub releases with pinned checksums and SLSA provenance, which is a normal and secure practice for -bin packages; the low severity is due to few votes and recent upload, not the source itself.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases with pinned checksums and SLSA provenance, which is a normal and secure practice for -bin packages; the low severity is due to few votes and recent upload, not the source itself.

PKGBUILD

      1# Maintainer: Amurru Zerouk <amurru@users.noreply.github.com>
    
      2#
    
      3# Prebuilt-binary package (-bin): installs the linux/amd64 hakase binary
    
      4# published on GitHub releases by .github/workflows/release.yml. No
    
      5# compilation happens here; checksums pin the released assets.
    
      6#
    
      7# The release workflow uploads only the binary + SHA256SUMS.txt (+ SLSA
    
      8# provenance), so config.json.example and LICENSE are pulled from the tag.
    
      9#
    
      10# Update pkgver + sha256sums together (`updpkgsums` after editing pkgver).
    
      11# The sum for the binary is also in SHA256SUMS.txt on the release; the
    
      12# release additionally carries SLSA L3 provenance verifiable with
    
      13# slsa-verifier (see "Verifying release binaries" in README.md).
    
      14
    
      15pkgname=hakase-bin
    
      16pkgver=0.1.0.alpha.3
    
      17pkgrel=1
    
      18pkgdesc="Go agent harness with an embedded Vue 3 web UI (prebuilt binary)"
    
      19arch=('x86_64')
    
      20url="https://github.com/amurru/hakase"
    
      21license=('MIT')
    
      22depends=('python')   # agent executes learned skills via python3
    
      23optdepends=('tectonic: latex-math skill (LaTeX rendering)'
    
      24            'poppler: PDF tools used by document skills'
    
      25            'librsvg: SVG conversion used by diagram skills'
    
      26            'inkscape: alternative SVG conversion'
    
      27            'wl-clipboard: clipboard support on Wayland'
    
      28            'xclip: clipboard support on X11')
    
      29provides=(hakase)
    
      30conflicts=(hakase)
    
      31# The real git tag. AUR pkgver cannot contain '-', so the alpha separator
    
      32# becomes a dot in pkgver; keep this in sync manually on version bumps.
    
      33_tag="v0.1.0-alpha.3"
    
      34source=("hakase-$_tag-linux-amd64::$url/releases/download/$_tag/hakase-$_tag-linux-amd64"
    
      35        "config.json.example::$url/raw/$_tag/config.json.example"
    
      36        "LICENSE::$url/raw/$_tag/LICENSE")
    
      37sha256sums=('07081a1aa2db039bda3e19cb9c5f91ee33820ee20c2f21613af758f69bb9365e'
    
      38            '555082141ff6038ac4c6700398b8b7727895c2d0fe243b768885439ea36c8667'
    
      39            '791adc82735316a6a2ca21ce16cf6f030ad640a8a2fdcc1f388c33816272131e')
    
      40
    
      41package() {
    
      42  install -Dm755 "hakase-$_tag-linux-amd64" "$pkgdir/usr/bin/hakase"
    
      43  install -Dm644 config.json.example "$pkgdir/usr/share/doc/hakase/config.json.example"
    
      44  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/hakase/LICENSE"
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-24 00:17:16	Low	2
2026-08-23 23:21:41	Low	2