hush3-bin

maintainer jahway603 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from git.hush.is using an attachment UUID URL rather than a tagged release URL, then installs multiple executed binaries (hushd, hush-cli, hush-tx, dragonxd, dragonx-cli, hush-arrakis-chain) directly onto the system. The host git.hush.is is the project's own Gitea instance (the canonical upstream for the HUSH3 privacy cryptocurrency), so it is not a random personal host — it is the official project forge. However, the attachment URL (a UUID blob) is not a versioned/tagged release artifact in the traditional sense; it could be silently replaced without changing the URL. The sha512sums are present and provide integrity verification, which significantly mitigates the supply-chain risk of silent substitution. The primary residual concern is that prebuilt cryptocurrency node binaries from a self-hosted forge carry inherent trust issues (no reproducible build verification, no distro signing), but this is standard practice for -bin AUR packages. The cheaper model's MEDIUM rating is defensible but slightly overstated given the sha512 checksums and the fact that git.hush.is is the project's own canonical host. Still, executing unverified prebuilt binaries for a cryptocurrency full node warrants keeping this at MEDIUM.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("hush-$pkgver-amd64.deb::https://git.hush.is/attachments/1123a055-a8e7-420a-8624-6f1e4adfe38e"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from git.hush.is using an attachment UUID URL rather than a tagged release URL, then installs multiple executed binaries (hushd, hush-cli, hush-tx, dragonxd, dragonx-cli, hush-arrakis-chain) directly onto the system. The host git.hush.is is the project's own Gitea instance (the canonical upstream for the HUSH3 privacy cryptocurrency), so it is not a random personal host — it is the official project forge. However, the attachment URL (a UUID blob) is not a versioned/tagged release artifact in the traditional sense; it could be silently replaced without changing the URL. The sha512sums are present and provide integrity verification, which significantly mitigates the supply-chain risk of silent substitution. The primary residual concern is that prebuilt cryptocurrency node binaries from a self-hosted forge carry inherent trust issues (no reproducible build verification, no distro signing), but this is standard practice for -bin AUR packages. The cheaper model's MEDIUM rating is defensible but slightly overstated given the sha512 checksums and the fact that git.hush.is is the project's own canonical host. Still, executing unverified prebuilt binaries for a cryptocurrency full node warrants keeping this at MEDIUM.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jah Way <jahway603 at protonmail dot com>
    
      2
    
      3pkgname=hush3-bin
    
      4_pkgname=hush3
    
      5pkgver=3.10.4
    
      6pkgrel=1
    
      7pkgdesc='HUSH (Privacy Cryptocurrency and Messenger) full node that supports z-addresses'
    
      8url='http://git.hush.is/hush/hush3'
    
      9arch=('x86_64')
    
      10license=('GPL-3.0-only')
    
      11depends=('libsodium')
    
      12makedepends=('wget' 'git' 'curl')
    
      13provides=('hush3')
    
      14conflicts=('hush3')
    
      15source=("hush-$pkgver-amd64.deb::https://git.hush.is/attachments/1123a055-a8e7-420a-8624-6f1e4adfe38e"
    
      16        "$url/raw/branch/master/LICENSE"
    
      17        "hushd.service")
    
      18sha512sums=('cf7833b3172787bb4a4c5af388ee65e0253763c6866ad8b2fca43a8076aa7dfc221c75e6f8bc2c6e70f407832fcf4c3d2c8abb5b06c8ed56f33e1b1c90655fcb'
    
      19            '7b0af5cf16f2def174a5cf63dc536e07f8a0cd3bcd48f9edccc414d406b1cb11e0a82af157ea1c43449cbabad845a1f52b084dc9232b45935880d0d82fb356ca'
    
      20            'f8ab447fc4d91a86090326427fbbe8eda019fcfddf0ba1654f599903b25f4084eacc510f262ce03f176e7fd22316c55e5d8cf43dd9a4ccea375643e8fa8270c6')
    
      21
    
      22package() {
    
      23  # extract from deb file
    
      24  tar -xf "$srcdir/data.tar.xz"
    
      25
    
      26  install -Dm644 "${srcdir}/LICENSE" "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      27
    
      28  # install required binaries & scripts
    
      29  install -Dm755 "${srcdir}/usr/bin/hush-arrakis-chain" "$pkgdir/opt/$_pkgname/hush-arrakis-chain"
    
      30  install -Dm755 "${srcdir}/usr/bin/hush-cli" "${pkgdir}/opt/$_pkgname/hush-cli"
    
      31  install -Dm755 "${srcdir}/usr/bin/hushd" "${pkgdir}/opt/$_pkgname/hushd"
    
      32  install -Dm755 "${srcdir}/usr/bin/hush-tx" "${pkgdir}/opt/$_pkgname/hush-tx"
    
      33  install -Dm755 "${srcdir}/usr/bin/dragonx-cli" "${pkgdir}/opt/$_pkgname/dragonx-cli"
    
      34  install -Dm755 "${srcdir}/usr/bin/dragonxd" "${pkgdir}/opt/$_pkgname/dragonxd"
    
      35
    
      36  # install required sapling files and asmap.dat
    
      37  install -Dm644 "${srcdir}/usr/share/hush/sapling-output.params" "${pkgdir}/opt/$_pkgname/sapling-output.params"
    
      38  install -Dm644 "${srcdir}/usr/share/hush/sapling-spend.params" "${pkgdir}/opt/$_pkgname/sapling-spend.params"
    
      39  install -Dm644 "${srcdir}/usr/share/hush/asmap.dat" "${pkgdir}/opt/$_pkgname/asmap.dat"
    
      40
    
      41  # install man pages
    
      42  install -Dm644 "${srcdir}/usr/share/man/man1/hush-cli.1.gz" "${pkgdir}/usr/share/man/man1/hush-cli.1.gz"
    
      43  install -Dm644 "${srcdir}/usr/share/man/man1/hushd.1.gz" "${pkgdir}/usr/share/man/man1/hushd.1.gz"
    
      44  install -Dm644 "${srcdir}/usr/share/man/man1/hush-tx.1.gz" "${pkgdir}/usr/share/man/man1/hush-tx.1.gz"
    
      45
    
      46  # create symlinks
    
      47  install -d "${pkgdir}/usr/bin"
    
      48  ln -s /opt/${_pkgname}/hush-cli "${pkgdir}/usr/bin"
    
      49  ln -s /opt/${_pkgname}/hushd "${pkgdir}/usr/bin"
    
      50  ln -s /opt/${_pkgname}/hush-arrakis-chain "${pkgdir}/usr/bin"
    
      51  ln -s /opt/${_pkgname}/hush-tx "${pkgdir}/usr/bin"
    
      52  ln -s /opt/${_pkgname}/dragonx-cli "${pkgdir}/usr/bin"
    
      53  ln -s /opt/${_pkgname}/dragonxd "${pkgdir}/usr/bin"
    
      54
    
      55  install -d "${pkgdir}/usr/share/hush"
    
      56  ln -s /opt/${_pkgname}/sapling-output.params "${pkgdir}/usr/share/hush"
    
      57  ln -s /opt/${_pkgname}/sapling-spend.params "${pkgdir}/usr/share/hush"
    
      58  ln -s /opt/${_pkgname}/asmap.dat "${pkgdir}/usr/share/hush"
    
      59
    
      60  # install systemd service
    
      61  install -Dm644 -t "${pkgdir}"/usr/lib/systemd/user "${srcdir}"/hushd.service
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2