immich-server

LOW
maintainer aliu 28 votes base immich scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package downloads geospatial data and a GeoJSON file from non-whitelisted but legitimate public sources (geonames.org, githubusercontent.com) for reverse-geocoding; these are non-executable data files, not code, and the worst case of tampering is degraded geolocation functionality, not remote code execution or system compromise.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads geospatial data and a GeoJSON file from non-whitelisted but legitimate public sources (geonames.org, githubusercontent.com) for reverse-geocoding; these are non-executable data files, not code, and the worst case of tampering is degraded geolocation functionality, not remote code execution or system compromise.

2 higher static findings superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:103 pnpm install --filter immich --frozen-lockfile --offline
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:74 'https://download.geonames.org/export/dump/cities500.zip'

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: aliu <aaronliu 0 1 3 0 gmail com>
2# Contributor: wabi <aschrafl@jetnet.ch>
3# Contributor: pikl <me@pikl.uk>
4# Contributor: caoticofanegas
5# Contributor: AlD <daniel@lbe.rs>
6# Contributor: Terrence
7# Contributor: CountMurphy (sarif)
8pkgbase=immich
9pkgname=('immich-server' 'immich-cli')
10pkgrel=1
11pkgver=3.3.4
12pkgdesc='Self-hosted photos and videos backup tool'
13url='https://github.com/immich-app/immich'
14license=('AGPL-3.0-only')
15arch=(x86_64 aarch64)
16# ts-node required for CLI
17makedepends=('git' 'pnpm' 'ts-node' 'mise')
18
19# combination of server/CLI deps, see split package functions
20# for individual deps and commentary
21
22# dependencies generated from base-images repository
23# https://github.com/immich-app/base-images/blob/main/server/Dockerfile
24# 1.101.0-2: liborc dep found to be not required
25depends=('redis' 'postgresql>=14' 'nodejs>=22'
26 'vectorchord>=0.3' 'vectorchord<2' # server/src/constants.ts
27 'zlib'
28 'glib2'
29 'expat'
30 'librsvg'
31 'libexif'
32 'libwebp'
33 'libjpeg-turbo'
34 'libgsf'
35 'libpng'
36 'libheif'
37 'lcms2'
38 'mimalloc'
39 'openjpeg2'
40 'openexr>=3.4.0' # sharp refuses to start rn w/ lower version; not sure where this version's from
41 'liblqr'
42 'libtool'
43 'jellyfin-ffmpeg' # maintainer advice 28/10/24
44 # need to ensure this matches sharp depend version
45 # because otherwise a local copy will be built
46 # breaking heif conversion
47 'libvips>=8.18.3'
48 'openslide'
49 'poppler-glib'
50 'imagemagick'
51 'libraw'
52 # added v1.108
53 'libde265'
54 'dav1d'
55 # added v1.118
56 'brotli'
57 'perl-io-compress-brotli'
58 # added v1.120.2
59 'highway'
60)
61source=("${pkgbase}-${pkgver}.tar.gz::https://github.com/immich-app/immich/archive/refs/tags/v${pkgver}.tar.gz"
62 'postgres-path.patch' # replace Debian's location of postgres with Arch's
63 'sh-serverhome.patch' # tell start.sh server home's /usr/lib/immich/app/server
64 'sharp.patch' # patch sharp to use pnpm instead of npm in install script
65 "${pkgbase}-server.service"
66 "${pkgbase}.sysusers"
67 "${pkgbase}.tmpfiles"
68 'immich.conf'
69 'nginx.immich.conf'
70 # TODO at the moment, the latest version at install will be taken
71 # mirroring approach in docker base-image, however should we implement
72 # a simple service to keep these up-to-date since they appear to be
73 # generated daily?
74 'https://download.geonames.org/export/dump/cities500.zip'
75 'https://download.geonames.org/export/dump/admin1CodesASCII.txt'
76 'https://download.geonames.org/export/dump/admin2Codes.txt'
77 'https://raw.githubusercontent.com/nvkelso/natural-earth-vector/v5.1.2/geojson/ne_10m_admin_0_countries.geojson'
78 'https://download.geonames.org/export/dump/countryInfo.txt')
79b2sums=('88e89f42cc7a32aad848b05f9f1a3928399f045786c897ecbc0c3e60b4ecc12c53a32423690381c1d8bc33c1454e8bbcf4e317e3c856ee431085857cd418248b'
