elasticsearch

maintainer ipaqmaster · 10 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged pattern involves creating systemd services and sysusers/tmpfiles configurations, which is standard for a system service package and does not involve privileged installs or self-updates; it is a normal part of packaging a daemon for Arch Linux.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves creating systemd services and sysusers/tmpfiles configurations, which is standard for a system service package and does not involve privileged installs or self-updates; it is a normal part of packaging a daemon for Arch Linux.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:65 chmod 2750 "$pkgdir"/etc/elasticsearch

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  HLFH <gaspard@dhautefeuille.eu>
    
      2
    
      3pkgname=elasticsearch
    
      4pkgver=9.4.4
    
      5pkgrel=1
    
      6pkgdesc="Free and Open, Distributed, RESTful Search Engine"
    
      7arch=('aarch64' 'x86_64')
    
      8url="https://www.elastic.co/elasticsearch/"
    
      9license=('custom:Elastic-2.0')
    
      10depends=('jdk21-openjdk' 'libxml2')
    
      11makedepends=()
    
      12provides=("elasticsearch=$pkgver")
    
      13conflicts=('elasticsearch7' 'elasticsearch-bin')
    
      14source=(
    
      15  $pkgname-$pkgver.tar.gz::"https://github.com/elastic/elasticsearch/archive/v${pkgver}.tar.gz"
    
      16  elasticsearch.service
    
      17  elasticsearch@.service
    
      18  elasticsearch-keystore.service
    
      19  elasticsearch-keystore@.service
    
      20  elasticsearch-sysctl.conf
    
      21  elasticsearch-user.conf
    
      22  elasticsearch-tmpfile.conf
    
      23  elasticsearch.default
    
      24)
    
      25b2sums=('15461c533831355ec1645c1945758b93b7eada3a0edc928c025d8d3aeb3493a7414328bb7ab8271f013b12cf88bddc556a50961f0e2ac468b2288fc29fdee4e6'
    
      26        '76e4098c4f2c0656e70590997ada2e489c53b61386fb92524ac34e09b7fd43b511e2305047754bba29883d388fec4855dd8fc429e0e3aa93068ab671b6bd1a79'
    
      27        '9b74e7ae392132056ab5e8a9e2637d71564fe736d10c16e07395878c4ef0a5498147d8a5b7a28dac6ef3722bc525bb8a57b01f9e185613c46c4f34f3a69990c8'
    
      28        '48a332da75e1d8c7624a5948c4b145ad6ec6aca7ed2da31802920fa99490cc99a354e06d635b8937217404bcb99302f8d95b7af99d6af8e3227e39cdb80fa3cd'
    
      29        '91ca815aa29f619e74b8d735af234705aed7254e4ecdde5248ab2a971a6b13e4c3897ed54933b2d68d3f16c266cd20d6ce14377f988199c367c39b892ddf5bca'
    
      30        '5690e288a5d288931094db9e1532737b641d9852c2dc5cf45c2853e20c6ab013b1cf056f2cd325ad0703c2075dac7bd16c99c7f1ba202f5d94aac336508f7417'
    
      31        '21cc254940924675bd24e07f6af1f58c89530abfb075637279798bdbba80772c6a4659361e9e8e58a5b2a5ffb21e55e40c91a270ff10da5ab467f63ce34e9f76'
    
      32        'b54cc37b1e5b4f054fc14d3112bee2cbad1ba48f7f15364366473753767fa74f38874da35083f9f7d840286052d3da970cdcf509569aa8b5fff39e4941959678'
    
      33        'f346ba285e045e3982da1841adc8625ebf1a662882d20a7c69bd76911782e1bdf30883b16dffe32cd2355349738b9b6c275b9ff6b11dfdd7fd56b509bcd19c31')
    
      34
    
      35backup=('etc/elasticsearch/elasticsearch.yml'
    
      36        'etc/elasticsearch/log4j2.properties'
    
      37        'etc/elasticsearch/jvm.options'
    
      38        'etc/default/elasticsearch')
    
      39
    
      40build() {
    
      41  cd $pkgname-$pkgver
    
      42  echo "Building using java-21-openjdk..."
    
      43  # For now as jdk-openjdk upgraded to JDK21 experiencing warnings treated as errors.
    
      44  export JAVA_HOME=/usr/lib/jvm/java-21-openjdk
    
      45  ./gradlew --no-daemon :modules:systemd:assemble
    
      46  ./gradlew --no-daemon :distribution:archives:linux-tar:assemble
    
      47}
    
      48
    
      49package() {
    
      50  cd $pkgname-$pkgver
    
      51
    
      52
    
      53  mkdir -p distribution/archives/linux-tar/build/install/
    
      54  tar -xf "distribution/archives/linux-tar/build/distributions/${pkgname}-${pkgver}-SNAPSHOT-linux-x86_64.tar.gz" -C "distribution/archives/linux-tar/build/install/"
    
      55
    
      56  install -dm755 "$pkgdir"/{usr/share,var/lib,var/log}/elasticsearch
    
      57  install -dm755 "$pkgdir"/usr/bin
    
      58  
    
      59  cp -R "${srcdir}/${pkgname}-${pkgver}/distribution/archives/linux-tar/build/install/${pkgname}-${pkgver}-SNAPSHOT/." "${pkgdir}/usr/share/elasticsearch"
    
