clickhouse-common-static-bin
maintainer thebits
· 9 votes
· base
clickhouse-bin
· scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged
The package downloads prebuilt ClickHouse binaries from the official vendor domain packages.clickhouse.com, which is plausibly the project's own release infrastructure; despite the static analyzer flag for a non-whitelisted host, this constitutes a standard and trusted source for official builds, not a supply-chain risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt ClickHouse binaries from the official vendor domain packages.clickhouse.com, which is plausibly the project's own release infrastructure; despite the static analyzer flag for a non-whitelisted host, this constitutes a standard and trusted source for official builds, not a supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
"https://packages.clickhouse.com/tgz/$_channel/clickhouse-client-$pkgver-amd64.tgz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Sergey Mezentsev <thebits@yandex.ru>
2
pkgbase='clickhouse-bin'
3
pkgname=('clickhouse-server-bin' 'clickhouse-common-static-bin' 'clickhouse-client-bin')
4
# 'stable' - for production environment
5
# 'testing' - most recent version
6
# 'prestable' and 'lts' are available
7
_channel='stable'
8
pkgver=26.7.3.19
9
pkgrel=1
10
provides=('clickhouse')
11
pkgdesc="ClickHouse is a fast open-source OLAP database management system"
12
arch=('x86_64' 'aarch64')
13
url="https://clickhouse.com/"
14
license=('Apache-2.0')
15
source_x86_64=(
16
"https://packages.clickhouse.com/tgz/$_channel/clickhouse-client-$pkgver-amd64.tgz"
17
"https://packages.clickhouse.com/tgz/$_channel/clickhouse-common-static-$pkgver-amd64.tgz"
18
"https://packages.clickhouse.com/tgz/$_channel/clickhouse-server-$pkgver-amd64.tgz"
19
"clickhouse.sysusers"
20
"clickhouse-server.service"
21
)
22
source_aarch64=(
23
"https://packages.clickhouse.com/tgz/$_channel/clickhouse-client-$pkgver-arm64.tgz"
24
"https://packages.clickhouse.com/tgz/$_channel/clickhouse-common-static-$pkgver-arm64.tgz"
25
"https://packages.clickhouse.com/tgz/$_channel/clickhouse-server-$pkgver-arm64.tgz"
26
"clickhouse.sysusers"
27
"clickhouse-server.service"
28
)
29
sha512sums_x86_64=('099e7a4e99976ed2e1aeed2dc3bf6082d10e9e52b351486e48bfb398d7cc73388f756d5925b454cda6b6b967f0b4136766d9c6b898d4453d2e54fb734368fe50'
30
'e6a30bb4acb9e2e063d2a99d93bf42f5bac12f92cba8993482d5b2f175eb1cca65ae4bbe02a1a1b5ac7c0a783886871b2c2abb6b26e601f72f0577697d3e9d4c'
31
'e2dc9b3f1f8acb1f394dde2aaa6bc9f8b1cef6081ed0a8fbf84ccae9a2f8f829ec7104751a658ba395de4c09496fbdaac9390f5348a69048cc800849bacb0931'
32
'70af4456ded1a1bb5cf29d2d3b29086aedc7875ef673e8817f389243f0c79eb491c9ce715b94542cbe16eb7489d97411ff0ab4a1a7f6c9b9120c659b87ea25b7'
33
'6b22c7e27961c1453f8ce71457085cb24271ed1962033f78ea2483560bb6ad265a117414c5a9627a1733429d4080adf1fea4490073a7e522a002753d4d87d01c')
34
sha512sums_aarch64=('2f97bff5a39d4517f53a6586c9d90e71a97b93e9983c86d50602fc8d8cd25c312f40b96d9499db1592cc4ddd334ca638c256b51f410cb350aa6ed90a42dff793'
35
'e71192af6e45a7293a98dd0ab9de95eea4c63c21d03260b50ba73b57e124f50551d91f72bb4b2f8268a176e6252c9af28f489244492ebab21f0376529ae87f2f'
36
'ff817ebfeef18de68b9f5d118d9190df4be4199ecf1f8bc7c824a38fa6ea47bb8faf7c9e2ded0a5892e09d527a3a4736e3f737aa25961b869a7ec6e9ba142731'
37
'70af4456ded1a1bb5cf29d2d3b29086aedc7875ef673e8817f389243f0c79eb491c9ce715b94542cbe16eb7489d97411ff0ab4a1a7f6c9b9120c659b87ea25b7'
38
'6b22c7e27961c1453f8ce71457085cb24271ed1962033f78ea2483560bb6ad265a117414c5a9627a1733429d4080adf1fea4490073a7e522a002753d4d87d01c')
39
40
41
package_clickhouse-client-bin() {
42
depends=('clickhouse-common-static-bin')
43
backup=('etc/clickhouse-client/config.xml')
44
pkgdesc="ClickHouse client and other client-related tools."
45
46
cd "clickhouse-client-$pkgver"
47
cp -a etc usr $pkgdir
48
}
49
50
package_clickhouse-common-static-bin() {
51
# options and directives overrides
52
pkgdesc="ClickHouse compiled binary files."
53
54
cd "clickhouse-common-static-$pkgver"
55
cp -a usr $pkgdir
56
}
57
58
package_clickhouse-server-bin() {
59
# options and directives overrides
60
pkgdesc="ClickHouse server and default configuration."
