hclient-cli-bin

maintainer czyt · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from a project-specific domain with verifiable checksums; while the host is not a standard forge, it is plausibly official and the binaries are validated, limiting supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from a project-specific domain with verifiable checksums; while the host is not a standard forge, it is plausibly official and the binaries are validated, limiting supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("${pkgname}-${pkgver}-amd64::https://dl.lazycatmicroserver.com/hclient-cli/v${pkgver}/hclient-cli-linux-amd64")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=hclient-cli-bin
    
      3pkgver=1.1.4
    
      4pkgrel=2
    
      5pkgdesc="Lazycat Microserver CLI client (懒猫微服命令行客户端)"
    
      6arch=('x86_64' 'aarch64' 'riscv64')
    
      7url="https://lazycat.cloud/download"
    
      8license=('MIT')
    
      9provides=('hclient-cli')
    
      10conflicts=('hclient-cli')
    
      11
    
      12source_x86_64=("${pkgname}-${pkgver}-amd64::https://dl.lazycatmicroserver.com/hclient-cli/v${pkgver}/hclient-cli-linux-amd64")
    
      13source_aarch64=("${pkgname}-${pkgver}-arm64::https://dl.lazycatmicroserver.com/hclient-cli/v${pkgver}/hclient-cli-linux-arm64")
    
      14source_riscv64=("${pkgname}-${pkgver}-riscv64::https://dl.lazycatmicroserver.com/hclient-cli/v${pkgver}/hclient-cli-linux-riscv64")
    
      15
    
      16sha256sums_x86_64=('47519ae0378506b098634545ab2989861ae58a0c367d77481a23cb47495767cd')
    
      17sha256sums_aarch64=('e7bb81fd8f66d2b3ac9ea3810ca4d97d6ff5a53c7e375a893938d5f270e084f5')
    
      18sha256sums_riscv64=('f2d8b1943f59ceb2e00667843bce84f5cd4503ce4654372843970a731c6de416')
    
      19
    
      20package() {
    
      21    case "$CARCH" in
    
      22        x86_64)  _src="${pkgname}-${pkgver}-amd64" ;;
    
      23        aarch64) _src="${pkgname}-${pkgver}-arm64" ;;
    
      24        riscv64) _src="${pkgname}-${pkgver}-riscv64" ;;
    
      25    esac
    
      26    install -Dm755 "${srcdir}/${_src}" "${pkgdir}/usr/bin/hclient-cli"
    
      27}
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-07-24 00:02
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: czyt <czytcn@gmail.com>
 pkgname=hclient-cli-bin
 pkgver=1.1.4
-pkgrel=1
+pkgrel=2
 pkgdesc="Lazycat Microserver CLI client (懒猫微服命令行客户端)"
 arch=('x86_64' 'aarch64' 'riscv64')
 url="https://lazycat.cloud/download"
@@ -9,9 +9,9 @@
 provides=('hclient-cli')
 conflicts=('hclient-cli')
 
-source_x86_64=("${pkgname}-amd64::https://dl.lazycatmicroserver.com/hclient-cli/v${pkgver}/hclient-cli-linux-amd64")
-source_aarch64=("${pkgname}-arm64::https://dl.lazycatmicroserver.com/hclient-cli/v${pkgver}/hclient-cli-linux-arm64")
-source_riscv64=("${pkgname}-riscv64::https://dl.lazycatmicroserver.com/hclient-cli/v${pkgver}/hclient-cli-linux-riscv64")
+source_x86_64=("${pkgname}-${pkgver}-amd64::https://dl.lazycatmicroserver.com/hclient-cli/v${pkgver}/hclient-cli-linux-amd64")
+source_aarch64=("${pkgname}-${pkgver}-arm64::https://dl.lazycatmicroserver.com/hclient-cli/v${pkgver}/hclient-cli-linux-arm64")
+source_riscv64=("${pkgname}-${pkgver}-riscv64::https://dl.lazycatmicroserver.com/hclient-cli/v${pkgver}/hclient-cli-linux-riscv64")
 
 sha256sums_x86_64=('47519ae0378506b098634545ab2989861ae58a0c367d77481a23cb47495767cd')
 sha256sums_aarch64=('e7bb81fd8f66d2b3ac9ea3810ca4d97d6ff5a53c7e375a893938d5f270e084f5')
@@ -19,9 +19,9 @@
 
 package() {
     case "$CARCH" in
-        x86_64)  _src="${pkgname}-amd64" ;;
-        aarch64) _src="${pkgname}-arm64" ;;
-        riscv64) _src="${pkgname}-riscv64" ;;
+        x86_64)  _src="${pkgname}-${pkgver}-amd64" ;;
+        aarch64) _src="${pkgname}-${pkgver}-arm64" ;;
+        riscv64) _src="${pkgname}-${pkgver}-riscv64" ;;
     esac
     install -Dm755 "${srcdir}/${_src}" "${pkgdir}/usr/bin/hclient-cli"
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 01:26:42	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 05:22:32	MEDIUM	1
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2