herdr-core-bin

MEDIUM

maintainer Qingxu 0 votes scanned 2026-10-30 00:29:30.650963

View on AUR

Why flagged

Prebuilt binary downloaded from releases.herdr.dev, a non-whitelisted personal/project host unrelated to a major forge's release infrastructure; while checksums are provided for the binaries, the host is not independently verifiable as official and could be silently swapped, making this a moderate supply-chain risk for an executable installed to /usr/bin.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 "$pkgname-$pkgver-x86_64.tar.gz::https://releases.herdr.dev/core/$pkgver/herdr-core-linux-x86_64.tar.gz"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 60%): Prebuilt binary downloaded from releases.herdr.dev, a non-whitelisted personal/project host unrelated to a major forge's release infrastructure; while checksums are provided for the binaries, the host is not independently verifiable as official and could be silently swapped, making this a moderate supply-chain risk for an executable installed to /usr/bin.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Qingxu <me@linioi.com>
    
      2pkgname=herdr-core-bin
    
      3pkgver=0.1.13
    
      4pkgrel=2
    
      5pkgdesc='Background server that keeps Herdr terminals and coding agents running'
    
      6url='https://herdr.dev/core/'
    
      7arch=(
    
      8    'x86_64'
    
      9    'aarch64'
    
      10)
    
      11license=(
    
      12    'Apache-2.0'
    
      13)
    
      14provides=(
    
      15    "${pkgname%-bin}=$pkgver"
    
      16)
    
      17conflicts=(
    
      18    "${pkgname%-bin}"
    
      19)
    
      20options=(
    
      21    '!strip'
    
      22    '!debug'
    
      23)
    
      24source=(
    
      25    "LICENSE::https://raw.githubusercontent.com/herdrdev/herdr-core/master/LICENSE"
    
      26)
    
      27source_x86_64=(
    
      28    "$pkgname-$pkgver-x86_64.tar.gz::https://releases.herdr.dev/core/$pkgver/herdr-core-linux-x86_64.tar.gz"
    
      29)
    
      30source_aarch64=(
    
      31    "$pkgname-$pkgver-aarch64.tar.gz::https://releases.herdr.dev/core/$pkgver/herdr-core-linux-aarch64.tar.gz"
    
      32)
    
      33sha256sums=('SKIP')
    
      34sha256sums_x86_64=('d0dbfdd6e060832c629a6aed03687165479baceab5a5545a103490d0e4adab8c')
    
      35sha256sums_aarch64=('82abc30deaf6e7daeca3c60eefc12708f0210f945c28062674be71fcfde17bd5')
    
      36
    
      37package() {
    
      38    install -Dm755 "$srcdir/herdr-core" "$pkgdir/usr/bin/herdr-core"
    
      39    ln -s herdr-core "$pkgdir/usr/bin/hc"
    
      40    install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 00:29:30	Medium	3
2026-10-29 21:57:52	Medium	3
2026-10-29 21:53:30	Medium	3