hc-bin

MEDIUM

maintainer czyt 0 votes scanned 2026-10-30 01:57:15.067039

View on AUR

Why flagged

Prebuilt static binary downloaded from releases.herdr.dev, a non-GitHub host unrelated to any major vendor infrastructure; while checksums are provided, the host is a personal/project-controlled domain with no independent verification, making silent substitution plausible if the domain is compromised or swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://releases.herdr.dev/core/${pkgver}/${_pkg}-x86_64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt static binary downloaded from releases.herdr.dev, a non-GitHub host unrelated to any major vendor infrastructure; while checksums are provided, the host is a personal/project-controlled domain with no independent verification, making silent substitution plausible if the domain is compromised or swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=hc-bin
    
      3pkgver=0.1.14
    
      4pkgrel=1
    
      5pkgdesc="herdr-core (hc) — background server that keeps Herdr terminals and coding agents running (prebuilt, static)"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://herdr.dev/core/"
    
      8license=('Apache-2.0')
    
      9depends=()
    
      10provides=("herdr-core=${pkgver}")
    
      11# Installs the same files as herdr-core-bin, so the two must not coexist.
    
      12# herdr-bin (the Herdr supervisor) is a separate component and may stay.
    
      13conflicts=("herdr-core-bin" "herdr-core")
    
      14options=('!strip' '!debug')
    
      15
    
      16# Upstream publishes no GitHub Releases: versions live in the
    
      17# releases.herdr.dev manifest and download URLs are version-pinned.
    
      18_pkg="herdr-core-linux"
    
      19source=("LICENSE-${pkgver}::https://raw.githubusercontent.com/herdrdev/herdr-core/v${pkgver}/LICENSE")
    
      20source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://releases.herdr.dev/core/${pkgver}/${_pkg}-x86_64.tar.gz")
    
      21source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://releases.herdr.dev/core/${pkgver}/${_pkg}-aarch64.tar.gz")
    
      22sha256sums=('c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4')
    
      23sha256sums_x86_64=('e9dbabdead0ce0ce3de51b6f54cc9549efedbb41b2f8448b6932ab0d1442343e')
    
      24sha256sums_aarch64=('19cef6a2e52f14c22c4b6f3fdaf1a462d2dafc78e8b03fabbfad5b063477a370')
    
      25
    
      26package() {
    
      27    install -Dm755 "${srcdir}/herdr-core" "${pkgdir}/usr/bin/herdr-core"
    
      28    # Upstream install.sh only creates the hc alias when no hc is present;
    
      29    # in a package the alias is always ours to own.
    
      30    ln -s herdr-core "${pkgdir}/usr/bin/hc"
    
      31    install -Dm644 "${srcdir}/LICENSE-${pkgver}"         "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 01:57:15	Medium	3
2026-10-30 01:55:02	Medium	2