cockroachdb-bin

maintainer xiota · 9 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from the official project host 'binaries.cockroachdb.com', which is not on the whitelist but is the legitimate release infrastructure for CockroachDB; the source is verifiable via checksum and the package does not execute untrusted remote code or exfiltrate data.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the official project host 'binaries.cockroachdb.com', which is not on the whitelist but is the legitimate release infrastructure for CockroachDB; the source is verifiable via checksum and the package does not execute untrusted remote code or exfiltrate data.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 "$_pkgname-$pkgver.tar.gz"::"https://binaries.cockroachdb.com/$_pkgsrc.tgz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: aur.chaotic.cx
    
      2# Contributor: Riccardo Berto <riccardo at rcrdbrt dot-symbol com>
    
      3# Contributor: Moses Narrow <moe-narrow@use.startmail.com>
    
      4# Contributor: Dimitris Kiziridis <ragouel at outlook dot com>
    
      5# Contributor: Konrad Tegtmeier <konrad.tegtmeier+aur@gmail.com>
    
      6# Contributor: Marcel O'Neil <marcel@marceloneil.com>
    
      7
    
      8## links
    
      9# https://www.cockroachlabs.com/docs/stable/install-cockroachdb-linux.html
    
      10# https://github.com/cockroachdb/cockroach
    
      11# https://www.cockroachlabs.com/docs/releases/
    
      12
    
      13: ${_install_path:=usr/lib}
    
      14
    
      15_pkgname=cockroachdb
    
      16pkgname="$_pkgname-bin"
    
      17pkgver=26.2.5
    
      18pkgrel=1
    
      19pkgdesc="Cloud-native, distributed SQL database"
    
      20url='https://www.cockroachlabs.com'
    
      21license=('LicenseRef-CockroachDB')
    
      22arch=('x86_64')
    
      23
    
      24depends=(
    
      25  'glibc'
    
      26  'sh'
    
      27)
    
      28makedepends=('patchelf')
    
      29
    
      30provides=("$_pkgname")
    
      31conflicts=("$_pkgname")
    
      32
    
      33options=('!debug')
    
      34
    
      35backup=("etc/default/cockroach")
    
      36
    
      37_pkgsrc="cockroach-v$pkgver.linux-amd64"
    
      38_pkgsrc_source="cockroach-$pkgver"
    
      39source=(
    
      40  "$_pkgname-$pkgver.tar.gz"::"https://binaries.cockroachdb.com/$_pkgsrc.tgz"
    
      41  "$_pkgname-$pkgver-LICENSE.txt"::"https://github.com/cockroachdb/cockroach/raw/v$pkgver/LICENSE"
    
      42)
    
      43sha256sums=('067bd264ff1d39483049f5c75b26f704a10038d8d11fca53b5b8a48894c92d5d'
    
      44            'cb4f34a516b09ec1815bd8376a34de7ea5e6da06c70bed756110943ad1b340e4')
    
      45
    
      46build() {
    
      47  # generate shell completion
    
      48  "$_pkgsrc/cockroach" gen autocomplete bash --out "cockroach.bash"
    
      49  "$_pkgsrc/cockroach" gen autocomplete zsh --out "cockroach.zsh"
    
      50
    
      51  # generate man pages
    
      52  "$_pkgsrc/cockroach" gen man --path "man"
    
      53}
    
      54
    
      55package() {
    
      56  # binary
    
      57  install -Dm755 "$_pkgsrc/cockroach" "$pkgdir/$_install_path/$_pkgname/cockroach"
    
      58
    
      59  # GEOS libraries
    
      60  install -Dm644 "$_pkgsrc/lib/libgeos.so" "$pkgdir/$_install_path/$_pkgname/lib/libgeos.so"
    
      61  install -Dm644 "$_pkgsrc/lib/libgeos_c.so" "$pkgdir/$_install_path/$_pkgname/lib/libgeos_c.so"
    
      62  patchelf --set-rpath "/$_install_path/$_pkgname" "$pkgdir/$_install_path/$_pkgname/lib/libgeos_c.so"
    
