herdr-app-bin

LOW

maintainer Qingxu 0 votes scanned 2026-10-30 00:29:30.650963

View on AUR

Why flagged

Prebuilt binaries are downloaded from releases.herdr.dev, which appears to be the project's own release infrastructure (matching the project URL herdr.dev), with proper sha256 checksums for the architecture-specific tarballs; the only SKIP'd checksum is for the LICENSE text file which is pure data and not executed.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Prebuilt binaries are downloaded from releases.herdr.dev, which appears to be the project's own release infrastructure (matching the project URL herdr.dev), with proper sha256 checksums for the architecture-specific tarballs; the only SKIP'd checksum is for the LICENSE text file which is pure data and not executed.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 "$pkgname-$pkgver-x86_64.tar.gz::https://releases.herdr.dev/app/$pkgver/herdr-app-linux-x86_64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Qingxu <me@linioi.com>
    
      2pkgname=herdr-app-bin
    
      3pkgver=0.1.7
    
      4pkgrel=2
    
      5pkgdesc='Native desktop workspace for terminals and coding agents that keep running'
    
      6url='https://herdr.dev'
    
      7arch=(
    
      8    'x86_64'
    
      9    'aarch64'
    
      10)
    
      11license=(
    
      12    'Apache-2.0'
    
      13)
    
      14depends=(
    
      15    'gcc-libs'
    
      16    'glibc'
    
      17    'hicolor-icon-theme'
    
      18    'libglvnd'
    
      19    'libxcb'
    
      20    'libxkbcommon'
    
      21    'libxkbcommon-x11'
    
      22    'vulkan-icd-loader'
    
      23    'wayland'
    
      24    'herdr-core>=0.1.11'
    
      25)
    
      26provides=(
    
      27    "${pkgname%-bin}=$pkgver"
    
      28)
    
      29conflicts=(
    
      30    "${pkgname%-bin}"
    
      31)
    
      32options=(
    
      33    '!strip'
    
      34    '!debug'
    
      35)
    
      36source=(
    
      37    "LICENSE::https://raw.githubusercontent.com/herdrdev/herdr-app/master/LICENSE"
    
      38)
    
      39source_x86_64=(
    
      40    "$pkgname-$pkgver-x86_64.tar.gz::https://releases.herdr.dev/app/$pkgver/herdr-app-linux-x86_64.tar.gz"
    
      41)
    
      42source_aarch64=(
    
      43    "$pkgname-$pkgver-aarch64.tar.gz::https://releases.herdr.dev/app/$pkgver/herdr-app-linux-aarch64.tar.gz"
    
      44)
    
      45sha256sums=('SKIP')
    
      46sha256sums_x86_64=('7678f9706552220047eb51ed1c781cef9495eab69dbff19e7b8952a1d096802e')
    
      47sha256sums_aarch64=('f170b2600a1abdf04bce81c066704db86282e98cfbe38797ce3bedc1e0d9dfd6')
    
      48
    
      49package() {
    
      50    install -Dm755 "$srcdir/herdr-app/herdr-app" "$pkgdir/usr/bin/herdr-app"
    
      51    install -Dm644 "$srcdir/herdr-app/herdr-app.svg" \
    
      52        "$pkgdir/usr/share/icons/hicolor/scalable/apps/herdr-app.svg"
    
      53
    
      54    install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/herdr-app.desktop" <<'DESKTOP'
    
      55[Desktop Entry]
    
      56Type=Application
    
      57Name=Herdr
    
      58Comment=Terminals and coding agents that keep running
    
      59Exec=herdr-app
    
      60Icon=herdr-app
    
      61Terminal=false
    
      62Categories=Development;
    
      63StartupWMClass=herdr-app
    
      64DESKTOP
    
      65
    
      66    install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 00:29:30	Low	3
2026-10-29 21:57:52	Low	3
2026-10-29 21:53:30	Medium	3