humanlayer-bin

maintainer asermax · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from npmjs.org, a legitimate registry; while the source is not the project's primary repo, npm is a trusted distribution platform for this type of tool, and the binaries are checksum-verified, limiting supply-chain risk to typical AUR levels.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from npmjs.org, a legitimate registry; while the source is not the project's primary repo, npm is a trusted distribution platform for this type of tool, and the binaries are checksum-verified, limiting supply-chain risk to typical AUR levels.

PKGBUILD

      1# Maintainer: Agustin Carrasco <asermax@gmail.com>
    
      2
    
      3_pkgname=humanlayer
    
      4pkgname=humanlayer-bin
    
      5pkgver=0.31.17
    
      6pkgrel=1
    
      7pkgdesc="HumanLayer CLI - daemon management and authentication for HumanLayer coding sessions"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/humanlayer/humanlayer"
    
      10license=('Apache-2.0')
    
      11depends=('glibc')
    
      12provides=('humanlayer')
    
      13conflicts=('humanlayer' 'humanlayer-git')
    
      14options=('!strip')
    
      15source_x86_64=("${pkgname}-${pkgver}-x86_64.tgz::https://registry.npmjs.org/@humanlayer/cli-linux-x64/-/cli-linux-x64-${pkgver}.tgz")
    
      16source_aarch64=("${pkgname}-${pkgver}-aarch64.tgz::https://registry.npmjs.org/@humanlayer/cli-linux-arm64/-/cli-linux-arm64-${pkgver}.tgz")
    
      17sha256sums_x86_64=('db08d85afea00ac6adf481b71ccee162d0109007ff44152712e667bace0cc416')
    
      18sha256sums_aarch64=('a52ac8cf97d4f55422af496b2893a7496914f6dd0c80efa146ebe7afaadce822')
    
      19
    
      20latestver() {
    
      21  curl -s "https://registry.npmjs.org/@humanlayer/cli/latest" | \
    
      22    grep -o '"version":"[^"]*"' | sed -E 's/.*"([^"]+)"$/\1/' || true
    
      23}
    
      24
    
      25package() {
    
      26  install -Dm755 "package/bin/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      27
    
      28  # Upstream only ships the license in the git repo, not in the npm tarballs,
    
      29  # so it's inlined here to avoid an extra pkgver-scoped source download per bump
    
      30  install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      31  cat > "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<'EOF'
    
      32Apache Software License 2.0
    
      33
    
      34Copyright (c) 2024, humanlayer Authors
    
      35
    
      36Licensed under the Apache License, Version 2.0 (the "License");
    
      37you may not use this file except in compliance with the License.
    
      38You may obtain a copy of the License at
    
      39
    
      40http://www.apache.org/licenses/LICENSE-2.0
    
      41
    
      42Unless required by applicable law or agreed to in writing, software
    
      43distributed under the License is distributed on an "AS IS" BASIS,
    
      44WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    
      45See the License for the specific language governing permissions and
    
      46limitations under the License.
    
      47EOF
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 23:19:22	LOW	2