hermes-webui-desktop-appimage

MEDIUM

maintainer liteapp 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs an AppImage from GitHub releases, which is a prebuilt executable that cannot be independently verified, posing a supply-chain risk if the source were compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs an AppImage from GitHub releases, which is a prebuilt executable that cannot be independently verified, posing a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: Alexis Rossfelder <rossfelderalexis@gmail.com>
    
      2pkgname=hermes-webui-desktop-appimage
    
      3pkgver=0.7.0
    
      4pkgrel=1
    
      5pkgdesc="Cross-platform desktop shell for Hermes WebUI, the web interface for Hermes Agent (AppImage)"
    
      6arch=('x86_64')
    
      7url="https://github.com/hermes-webui/hermes-desktop-rust"
    
      8license=('MIT')
    
      9depends=('fuse2' 'webkit2gtk-4.1' 'gtk3')
    
      10provides=('hermes-webui-desktop')
    
      11conflicts=('hermes-webui-desktop')
    
      12options=('!strip' '!debug')
    
      13_appimage="hermes-webui-desktop-${pkgver}.AppImage"
    
      14source=("${_appimage}::https://github.com/hermes-webui/hermes-desktop-rust/releases/download/v${pkgver}/Hermes.WebUI.Desktop_${pkgver}_lin_x86_64.AppImage")
    
      15sha256sums=('b1b0c3b3cd56f8861ce701bb6f5f792ee271ed32648ff9b54545cc862c110c41')
    
      16noextract=("${_appimage}")
    
      17
    
      18prepare() {
    
      19	chmod +x "$srcdir/${_appimage}"
    
      20	"$srcdir/${_appimage}" --appimage-extract 'usr/share/icons/*' >/dev/null
    
      21}
    
      22
    
      23package() {
    
      24	install -Dm755 "$srcdir/${_appimage}" "$pkgdir/opt/hermes-webui-desktop/hermes-webui-desktop.AppImage"
    
      25
    
      26	install -d "$pkgdir/usr/bin"
    
      27	ln -s /opt/hermes-webui-desktop/hermes-webui-desktop.AppImage "$pkgdir/usr/bin/hermes-webui-desktop"
    
      28
    
      29	install -d "$pkgdir/usr/share"
    
      30	cp -r "$srcdir/squashfs-root/usr/share/icons" "$pkgdir/usr/share/icons"
    
      31	find "$pkgdir/usr/share/icons" -type d -empty -delete
    
      32	find "$pkgdir/usr/share/icons" -type d -exec chmod 755 {} \;
    
      33	find "$pkgdir/usr/share/icons" -type f -exec chmod 644 {} \;
    
      34
    
      35	install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/hermes-webui-desktop.desktop" <<DESKTOP
    
      36[Desktop Entry]
    
      37Categories=Office;
    
      38Comment=Hermes WebUI Desktop — cross-platform shell for hermes-webui
    
      39Exec=hermes-webui-desktop
    
      40StartupWMClass=hermes-webui-desktop
    
      41Icon=hermes-webui-desktop
    
      42Name=Hermes WebUI Desktop
    
      43Terminal=false
    
      44Type=Application
    
      45DESKTOP
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 00:18:51	Medium	2
2026-10-11 00:26:05	Medium	2
2026-10-10 20:15:50	Medium	2