      60  rm -r "$pkgdir"/usr/share/elasticsearch/{jdk,logs}
    
      61
    
      62  install -dm755 "$pkgdir"/etc
    
      63  echo 'path.data: /var/lib/elasticsearch' >> "$pkgdir"/usr/share/elasticsearch/config/elasticsearch.yml
    
      64  mv "$pkgdir"/usr/share/elasticsearch/config "$pkgdir"/etc/elasticsearch
    
      65  chmod 2750 "$pkgdir"/etc/elasticsearch
    
      66
    
      67  for bin in "$pkgdir"/usr/share/elasticsearch/bin/*; do
    
      68    ln -sT /usr/share/elasticsearch/bin/$(basename $bin) "$pkgdir"/usr/bin/$(basename $bin)
    
      69  done
    
      70
    
      71  ln -s /etc/elasticsearch "$pkgdir"/usr/share/elasticsearch/config
    
      72  ln -s /var/log/elasticsearch "$pkgdir"/usr/share/elasticsearch/logs
    
      73
    
      74  ## Dynamically determine what version jdk-openjdk provides and symlink it.
    
      75  # Good automation attempt but cannot be used. Elasticsearch falls behind java updates too often for a rolling release platform.
    
      76  #jdk_openjdk_version=$(pacman -Ql java-runtime | grep -Pom1 '/usr/lib/jvm/java-[0-9]+-openjdk/')
    
      77  #[ -z "${jdk_openjdk_version}" ] && echo "Unable to determine jdk-openjdk version automatically" && exit 1
    
      78  #ln -s "${jdk_openjdk_version}" "$pkgdir"/usr/share/elasticsearch/jdk
    
      79  ln -s "/usr/lib/jvm/java-21-openjdk" "$pkgdir"/usr/share/elasticsearch/jdk
    
      80
    
      81  install -Dm644 "$srcdir"/elasticsearch.service "$pkgdir"/usr/lib/systemd/system/elasticsearch.service
    
      82  install -Dm644 "$srcdir"/elasticsearch@.service "$pkgdir"/usr/lib/systemd/system/elasticsearch@.service
    
      83  install -Dm644 "$srcdir"/elasticsearch-keystore.service "$pkgdir"/usr/lib/systemd/system/elasticsearch-keystore.service
    
      84  install -Dm644 "$srcdir"/elasticsearch-keystore@.service "$pkgdir"/usr/lib/systemd/system/elasticsearch-keystore@.service
    
      85  install -Dm644 "$srcdir"/elasticsearch-user.conf "$pkgdir"/usr/lib/sysusers.d/elasticsearch.conf
    
      86  install -Dm644 "$srcdir"/elasticsearch-tmpfile.conf "$pkgdir"/usr/lib/tmpfiles.d/elasticsearch.conf
    
      87  install -Dm644 "$srcdir"/elasticsearch-sysctl.conf "$pkgdir"/usr/lib/sysctl.d/60-elasticsearch.conf
    
      88  install -Dm644 "$srcdir"/elasticsearch.default "$pkgdir"/etc/default/elasticsearch
    
      89
    
      90  sed -i '2iJAVA_HOME=/usr/lib/jvm/default-runtime' "$pkgdir"/usr/share/elasticsearch/bin/elasticsearch-env
    
      91  sed -i 's/ES_BUNDLED_JDK=true/ES_BUNDLED_JDK=false/g' "$pkgdir"/usr/share/elasticsearch/bin/elasticsearch-env
    
      92
    
      93  install -Dm644 LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      94}
    
      95

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer:  HLFH <gaspard@dhautefeuille.eu>
 
 pkgname=elasticsearch
-pkgver=9.4.3
+pkgver=9.4.4
 pkgrel=1
 pkgdesc="Free and Open, Distributed, RESTful Search Engine"
 arch=('aarch64' 'x86_64')
@@ -22,7 +22,7 @@
   elasticsearch-tmpfile.conf
   elasticsearch.default
 )
-b2sums=('27fb0a0e890a4d0d6634573558e8504f2f71fa85f9922146ce10e30d6eba7c6a1a9cdddd8474080c65045e20013f686728782dc96f082464b03bf55716a5d2bc'
+b2sums=('15461c533831355ec1645c1945758b93b7eada3a0edc928c025d8d3aeb3493a7414328bb7ab8271f013b12cf88bddc556a50961f0e2ac468b2288fc29fdee4e6'
         '76e4098c4f2c0656e70590997ada2e489c53b61386fb92524ac34e09b7fd43b511e2305047754bba29883d388fec4855dd8fc429e0e3aa93068ab671b6bd1a79'
         '9b74e7ae392132056ab5e8a9e2637d71564fe736d10c16e07395878c4ef0a5498147d8a5b7a28dac6ef3722bc525bb8a57b01f9e185613c46c4f34f3a69990c8'
         '48a332da75e1d8c7624a5948c4b145ad6ec6aca7ed2da31802920fa99490cc99a354e06d635b8937217404bcb99302f8d95b7af99d6af8e3227e39cdb80fa3cd'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 19:17:41	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2