61
depends=('clickhouse-common-static-bin')
62
backup=(
63
'etc/clickhouse-server/config.xml'
64
'etc/clickhouse-server/users.xml'
65
)
66
67
cd "clickhouse-server-$pkgver"
68
cp -a usr "$pkgdir/"
69
cp -a lib "$pkgdir/usr"
70
mkdir -p "$pkgdir/etc/clickhouse-server"
71
cp -a etc/clickhouse-server "$pkgdir/etc"
72
install -D "$srcdir/clickhouse.sysusers" "${pkgdir}/usr/lib/sysusers.d/clickhouse.conf"
73
install -D "$srcdir/clickhouse-server.service" "${pkgdir}/usr/lib/systemd/system/clickhouse-server.service"
74
}
75
Changes since previous scan
--- PKGBUILD @ 2026-07-27 00:24+++ PKGBUILD @ 2026-08-18 00:03@@ -5,7 +5,7 @@ # 'testing' - most recent version # 'prestable' and 'lts' are available _channel='stable'-pkgver=26.7.1.1315+pkgver=26.7.3.19 pkgrel=1 provides=('clickhouse') pkgdesc="ClickHouse is a fast open-source OLAP database management system"@@ -26,14 +26,14 @@ "clickhouse.sysusers" "clickhouse-server.service" )-sha512sums_x86_64=('887409cfe4945341f17e8e8bb3c03f30c68c677962817c7374d02597c14448a8ac42eb7afb2f450423c223113863c31b12fc6a3511cd804125661ca7c44f9c32'- 'ac83fa52363241d10f978633d742401381d477c6996dad055a8d6c7604a7e128ef0a71fe2af2eec9904489211fa69055944c2cbc5587636ac3f2d16bb68e9160'- '6bb913ff471e60657e4a6a7b95ac6b4c79de43e55c99148cb3c13909011234e78c53bdb04b52822965b0a2470021428ca4e80887875f58c3e384a6ec8d2fdf79'+sha512sums_x86_64=('099e7a4e99976ed2e1aeed2dc3bf6082d10e9e52b351486e48bfb398d7cc73388f756d5925b454cda6b6b967f0b4136766d9c6b898d4453d2e54fb734368fe50'+ 'e6a30bb4acb9e2e063d2a99d93bf42f5bac12f92cba8993482d5b2f175eb1cca65ae4bbe02a1a1b5ac7c0a783886871b2c2abb6b26e601f72f0577697d3e9d4c'+ 'e2dc9b3f1f8acb1f394dde2aaa6bc9f8b1cef6081ed0a8fbf84ccae9a2f8f829ec7104751a658ba395de4c09496fbdaac9390f5348a69048cc800849bacb0931' '70af4456ded1a1bb5cf29d2d3b29086aedc7875ef673e8817f389243f0c79eb491c9ce715b94542cbe16eb7489d97411ff0ab4a1a7f6c9b9120c659b87ea25b7' '6b22c7e27961c1453f8ce71457085cb24271ed1962033f78ea2483560bb6ad265a117414c5a9627a1733429d4080adf1fea4490073a7e522a002753d4d87d01c')-sha512sums_aarch64=('0070f97786b5b68544bf418bd4aa83cb5f5a8cbdba6a16f084a48a130df1f48ff68d4ae4af1cf4bb24f3d84e581f75abf7b5d569f8b9f74338cf3692dd395d48'- 'cec927ed8fbf7897af25ab82d10ef297c0afc508eb57b62b665e93317061fbacf9d506874b1beec53ebdd40185e6bd92452337f09a05fac9dd9bd1b0a2ba861b'- 'd65b1a2d13bdbedaad1ecf4c2fab6c193815ad514a8cbca66374a5e668332ae8ea44702d4192324eb4f517531038416f2a5366ebaa3fb97db1d3285def5ac519'+sha512sums_aarch64=('2f97bff5a39d4517f53a6586c9d90e71a97b93e9983c86d50602fc8d8cd25c312f40b96d9499db1592cc4ddd334ca638c256b51f410cb350aa6ed90a42dff793'+ 'e71192af6e45a7293a98dd0ab9de95eea4c63c21d03260b50ba73b57e124f50551d91f72bb4b2f8268a176e6252c9af28f489244492ebab21f0376529ae87f2f'+ 'ff817ebfeef18de68b9f5d118d9190df4be4199ecf1f8bc7c824a38fa6ea47bb8faf7c9e2ded0a5892e09d527a3a4736e3f737aa25961b869a7ec6e9ba142731' '70af4456ded1a1bb5cf29d2d3b29086aedc7875ef673e8817f389243f0c79eb491c9ce715b94542cbe16eb7489d97411ff0ab4a1a7f6c9b9120c659b87ea25b7' '6b22c7e27961c1453f8ce71457085cb24271ed1962033f78ea2483560bb6ad265a117414c5a9627a1733429d4080adf1fea4490073a7e522a002753d4d87d01c') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | LOW | 2 |
| 2026-08-17 00:18:29 | LOW | 2 |
| 2026-08-16 17:33:23 | MEDIUM | 1 |
| 2026-07-27 00:24:32 | CLEAN | 2 |
| 2026-07-26 13:32:26 | MEDIUM | 1 |
| 2026-07-12 00:27:26 | CLEAN | 2 |
| 2026-07-11 07:36:33 | MEDIUM | 1 |
| 2026-06-19 19:07:35 | CLEAN | 2 |
| 2026-06-18 18:04:49 | CLEAN | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |