hexhub-bin

maintainer wwxiaoqi · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt AppImage binary from oss.hexhub.cn, which is the vendor's own OSS (Object Storage Service) host for hexhub.cn. The binary is extracted and installed as an executable. While this appears to be the official vendor distribution channel (matching the project URL hexhub.cn), it is still a closed-source prebuilt binary from a Chinese CDN/OSS host with no way to verify the build provenance. The sha256sum provides integrity checking against tampering in transit, but does not verify the binary's origin or contents. The AppImage is executed during prepare() to extract it, meaning arbitrary code runs at build time. The license is declared GPL but this is a proprietary all-in-one tool (database/docker/ssh/sftp client), making the GPL claim suspicious. Overall this is a legitimate medium-risk pattern: a prebuilt binary from a vendor-controlled but non-auditable host, executed during the build process.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=('https://oss.hexhub.cn/plugin/HexHub-amd64-appimage-1.2.2.AppImage')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): This PKGBUILD downloads a prebuilt AppImage binary from oss.hexhub.cn, which is the vendor's own OSS (Object Storage Service) host for hexhub.cn. The binary is extracted and installed as an executable. While this appears to be the official vendor distribution channel (matching the project URL hexhub.cn), it is still a closed-source prebuilt binary from a Chinese CDN/OSS host with no way to verify the build provenance. The sha256sum provides integrity checking against tampering in transit, but does not verify the binary's origin or contents. The AppImage is executed during prepare() to extract it, meaning arbitrary code runs at build time. The license is declared GPL but this is a proprietary all-in-one tool (database/docker/ssh/sftp client), making the GPL claim suspicious. Overall this is a legitimate medium-risk pattern: a prebuilt binary from a vendor-controlled but non-auditable host, executed during the build process.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: wwxiaoqi <tahicoing@gmail.com>
    
      2
    
      3pkgname=hexhub-bin
    
      4pkgver=1.2.2
    
      5pkgrel=1
    
      6pkgdesc="database, docker, ssh, sftp. all in one"
    
      7arch=('x86_64')
    
      8url='https://www.hexhub.cn/'
    
      9license=('GPL')
    
      10depends=()
    
      11conflicts=()
    
      12options=("!strip" "!debug")
    
      13source=('https://oss.hexhub.cn/plugin/HexHub-amd64-appimage-1.2.2.AppImage')
    
      14sha256sums=('92bb5ec914e4ddf0e061afc6bad4ec0d952de8204c9fcdd05aa502e05ca86382')
    
      15
    
      16_pkgname=HexHub-amd64-appimage-1.2.2.AppImage
    
      17noextract=("$_pkgname")
    
      18
    
      19prepare() {
    
      20    chmod +x "$_pkgname"
    
      21    ./"$_pkgname" --appimage-extract > /dev/null
    
      22}
    
      23
    
      24build() {
    
      25    # Adjust .desktop so it will work autside of AppImage container
    
      26    sed -i \
    
      27        -e "s|Exec=HexHub|Exec=/opt/$pkgname/AppRun|" \
    
      28        -e "s+^Icon=.*+Icon=hexhub-bin+" \
    
      29        -e "s|^Terminal=true|Terminal=false|" \
    
      30        -e "s|^NoDisplay=true|NoDisplay=false|" \
    
      31        "squashfs-root/appimagetool.desktop"
    
      32
    
      33    # Fix work no so files.
    
      34    sed -i \
    
      35        -e "s|cd \"\$(dirname \"\$0\")\"|cd /opt/$pkgname|" \
    
      36        "squashfs-root/AppRun"
    
      37}
    
      38
    
      39package() {
    
      40    # Icon images
    
      41    install -Dm644 "squashfs-root/hexhub.png" \
    
      42            "$pkgdir/usr/share/icons/hicolor/512x512/apps/hexhub-bin.png"
    
      43    
    
      44    # Desktop file
    
      45    install -Dm644 "$srcdir/squashfs-root/appimagetool.desktop" \
    
      46            "$pkgdir/usr/share/applications/HexHub.desktop"
    
      47    
    
      48    # Copy executable
    
      49    mkdir -p "$pkgdir/opt/$pkgname"
    
      50    cp -r "$srcdir/squashfs-root/." "$pkgdir/opt/$pkgname/"
    
      51
    
      52    # Copy Bin run file
    
      53    install -dm755 "$pkgdir/usr/bin"
    
      54    cp -r "$pkgdir/opt/$pkgname/AppRun" "$pkgdir/usr/bin/hexhub"
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2