hokum-bin

MEDIUM

maintainer thdxr 0 votes scanned 2026-10-28 15:53:09.149778

View on AUR

Why flagged

Installs a prebuilt binary from anoma.ly, a non-standard personal/project host unrelated to a major forge or vendor CDN; while checksums are provided and match the filename hash, the binary is unverifiable and could be silently swapped if the host is compromised or controlled by an unrelated party.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 source_x86_64=("hokum-${pkgver}-linux-x64::https://anoma.ly/release/hokum/files/941fedc5a77251b220ef488ce5ac468222a1909039b741f43622b5ab7d0fdabe/hokum")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary from anoma.ly, a non-standard personal/project host unrelated to a major forge or vendor CDN; while checksums are provided and match the filename hash, the binary is unverifiable and could be silently swapped if the host is compromised or controlled by an unrelated party.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dax
    
      2#
    
      3# Generated from anomalyco/hokum packaging/aur by scripts/release-aur.sh,
    
      4# which sets pkgver, the release service's linux-x64 and linux-arm64 file
    
      5# URLs, and the checksums for each release.
    
      6#
    
      7# Like dunst and xfce4-notifyd it provides notification-daemon. Like mako,
    
      8# dunst, and swaync it installs its D-Bus activation file under its own name,
    
      9# so it shares no file with them and conflicts with none: whichever daemon
    
      10# runs first owns org.freedesktop.Notifications, and hokum.service stops
    
      11# mako, dunst, and swaync when it starts.
    
      12pkgname=hokum-bin
    
      13pkgver=0.0.3
    
      14pkgrel=1
    
      15pkgdesc='Hokum: a freedesktop notification daemon for Wayland layer-shell compositors'
    
      16arch=('x86_64' 'aarch64')
    
      17url='https://hokum.app'
    
      18license=('MIT')
    
      19provides=('hokum' 'notification-daemon')
    
      20conflicts=('hokum')
    
      21# Linked: glibc, libgcc, xkbcommon. Loaded at run time (so namcap calls them
    
      22# unneeded): the Vulkan loader and a driver, and the Wayland client library.
    
      23depends=('glibc' 'libgcc' 'libxkbcommon' 'vulkan-driver' 'vulkan-icd-loader' 'wayland')
    
      24options=('!strip' '!debug')
    
      25install=hokum-bin.install
    
      26source=(
    
      27  'hokum.service'
    
      28  'app.hokum.Notifications.service'
    
      29  'hokum.desktop'
    
      30  'LICENSE'
    
      31)
    
      32source_x86_64=("hokum-${pkgver}-linux-x64::https://anoma.ly/release/hokum/files/941fedc5a77251b220ef488ce5ac468222a1909039b741f43622b5ab7d0fdabe/hokum")
    
      33source_aarch64=("hokum-${pkgver}-linux-arm64::https://anoma.ly/release/hokum/files/f51e3793e520ad4bb819effd47e091e9f9b3b95d72f0c815e9d7d9c365158e2b/hokum")
    
      34sha256sums=('3c612f12f425359719be5e47a52f6cfcf2129333d856fac119b57de96d184e39'
    
      35            'e83761aacd0d5ec5207e594564fdaa5677def9928ba07fcadb51f1c042c62034'
    
      36            'a2f5db48078f9d8109c6d53502313ff9639643ea07a7a968e99d9c4802198335'
    
      37            'b1fe69afe2f6fe0884efc8936dab69bbdf3a319b3828a965ee1304fbd6a60021')
    
      38sha256sums_x86_64=('941fedc5a77251b220ef488ce5ac468222a1909039b741f43622b5ab7d0fdabe')
    
      39sha256sums_aarch64=('f51e3793e520ad4bb819effd47e091e9f9b3b95d72f0c815e9d7d9c365158e2b')
    
      40
    
      41package() {
    
      42  local target=x64
    
      43  [ "$CARCH" = aarch64 ] && target=arm64
    
      44  install -Dm755 "hokum-${pkgver}-linux-${target}" "$pkgdir/usr/bin/hokum"
    
      45  install -Dm644 hokum.service "$pkgdir/usr/lib/systemd/user/hokum.service"
    
      46  install -Dm644 app.hokum.Notifications.service \
    
      47    "$pkgdir/usr/share/dbus-1/services/app.hokum.Notifications.service"
    
      48  install -Dm644 hokum.desktop "$pkgdir/usr/share/applications/hokum.desktop"
    
      49  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-28 15:53:09	Medium	3
2026-10-28 15:50:30	Medium	3