hexgrep

LOW

maintainer Xyne 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is hosted on the maintainer's own domain, which is plausibly the project's official site, and the package builds from source without executing untrusted binaries or obfuscated code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is hosted on the maintainer's own domain, which is plausibly the project's official site, and the package builds from source without executing untrusted binaries or obfuscated code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 https://xyne.dev/projects/hexgrep/src/hexgrep-2013.9.6.tar.xz

PKGBUILD

1 offending line(s) highlighted

      1#Maintainer: Xyne <gro xunilhcra enyx, backwards>
    
      2pkgname=hexgrep
    
      3pkgver=2013.9.6
    
      4pkgrel=4
    
      5pkgdesc='versatile grep-like binary stream and file search tool'
    
      6arch=(i686 x86_64)
    
      7license=(GPL)
    
      8url="https://xyne.dev/projects/hexgrep"
    
      9source=(
    
      10  https://xyne.dev/projects/hexgrep/src/hexgrep-2013.9.6.tar.xz
    
      11  https://xyne.dev/projects/hexgrep/src/hexgrep-2013.9.6.tar.xz.sig
    
      12)
    
      13sha512sums=(
    
      14  d6a6e2062176fd32404e27318cb1dd463579d2112e26feef487e6ffbfd8baf11d39b44a940ea11256819b99b411c3e191e76c4e3cac482340c71b4a9078ddd61
    
      15  4a7146f5ab1839ce1613ebbbd244dab4925ba69b925382cf3c603aa59c03d748a6ca24ad65378890e8ef1ec8dc93b84ddba03e0f80d69b787e6d380ea0a2e824
    
      16)
    
      17md5sums=(
    
      18  0550b56796ca5c14e3c825b6c68b9aa0
    
      19  e6a7a5c928381275c088d95a05ae482a
    
      20)
    
      21validpgpkeys=('D89FAAEB4CECAFD199A2F5E612C6F735F7A9A519')
    
      22
    
      23build ()
    
      24{
    
      25  cd -- "$srcdir/$pkgname-$pkgver"
    
      26  make
    
      27}
    
      28
    
      29package ()
    
      30{
    
      31  cd -- "$srcdir/$pkgname-$pkgver"
    
      32  make prefix=/usr DESTDIR="$pkgdir" install
    
      33  install -Dm644 "man/hexgrep.1.gz" "$pkgdir/usr/share/man/man1/hexgrep.1.gz"
    
      34}
    
      35
    
      36# vim: set ts=2 sw=2 et:
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2