honk-bin

MEDIUM

maintainer illusory 0 votes scanned 2026-10-29 15:57:19.794789

View on AUR

Why flagged

Installs a prebuilt static binary (honk-core) from GitHub release assets of a project with very few votes and recent upload; while the download is from the project's own GitHub releases and checksums are pinned, the binary is a prebuilt eBPF transparent proxy engine that runs as a privileged system service, and the project is obscure/unestablished enough that the supply-chain risk is non-trivial despite the sha256 pinning.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:61 "config.example.dae::https://fastly.jsdelivr.net/gh/daeuniverse/honk@v${_upver}/example.dae"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt static binary (honk-core) from GitHub release assets of a project with very few votes and recent upload; while the download is from the project's own GitHub releases and checksums are pinned, the binary is a prebuilt eBPF transparent proxy engine that runs as a privileged system service, and the project is obscure/unestablished enough that the supply-chain risk is non-trivial despite the sha256 pinning.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: illusory <becomeillusory@gmail.com>
    
      2
    
      3pkgname=honk-bin
    
      4pkgver=0.1.0beta.3
    
      5pkgrel=1
    
      6pkgdesc='Experimental Linux eBPF transparent proxy engine (prebuilt musl static full build)'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/daeuniverse/honk'
    
      9license=('GPL-3.0-only')
    
      10# The shipped binary is a static musl executable with no dynamic library
    
      11# dependencies. systemd provides the unit, kmod and procps-ng are used by the
    
      12# install script (modprobe to load NFQUEUE modules, sysctl to restore values on
    
      13# removal), and iproute2 by honk-check.
    
      14depends=('systemd' 'kmod' 'procps-ng' 'iproute2')
    
      15optdepends=(
    
      16  'nftables: honk-check NFQUEUE leftovers, and manual rule inspection'
    
      17  'bpftool: inspect loaded eBPF programs and pinned maps'
    
      18  'v2ray-geoip: geoip.dat for geoip: routing rules'
    
      19  'v2ray-domain-list-community: geosite.dat for geosite: routing rules'
    
      20)
    
      21provides=('honk-core')
    
      22conflicts=('honk-core' 'honk-core-bin')
    
      23backup=('etc/honk/config.dae')
    
      24install="${pkgname}.install"
    
      25options=('!strip' '!debug')
    
      26
    
      27_upver='0.1.0-beta.3'
    
      28# Literal directory names keep .SRCINFO architecture-correct regardless of which
    
      29# host generated it (${CARCH} inside source= would resolve at build time only).
    
      30_dir_x86_64="honk-core-v${_upver}-x86_64-unknown-linux-musl-full"
    
      31_dir_aarch64="honk-core-v${_upver}-aarch64-unknown-linux-musl-full"
    
      32
    
      33# Release assets cannot go through jsDelivr/Fastly: those CDNs only serve files
    
      34# committed inside a repository, so the tarball path returns 404 there (verified
    
      35# for both fastly.jsdelivr.net and cdn.jsdelivr.net). Measured from a CN ISP:
    
      36#
    
      37#   github.com direct   ~2.9 MB/s   (fastest here)
    
      38#   gh-proxy.com        ~40 KB/s
    
      39#   ghproxy.net         ~130 KB/s
    
      40#
    
      41# So the default is the upstream URL; override it when github.com is blocked or
    
      42# slow on your route:
    
      43#
    
      44#   makepkg GITHUB_MIRROR=https://gh-proxy.com
    
      45#   makepkg GITHUB_MIRROR=https://ghproxy.net
    
      46#
    
      47# A trailing slash is optional. The sha256s below pin the exact upstream bytes,
    
      48# so a broken or hostile mirror fails the build instead of shipping a different
    
      49# binary.
    
      50_github_mirror="${GITHUB_MIRROR:-}"
    
      51[[ -n "$_github_mirror" ]] && _github_mirror="${_github_mirror%/}/"
    
      52_dl_base="${_github_mirror}${url}/releases/download/v${_upver}"
    
      53
    
      54source=(
    
      55  'honk-core.service'
    
      56  'config.dae'
    
      57  'honk-check'
    
      58  'honk-modules.conf'
    
      59  # jsDelivr serves the exact blob of the GitHub tag. raw.githubusercontent.com
    
      60  # resets the connection from some ISPs; fastly.jsdelivr.net is reachable.
    