      63
    
      64  # script
    
      65  install -Dm755 /dev/stdin "$pkgdir/usr/bin/cockroach" << END
    
      66#!/usr/bin/env sh
    
      67exec /$_install_path/$_pkgname/cockroach "\$@"
    
      68END
    
      69
    
      70  # user/group & owned directories
    
      71  install -Dm644 /dev/stdin "$pkgdir/usr/lib/sysusers.d/cockroach.conf" << END
    
      72u cockroach - "CockroachDB" /var/lib/cockroach
    
      73END
    
      74
    
      75  install -Dm644 /dev/stdin "$pkgdir/usr/lib/tmpfiles.d/cockroach.conf" << END
    
      76d /etc/cockroach 0755 root cockroach - -
    
      77d /var/lib/cockroach 0750 cockroach cockroach - -
    
      78END
    
      79
    
      80  # services & runtime
    
      81  install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/system/cockroach.service" << END
    
      82[Unit]
    
      83Description=CockroachDB database server
    
      84Requires=network-online.target
    
      85After=network-online.target
    
      86
    
      87[Service]
    
      88User=cockroach
    
      89Group=cockroach
    
      90
    
      91EnvironmentFile=-/etc/default/cockroach
    
      92ExecStart=/usr/bin/cockroach start --certs-dir /etc/cockroach --store=${COCKROACH_STORE} $COCKROACH_FLAGS
    
      93LimitNOFILE=35000
    
      94
    
      95ProtectHome=true
    
      96ProtectSystem=full
    
      97NoNewPrivileges=true
    
      98
    
      99[Install]
    
      100WantedBy=multi-user.target
    
      101END
    
      102
    
      103  install -Dm644 /dev/stdin "$pkgdir/etc/default/cockroach" << END
    
      104COCKROACH_FLAGS="--insecure"
    
      105COCKROACH_STORE="path=/var/lib/cockroach"
    
      106END
    
      107
    
      108  # man pages
    
      109  install -Dm644 "man"/*.1 -t "$pkgdir/usr/share/man/man1/"
    
      110
    
      111  # shell completion
    
      112  install -Dm644 cockroach.bash "$pkgdir/usr/share/bash-completion/completions/cockroach"
    
      113  install -Dm644 cockroach.zsh "$pkgdir/usr/share/zsh/site-functions/_cockroach"
    
      114
    
      115  # licenses
    
      116  install -Dm644 "$_pkgname-$pkgver-LICENSE.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      117}
    
      118

Changes since previous scan

--- PKGBUILD @ 2026-07-23 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -14,7 +14,7 @@
 
 _pkgname=cockroachdb
 pkgname="$_pkgname-bin"
-pkgver="26.2.4"
+pkgver=26.2.5
 pkgrel=1
 pkgdesc="Cloud-native, distributed SQL database"
 url='https://www.cockroachlabs.com'
@@ -40,7 +40,7 @@
   "$_pkgname-$pkgver.tar.gz"::"https://binaries.cockroachdb.com/$_pkgsrc.tgz"
   "$_pkgname-$pkgver-LICENSE.txt"::"https://github.com/cockroachdb/cockroach/raw/v$pkgver/LICENSE"
 )
-sha256sums=('3c7de055c07f9101eb0f71b3f5e6b489b0fcf449d3d5a55bfe61eff4f935ce8f'
+sha256sums=('067bd264ff1d39483049f5c75b26f704a10038d8d11fca53b5b8a48894c92d5d'
             'cb4f34a516b09ec1815bd8376a34de7ea5e6da06c70bed756110943ad1b340e4')
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 21:16:48	MEDIUM	1
2026-07-23 00:14:47	CLEAN	2
2026-07-22 21:22:00	MEDIUM	1
2026-06-20 00:50:07	CLEAN	2
2026-06-20 00:18:46	MEDIUM	1
2026-06-19 23:51:18	MEDIUM	2
2026-06-19 19:07:35	LOW	2
2026-06-18 18:04:49	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1