hydra-download-manager-bin

MEDIUM

maintainer ja7ad 0 votes scanned 2026-08-23 21:21:38.325556

View on AUR

Why flagged

The package installs precompiled binaries from a non-whitelisted, personal GitHub account release with SKIP'd checksums, creating an unverifiable supply-chain risk if the source were compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs precompiled binaries from a non-whitelisted, personal GitHub account release with SKIP'd checksums, creating an unverifiable supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: Javad Rajabzadeh <ja7ad@live.com>
    
      2
    
      3pkgname=hydra-download-manager-bin
    
      4_pkgname=hydra
    
      5pkgver=0.3.11
    
      6pkgrel=1
    
      7pkgdesc="Multi-connection download accelerator and manager (GUI, CLI, browser integration) (precompiled binary)"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/ja7ad/hydra"
    
      10license=('GPL-3.0-or-later')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'gcc-libs'
    
      14  'glibc'
    
      15  'hicolor-icon-theme'
    
      16  'libx11'
    
      17  'libxrandr'
    
      18  'libxcb'
    
      19  'libxkbcommon'
    
      20)
    
      21optdepends=(
    
      22  'gnome-shell-extension-appindicator: StatusNotifierItem system tray icon in GNOME Shell'
    
      23  'xdg-utils: Open completed files and download directories'
    
      24)
    
      25provides=('hydra' 'hydra-download-manager')
    
      26conflicts=('hydra' 'hydra-download-manager' 'hydra-git')
    
      27source_x86_64=("$url/releases/download/v$pkgver/hydra-$pkgver-linux-amd64.tar.gz")
    
      28source_aarch64=("$url/releases/download/v$pkgver/hydra-$pkgver-linux-arm64.tar.gz")
    
      29b2sums_x86_64=('SKIP')
    
      30b2sums_aarch64=('SKIP')
    
      31
    
      32package() {
    
      33  local _arch
    
      34  case "$CARCH" in
    
      35    x86_64) _arch="amd64" ;;
    
      36    aarch64) _arch="arm64" ;;
    
      37  esac
    
      38  cd "$srcdir/hydra-$pkgver-linux-$_arch"
    
      39
    
      40  # 1. Executables (CLI, GUI, Host, Updater)
    
      41  install -Dm755 hydra "$pkgdir/usr/bin/hydra"
    
      42  install -Dm755 hydra-gui "$pkgdir/usr/bin/hydra-gui"
    
      43  install -Dm755 hydra-host "$pkgdir/usr/bin/hydra-host"
    
      44  if [ -f hydra-updater ]; then
    
      45    install -Dm755 hydra-updater "$pkgdir/usr/bin/hydra-updater"
    
      46  fi
    
      47
    
      48  # 2. Desktop Launcher & Autostart
    
      49  install -d "$pkgdir/usr/share/applications"
    
      50  cat > "$pkgdir/usr/share/applications/hydra.desktop" <<'EOF'
    
      51[Desktop Entry]
    
      52Type=Application
    
      53Name=Hydra Download Manager
    
      54GenericName=Download Manager
    
      55Comment=Multi-connection download accelerator
    
      56Exec=hydra-gui
    
      57Icon=hydra
    
      58Terminal=false
    
      59Categories=Network;FileTransfer;
    
      60StartupWMClass=hydra
    
      61EOF
    
      62
    
      63  install -d "$pkgdir/etc/xdg/autostart"
    
      64  cat > "$pkgdir/etc/xdg/autostart/hydra.desktop" <<'EOF'
    
      65[Desktop Entry]
    
      66Type=Application
    
      67Name=Hydra Download Manager
    
      68Comment=Multi-connection download accelerator
    
      69Exec=hydra-gui --minimized
    
      70Icon=hydra
    
      71Terminal=false
    
      72Categories=Network;FileTransfer;
    
      73X-GNOME-Autostart-enabled=true
    
      74EOF
    
      75
    
      76  # 3. Application Icon
    
      77  if [ -f logo.png ]; then
    
      78    install -Dm644 logo.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/hydra.png"
    
      79  fi
    
      80
    
      81  # 4. Native Messaging Host Manifests
    
      82  for d in etc/opt/chrome etc/chromium etc/opt/edge; do
    
      83    install -d "$pkgdir/$d/native-messaging-hosts"
    
      84    cat > "$pkgdir/$d/native-messaging-hosts/com.hydra.host.json" <<'EOF'
    
      85{
    
      86  "name": "com.hydra.host",
    
      87  "description": "Hydra Download Manager native host",
    
      88  "path": "/usr/bin/hydra-host",
    
      89  "type": "stdio",
    
      90  "allowed_origins": ["chrome-extension://jpnonmbbkjdpeebdhkjoliklfhkdcomj/"]
    
      91}
    
      92EOF
    
      93  done
    
      94
    
      95  install -d "$pkgdir/usr/lib/mozilla/native-messaging-hosts"
    
      96  cat > "$pkgdir/usr/lib/mozilla/native-messaging-hosts/com.hydra.host.json" <<'EOF'
    
      97{
    
      98  "name": "com.hydra.host",
    
      99  "description": "Hydra Download Manager native host",
    
      100  "path": "/usr/bin/hydra-host",
    
      101  "type": "stdio",
    
      102  "allowed_extensions": ["hydra@ja7ad.github.io"]
    
      103}
    
      104EOF
    
      105
    
      106  # 5. Shell Completions
    
      107  install -d "$pkgdir/usr/share/bash-completion/completions"
    
      108  install -d "$pkgdir/usr/share/zsh/site-functions"
    
      109  install -d "$pkgdir/usr/share/fish/vendor_completions.d"
    
      110  ./hydra completions bash > "$pkgdir/usr/share/bash-completion/completions/hydra"
    
      111  ./hydra completions zsh > "$pkgdir/usr/share/zsh/site-functions/_hydra"
    
      112  ./hydra completions fish > "$pkgdir/usr/share/fish/vendor_completions.d/hydra.fish"
    
      113
    
      114  # 6. Man Pages
    
      115  if [ -d man ]; then
    
      116    for page in man/*.1; do
    
      117      install -Dm644 "$page" "$pkgdir/usr/share/man/man1/$(basename "$page")"
    
      118    done
    
      119  fi
    
      120}
    
      121

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-23 21:21:38	Medium	2