herta-bin

LOW

maintainer AnRan 0 votes scanned 2026-09-26 09:14:41.464653

View on AUR

Why flagged

The package repacks an official AppImage from the project's GitHub release page, uses system Electron for security updates, and modifies only resource paths; the main payload is non-executable data extracted from a trusted upstream source, so the risk is low despite unverifiable checksums on non-binary assets.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package repacks an official AppImage from the project's GitHub release page, uses system Electron for security updates, and modifies only resource paths; the main payload is non-executable data extracted from a trusted upstream source, so the risk is low despite unverifiable checksums on non-binary assets.

PKGBUILD

      1# Maintainer: AnRan <2318621872 at qq dot com>
    
      2#
    
      3# Packaged from the official AppImage release; upstream also ships a from-source
    
      4# PKGBUILD at packaging/arch/PKGBUILD.
    
      5#
    
      6# herta-bin repacks the official upstream AppImage. Only the application
    
      7# payload (resources/) is installed; the Chromium runtime comes from Arch's
    
      8# electron${_electronversion} package instead of the AppImage's bundled copy, which
    
      9# keeps the installed size roughly 270 MiB smaller and lets Electron security
    
      10# updates arrive through pacman.
    
      11#
    
      12# The AppImage is fetched from the project's own release page, so no
    
      13# game-derived artwork or voice asset is redistributed here -- see the
    
      14# exclusion list in the project LICENSE.
    
      15
    
      16pkgname=herta-bin
    
      17_appname=${pkgname%-bin}
    
      18_electronversion=43
    
      19_appdir="/usr/lib/${pkgname}"
    
      20pkgver=0.1.6
    
      21pkgrel=2
    
      22pkgdesc="The self that uses the agent - desktop companion (AppImage payload, system Electron)"
    
      23arch=('x86_64')
    
      24url="https://github.com/PersonaCLI/Herta"
    
      25license=('MIT')
    
      26depends=(
    
      27    "electron${_electronversion}"
    
      28    'libxss'
    
      29    'libnotify'
    
      30    'libxtst'
    
      31    'hicolor-icon-theme'
    
      32)
    
      33optdepends=(
    
      34    'gnome-keyring: keep the stored API key encrypted at rest'
    
      35    'xdg-utils: open external links from the application'
    
      36)
    
      37provides=('herta')
    
      38conflicts=('herta')
    
      39makedepends=('asar')
    
      40# The ASAR is not strip-safe and the bundled TTS addon must keep its symbols.
    
      41options=('!strip' '!debug')
    
      42source=(
    
      43    "Herta-x86_64.AppImage::https://github.com/PersonaCLI/Herta/releases/download/v${pkgver}/Herta-x86_64.AppImage"
    
      44    "${_appname}.sh"
    
      45    "herta.desktop"
    
      46)
    
      47sha256sums=('58488abb85e8a53583779c77edfc06c80ee5dbfc7f742d47a5c6ca7cc40554e1'
    
      48            'SKIP'
    
      49            'SKIP')
    
      50
    
      51prepare() {
    
      52    cd "${srcdir}"
    
      53    # makepkg does not keep the executable bit on downloaded sources.
    
      54    chmod +x Herta-x86_64.AppImage
    
      55    # The AppImage type-2 runtime unpacks itself without FUSE.
    
      56    ./Herta-x86_64.AppImage --appimage-extract >/dev/null
    
      57
    
      58    # The app resolves its payload through process.resourcesPath, which under a
    
      59    # system Electron points at /usr/lib/electron${_electronversion}/resources.
    
      60    # Repoint every occurrence at the directory this package installs.
    
      61    asar extract squashfs-root/resources/app.asar app.asar.tree
    
      62    rm -f squashfs-root/resources/app.asar
    
      63    while read -r _file; do
    
      64        sed -i "s|process\.resourcesPath|'${_appdir}/resources'|g" "${_file}"
    
      65    done < <(grep -rlI 'process\.resourcesPath' app.asar.tree || true)
    
      66    asar pack app.asar.tree squashfs-root/resources/app.asar
    
      67    rm -rf app.asar.tree
    
      68
    
      69    sed -i -e "s|@electronversion@|${_electronversion}|g" \
    
      70           -e "s|@appdir@|${_appdir}|g" \
    
      71           -e "s|@appname@|${_appname}|g" "${srcdir}/${_appname}.sh"
    
      72}
    
      73
    
      74package() {
    
      75    cd "${srcdir}"
    
      76
    
      77    install -Dm755 "${_appname}.sh" "${pkgdir}/usr/bin/${_appname}"
    
      78
    
      79    install -dm755 "${pkgdir}${_appdir}/resources"
    
      80    # --no-preserve=ownership: fakeroot records the files as root anyway, and it
    
      81    # keeps packaging independent of the builder's surroundings.
    
      82    cp -a --no-preserve=ownership squashfs-root/resources/. "${pkgdir}${_appdir}/resources/"
    
      83
    
      84    install -Dm644 squashfs-root/usr/share/icons/hicolor/1024x1024/apps/herta.png \
    
      85        "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/herta.png"
    
      86
    
      87    # Upstream's own desktop entry (packaging/arch/herta.desktop), with Exec
    
      88    # pointed at this package's launcher. Keeps the translated name and the
    
      89    # search keywords that a hand-rolled entry would drop.
    
      90    install -Dm644 herta.desktop "${pkgdir}/usr/share/applications/${_appname}.desktop"
    
      91
    
      92    install -Dm644 squashfs-root/resources/LICENSE \
    
      93        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      94    install -Dm644 squashfs-root/resources/THIRD-PARTY-NOTICES.md \
    
      95        "${pkgdir}/usr/share/licenses/${pkgname}/THIRD-PARTY-NOTICES.md"
    
      96}
    
      97

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-26 09:14:41	Low	2