      61  "config.example.dae::https://fastly.jsdelivr.net/gh/daeuniverse/honk@v${_upver}/example.dae"
    
      62)
    
      63source_x86_64=("${_dir_x86_64}.tar.gz::${_dl_base}/${_dir_x86_64}.tar.gz")
    
      64source_aarch64=("${_dir_aarch64}.tar.gz::${_dl_base}/${_dir_aarch64}.tar.gz")
    
      65
    
      66sha256sums=('ce16fa1bb208e289fc456945c8eee56df7590e5d2abbffdf405fdee9ed664398'
    
      67            'b6c68fe82d768be60ba00f7d3f00d5a4c47fa65a0921d19f0c29a8e22fb940bc'
    
      68            '95ef7759d5883f4b0ed43815eed6d1248ab636baad7b46470e0e5abacca5453a'
    
      69            'cba5c54fdc2ad776e8df3ac6094af3b6010554508925172b6e240a645630be13'
    
      70            '50d1ddbcc901d4e477f5e67ea2092ba364667dea24588929fbf9b2583035679b')
    
      71sha256sums_x86_64=('101b1f9bed80eff0a9287fbb7a6d9b933f30e8d9b511fad738d48c501cb8e55c')
    
      72sha256sums_aarch64=('9b782c6fcf2594a78aeac309371ec8026dcf3d460e457559e992d6bd91431c50')
    
      73
    
      74prepare() {
    
      75  # Upstream's example still points at the pre-0.1 legacy data root and at an
    
      76  # eth0 LAN bridge; both would silently misbehave on a desktop.
    
      77  sed -e 's|/var/share/honk|/var/lib/honk|g' \
    
      78      -e 's|^    lan_interface: eth0$|    # lan_interface: br0  # uncomment and set to your LAN bridge to proxy LAN clients|' \
    
      79      "${srcdir}/config.example.dae" > "${srcdir}/config.example.patched.dae"
    
      80}
    
      81
    
      82package() {
    
      83  local dir
    
      84  case "$CARCH" in
    
      85    x86_64)  dir="$_dir_x86_64" ;;
    
      86    aarch64) dir="$_dir_aarch64" ;;
    
      87    *) error "unsupported architecture: $CARCH" ;;
    
      88  esac
    
      89  cd "$dir"
    
      90
    
      91  install -Dm755 honk-core "${pkgdir}/usr/bin/honk-core"
    
      92
    
      93  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      94  install -d "${pkgdir}/usr/share/licenses/${pkgname}/doona"
    
      95  cp -a doona/. "${pkgdir}/usr/share/licenses/${pkgname}/doona/"
    
      96
    
      97  install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      98
    
      99  install -Dm644 "${srcdir}/honk-core.service" \
    
      100    "${pkgdir}/usr/lib/systemd/system/honk-core.service"
    
      101  install -Dm755 "${srcdir}/honk-check" "${pkgdir}/usr/bin/honk-check"
    
      102
    
      103  # backup=() needs the parent directory to exist inside the package, otherwise
    
      104  # pacman cannot place the file on a fresh install.
    
      105  install -d -m 0755 "${pkgdir}/etc/honk"
    
      106  install -Dm644 "${srcdir}/config.dae" "${pkgdir}/etc/honk/config.dae"
    
      107  install -Dm644 "${srcdir}/config.example.patched.dae" \
    
      108    "${pkgdir}/etc/honk/config.dae.example"
    
      109
    
      110  # /usr/lib, not /etc: these are fixed kernel requirements of the package, not
    
      111  # administrator configuration.
    
      112  install -Dm644 "${srcdir}/honk-modules.conf" \
    
      113    "${pkgdir}/usr/lib/modules-load.d/honk.conf"
    
      114}
    
      115

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 15:57:19	Medium	3
2026-10-29 15:52:51	Medium	2