hex-bin

MEDIUM

maintainer thdxr 0 votes scanned 2026-10-31 01:59:31.603525

View on AUR

Why flagged

Prebuilt executable binary downloaded from a non-standard personal/project host (anoma.ly) that is not the project's primary official infrastructure (GitHub), making it unverifiable and trivially swappable by whoever controls that domain; checksums are present but the host itself is not the canonical release source.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 source_x86_64=("hex-${pkgver}-linux-x64::https://anoma.ly/release/hex/files/5541eb3fdf971813ce72a9ada04f43ea09ebb90f9545fabca648adc9b4e3349c/hex")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Prebuilt executable binary downloaded from a non-standard personal/project host (anoma.ly) that is not the project's primary official infrastructure (GitHub), making it unverifiable and trivially swappable by whoever controls that domain; checksums are present but the host itself is not the canonical release source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dax
    
      2#
    
      3# Not a prebuilt of extra/hex (the hex dump tool, which installs /usr/bin/hx):
    
      4# this is the Hex voice dictation app, so it neither provides nor conflicts
    
      5# with it.
    
      6#
    
      7# Generated from anomalyco/hex packaging/aur by scripts/release-aur.sh, which
    
      8# sets pkgver, the release service's linux-x64 and linux-arm64 file URLs, and
    
      9# the checksums for each release.
    
      10pkgname=hex-bin
    
      11pkgver=3.0.0
    
      12pkgrel=1
    
      13pkgdesc='Hex voice dictation app by Anomaly: hold a key, speak, and it types (Linux beta; not the hex dump tool)'
    
      14arch=('x86_64' 'aarch64')
    
      15url='https://github.com/anomalyco/hex'
    
      16license=('MIT')
    
      17# Linked: alsa-lib, gcc-libs, glibc, vulkan-icd-loader. Loaded at
    
      18# runtime: the X11/Wayland/xkbcommon client libraries and OpenBLAS.
    
      19depends=(
    
      20  'alsa-lib' 'curl' 'gcc-libs' 'glibc' 'libx11' 'libxcb' 'libxcursor'
    
      21  'libxi' 'libxkbcommon' 'libxkbcommon-x11' 'openblas' 'vulkan-icd-loader'
    
      22  'wayland'
    
      23)
    
      24optdepends=(
    
      25  'wl-clipboard: paste on Wayland'
    
      26  'wtype: paste on Wayland'
    
      27  'vulkan-driver: GPU transcription'
    
      28  'wireplumber: mute output while dictating (or libpulse for pactl)'
    
      29  'xdg-utils: open links from voice commands'
    
      30)
    
      31options=('!strip' '!debug')
    
      32install=hex-bin.install
    
      33source=(
    
      34  'hex.desktop'
    
      35  'hex.service'
    
      36  'LICENSE'
    
      37)
    
      38source_x86_64=("hex-${pkgver}-linux-x64::https://anoma.ly/release/hex/files/5541eb3fdf971813ce72a9ada04f43ea09ebb90f9545fabca648adc9b4e3349c/hex")
    
      39source_aarch64=("hex-${pkgver}-linux-arm64::https://anoma.ly/release/hex/files/f43a7a3b4c6d432599f830aceaaae957b13b57bc60b6a6655a4d88ddd6a66d4a/hex")
    
      40sha256sums=('4c633c0cc9c32a22601bf7d62e4f924505b008017c89b8a7a0830792010de8b9'
    
      41            '7b7f3baa337f53b46574e4ea16d98f45c066ddcfc9cfd13bc255f5d4ce628652'
    
      42            '0c267f186f600c6f4d9d229d1792861361f2c433cfb23054fece61f227006344')
    
      43sha256sums_x86_64=('5541eb3fdf971813ce72a9ada04f43ea09ebb90f9545fabca648adc9b4e3349c')
    
      44sha256sums_aarch64=('f43a7a3b4c6d432599f830aceaaae957b13b57bc60b6a6655a4d88ddd6a66d4a')
    
      45
    
      46package() {
    
      47  local target=x64
    
      48  [ "$CARCH" = aarch64 ] && target=arm64
    
      49  install -Dm755 "hex-${pkgver}-linux-${target}" "$pkgdir/usr/bin/hex"
    
      50  install -Dm644 hex.desktop "$pkgdir/usr/share/applications/hex.desktop"
    
      51  install -Dm644 hex.service "$pkgdir/usr/lib/systemd/user/hex.service"
    
      52  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-31 01:59:31	Medium	3
2026-10-31 01:57:41	Medium	3