herdr-app-desktop-bin

MEDIUM

maintainer czyt 0 votes scanned 2026-10-30 01:57:15.067039

View on AUR

Why flagged

Prebuilt binary downloaded from releases.herdr.dev, a non-whitelisted personal/project host unrelated to a major forge; while checksums are provided and the host appears to be the project's own release infrastructure, it is a small/new project with few votes and the binary is executed directly, making it unverifiable if the host were compromised or swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://releases.herdr.dev/app/${pkgver}/herdr-app-linux-x86_64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt binary downloaded from releases.herdr.dev, a non-whitelisted personal/project host unrelated to a major forge; while checksums are provided and the host appears to be the project's own release infrastructure, it is a small/new project with few votes and the binary is executed directly, making it unverifiable if the host were compromised or swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=herdr-app-desktop-bin
    
      3pkgver=0.1.8
    
      4pkgrel=1
    
      5pkgdesc="Native desktop workspace for terminals and coding agents that keep running (prebuilt)"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://herdr.dev"
    
      8license=('Apache-2.0')
    
      9depends=('gcc-libs' 'glibc' 'hicolor-icon-theme' 'libglvnd' 'libxcb' 'libxkbcommon' 'libxkbcommon-x11' 'vulkan-icd-loader' 'wayland')
    
      10optdepends=('hc-bin: herdr-core background server (the app offers to fetch it on first run)')
    
      11provides=("herdr-app=${pkgver}")
    
      12# Installs the same files as herdr-app-bin, so the two must not coexist.
    
      13conflicts=('herdr-app-bin' 'herdr-app')
    
      14options=('!strip' '!debug')
    
      15
    
      16# Upstream publishes no GitHub Releases: versions live in the
    
      17# releases.herdr.dev manifest and download URLs are version-pinned.
    
      18source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://releases.herdr.dev/app/${pkgver}/herdr-app-linux-x86_64.tar.gz")
    
      19source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://releases.herdr.dev/app/${pkgver}/herdr-app-linux-aarch64.tar.gz")
    
      20sha256sums_x86_64=('a632465248034195fe5fa8f266b7e3578608b2ddc5569d8fd3a1b30bbb64691b')
    
      21sha256sums_aarch64=('0c9c17a8623b1dcdf08e22f59f97969fa447cf7db401b330fbd5c5c0fb52d97f')
    
      22
    
      23package() {
    
      24    install -Dm755 "${srcdir}/herdr-app/herdr-app" "${pkgdir}/usr/bin/herdr-app"
    
      25
    
      26    install -Dm644 "${srcdir}/herdr-app/herdr-app.svg" \
    
      27        "${pkgdir}/usr/share/icons/hicolor/scalable/apps/herdr-app.svg"
    
      28
    
      29    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/herdr-app.desktop" <<'DESKTOP'
    
      30[Desktop Entry]
    
      31Type=Application
    
      32Name=Herdr
    
      33Comment=Terminals and coding agents that keep running
    
      34Exec=herdr-app
    
      35Icon=herdr-app
    
      36Terminal=false
    
      37Categories=Development;
    
      38StartupWMClass=herdr-app
    
      39DESKTOP
    
      40
    
      41    install -Dm644 "${srcdir}/herdr-app/LICENSE" \
    
      42        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      43    install -Dm644 "${srcdir}/herdr-app/THIRD-PARTY-NOTICES" \
    
      44        "${pkgdir}/usr/share/licenses/${pkgname}/THIRD-PARTY-NOTICES"
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 01:57:15	Medium	3
2026-10-30 01:55:02	Medium	3