hyprlayer-desktop-bin

maintainer bitshifxr · 0 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release, which is a supply-chain risk if the source is private and the binary is not reproducible, though it relies on standard Arch dependencies and does not execute untrusted remote code at runtime.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release, which is a supply-chain risk if the source is private and the binary is not reproducible, though it relies on standard Arch dependencies and does not execute untrusted remote code at runtime.

PKGBUILD

      1# Maintainer: Jon Tsiros <jon@brightblock.ai>
    
      2#
    
      3# Template. scripts/release-linux-remote.sh substitutes 0.5.10 / f5f9c87ae45307d055273e136272d859bff8eb16e801ef3245ea31a29c1996bd and
    
      4# runs `makepkg --printsrcinfo`; scripts/release-local.sh pushes the pair to
    
      5# ssh://aur@aur.archlinux.org/hyprlayer-desktop-bin.git.
    
      6#
    
      7# A binary package because the source repo is private. The .deb is itself built
    
      8# on Arch against Arch's webkit2gtk-4.1, so unpacking it here is only transport
    
      9# — no Debian runtime is involved.
    
      10
    
      11pkgname=hyprlayer-desktop-bin
    
      12pkgver=0.5.10
    
      13pkgrel=1
    
      14pkgdesc="Native desktop app for spec-driven development with coding agents"
    
      15arch=('x86_64')
    
      16url="https://brightblock.ai/hyprlayer"
    
      17license=('LicenseRef-proprietary')
    
      18# webkit2gtk-4.1 pulls glib2/cairo/pango/gdk-pixbuf2/libsoup3 transitively; gtk3
    
      19# is listed because the binary links it directly. git is spawned for every
    
      20# network/branch operation, and xdg-utils backs tauri-plugin-opener.
    
      21depends=('webkit2gtk-4.1' 'gtk3' 'git' 'xdg-utils' 'hicolor-icon-theme')
    
      22optdepends=('claude-code: run Claude Code agent sessions in-app'
    
      23            'nodejs: runtime for agent CLIs installed through npm')
    
      24provides=('hyprlayer-desktop')
    
      25conflicts=('hyprlayer-desktop')
    
      26# Vendor binary: cargo's [profile.release] already stripped it, and re-stripping
    
      27# someone else's ELF only risks breaking it.
    
      28options=('!strip' '!debug' '!emptydirs')
    
      29_deb="Hyprlayer_${pkgver}_amd64.deb"
    
      30source=("${_deb}::https://github.com/BrightBlock/hyprlayer-releases/releases/download/v${pkgver}/${_deb}")
    
      31sha256sums=('f5f9c87ae45307d055273e136272d859bff8eb16e801ef3245ea31a29c1996bd')
    
      32noextract=("${_deb}")
    
      33
    
      34package() {
    
      35  # A .deb is an ar archive holding data.tar.<compression>; unpack the outer
    
      36  # layer to a scratch dir so the inner tarball's name doesn't have to be
    
      37  # guessed at the glob level.
    
      38  local _unpack="${srcdir}/deb"
    
      39  rm -rf "${_unpack}"
    
      40  install -d "${_unpack}"
    
      41  bsdtar -xf "${srcdir}/${_deb}" -C "${_unpack}"
    
      42  bsdtar -xpf "${_unpack}"/data.tar* -C "${pkgdir}"
    
      43}
    
      44

Changes since previous scan

--- PKGBUILD @ 2026-08-16 00:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,6 +1,6 @@
 # Maintainer: Jon Tsiros <jon@brightblock.ai>
 #
-# Template. scripts/release-linux-remote.sh substitutes 0.5.8 / 7124ccc3c97dd4bc7bc13dcb489222f20a2881bc3d64dfc6e1142683d1188c5c and
+# Template. scripts/release-linux-remote.sh substitutes 0.5.10 / f5f9c87ae45307d055273e136272d859bff8eb16e801ef3245ea31a29c1996bd and
 # runs `makepkg --printsrcinfo`; scripts/release-local.sh pushes the pair to
 # ssh://aur@aur.archlinux.org/hyprlayer-desktop-bin.git.
 #
@@ -9,7 +9,7 @@
 # — no Debian runtime is involved.
 
 pkgname=hyprlayer-desktop-bin
-pkgver=0.5.8
+pkgver=0.5.10
 pkgrel=1
 pkgdesc="Native desktop app for spec-driven development with coding agents"
 arch=('x86_64')
@@ -28,7 +28,7 @@
 options=('!strip' '!debug' '!emptydirs')
 _deb="Hyprlayer_${pkgver}_amd64.deb"
 source=("${_deb}::https://github.com/BrightBlock/hyprlayer-releases/releases/download/v${pkgver}/${_deb}")
-sha256sums=('7124ccc3c97dd4bc7bc13dcb489222f20a2881bc3d64dfc6e1142683d1188c5c')
+sha256sums=('f5f9c87ae45307d055273e136272d859bff8eb16e801ef3245ea31a29c1996bd')
 noextract=("${_deb}")
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 21:33:47	MEDIUM	2
2026-08-16 19:33:38	MEDIUM	2
2026-08-16 00:03:42	LOW	2
2026-08-15 23:31:34	LOW	2