hermes-agent-bin

LOW

maintainer jabla 0 votes scanned 2026-09-09 13:19:49.747679

View on AUR

Why flagged

The package is a prebuilt binary wrapper that re-packages a CI-built Arch package from a GitHub release; while the source is not built locally and comes from a personal account, it wraps a legitimate project's software and the checksum is verified, limiting risk to supply-chain trust in the maintainer.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package is a prebuilt binary wrapper that re-packages a CI-built Arch package from a GitHub release; while the source is not built locally and comes from a personal account, it wraps a legitimate project's software and the checksum is verified, limiting risk to supply-chain trust in the maintainer.

PKGBUILD

      1# Maintainer: jabla <jabla3000@duck.com>
    
      2#
    
      3# Prebuilt by GitHub Actions in https://github.com/jabla/hermes-agent-bin
    
      4# (archlinux container, non-root makepkg). The artifact is the finished Arch
    
      5# package; this PKGBUILD only re-wraps it, nothing is compiled here.
    
      6pkgname=hermes-agent-bin
    
      7pkgver=0.21.0
    
      8pkgrel=1
    
      9pkgdesc="Locally-run AI agent with tool use, web browsing, and automation (prebuilt binary, CI-built)"
    
      10arch=('x86_64')
    
      11url='https://github.com/NousResearch/hermes-agent'
    
      12license=('MIT')
    
      13depends=(
    
      14  'nodejs' 'uv' 'ripgrep' 'ffmpeg'
    
      15  'nss' 'atk' 'at-spi2-core' 'cups' 'libdrm' 'libxkbcommon' 'mesa' 'pango'
    
      16  'cairo' 'alsa-lib' 'git' 'curl'
    
      17)
    
      18conflicts=('hermes-agent')
    
      19provides=('hermes-agent')
    
      20options=('!debug')
    
      21source=("https://github.com/jabla/hermes-agent-bin/releases/download/v${pkgver}-${pkgrel}/${pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
    
      22sha256sums=('363e088ac6cf3c364850010026bf80aaf0d625fe44c9dd58060d14531694c00d')
    
      23
    
      24# The downloaded source is itself a complete Arch package. Extract only its
    
      25# payload (usr/); metadata (.PKGINFO/.MTREE/.BUILDINFO) is regenerated by
    
      26# makepkg for this wrapper package.
    
      27package() {
    
      28  bsdtar -xf "${srcdir}/${pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst" \
    
      29    -C "${pkgdir}" ./usr
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-09 13:19:49	Low	2