80 '6c8decad88b49a2d62c1ffbcc682c26250e459c0205f2e300973a837578841d896a51dfabf9ec8a4bc288e966303cf32dae02cebb9f78fdad807b07b3fd410c6'
81 '2d94fcc21861067920f0df1e6e5ac74b4413515777b204070c5d8fc01026c54e993e4eff65dabeb3629ee24d238a1a52793c061947009ddac5f0ebf64a58312d'
82 '48cf0c345047b50831f1f5a4fc0f5478aedddc50c6d62faf4205a6a093213a402e15567594a10987c9a97fb69f47894835409a9461d0cda9bf579e25e0d0e42b'
83 'e69ee70889da5b4eebafe7ed98cbeda735f5f280152e238e695b4e028edb496293435a2ff1ab021e5d263cc2133bfeadb23afd2d4936e40027a2ce28e09d12ef'
84 'c6071ce12cc719a6bf33d9486f54648edb62c710b216181524fef9a9fec26cf9ced6d65a3433b2af941e75b03fc4b261d5e901a7f736de29b0b98192df59fdd2'
85 '8a66c540b5cea1e303602cf78ca173da226c6693ec455a060c3d8a6e9616c5bfbab590e8e8a3c8e395bce8e026107b03abfa862ff436d22db271c359a977219d'
86 'e7a40359104cfd13c3563a5b988dcd9d2c132179a5e7e3eb5fe333a3667843e3c04e9eea8157b5f76a7dae18ac5736a487a2b97e2f8b30d6bdc7b2298f8b9e02'
87 'bc4251222a7dfe12d43f48def608ccc08b10ca37fc1eefd08ff8e7328195384598bae2af5b3af58ae3114727efdb9ccb9f20a908c5a919973f6001c69bae627a'
88 'SKIP'
89 'SKIP'
90 'SKIP'
91 'db7a138f7414d3c2c3ad9ee0e5d8ed6443b1f065fff14b899192ae9989455acf2bf7f609b6454bc8ac7680fab4299fde3f9ed655549923a9bede13f5b6fe1059'
92 'SKIP'
93)
94
95prepare() {
96 cd "${srcdir}/${pkgbase}-${pkgver}"
97 patch -p1 < "${srcdir}/postgres-path.patch"
98 patch -p1 < "${srcdir}/sh-serverhome.patch"
99 rm packages/cli/LICENSE # deploy would've picked this up, duplicating standard /usr/share/licenses/spdx/AGPL-3.0-only
100
101 # Patches to avoid calling npm in package scripts
102 pnpm fetch --ignore-scripts # First, get node_modules folder to patch into
103 pnpm install --filter immich --frozen-lockfile --offline # sometimes pnpm fetch doesn't give us the node_modules folder
104 sharp_dir="$(mktemp -d "${srcdir}/sharp-patch.XXXXXXXX")"
105 pnpm patch sharp --edit-dir "$sharp_dir" < <(yes '' 2>/dev/null)
106 (
107 cd "$sharp_dir"
108 patch -p1 < "${srcdir}/sharp.patch"
109 )
110 pnpm patch-commit "$sharp_dir" # Second, this runs the scripts
111
112 TIME=$(date --iso-8601=seconds | tr -d "\n") # used to write how updated the geodata is
113}
114
115# instructions adapted from server/Dockerfile
116build() {
117 cd "${srcdir}/${pkgbase}-${pkgver}"
118
119 export IMMICH_BUILD="${pkgver}-arch${pkgrel}@${TIME}" # build ID
120
121 pnpm --filter @immich/sdk --filter @immich/plugin-sdk build
122
123 # build server
124 ## add a flag to pnpm --filter immich build to make swagger plugin work
125 ## see https://docs.nestjs.com/openapi/cli-plugin#swc-builder
126 ## (immich itself is a monorepo but immich-server isn't)
127 (
128 cd server
129 pnpm exec nest build --type-check
130 )
131
132 pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build # SHARP_IGNORE_GLOBAL_LIBVIPS=true
133 pnpm --filter immich --prod --no-optional deploy output/server-pruned
134
135 # build sdk and web
136 export NODE_OPTIONS=--max-old-space-size=4096 # prevent OOM
137 pnpm --filter @immich/sdk --filter immich-web install --frozen-lockfile
138 pnpm --filter @immich/sdk --filter immich-web build
139
140 # build CLI
141 pnpm --filter @immich/sdk --filter @immich/cli install --frozen-lockfile
142 pnpm --filter @immich/sdk --filter @immich/cli build
143 pnpm --filter @immich/cli deploy --prod --no-optional output/cli-pruned
144
145 # build plugins
146 cd packages/plugin-core
147 export MISE_TRUSTED_CONFIG_PATHS="${srcdir}/${pkgbase}-${pkgver}/packages/plugin-core/mise.toml:""${srcdir}/${pkgbase}-${pkgver}/mise.toml" # needed for //: monorepo syntax
148 export MISE_DISABLE_TOOLS=flutter
149 mise install
150 mise //:plugins
151}
152
153package_immich-server() {
154 pkgdesc+=" (server and web client)"
155 replaces=('immich')
156 conflicts=('immich')
157
158 backup=("etc/immich.conf")
159 install=${pkgname}.install
160 changelog='BREAKING CHANGELOG.md'
161 optdepends=(
162 'nginx: Reverse proxy'
163 'immich-machine-learning: Required for features such as smart search, duplicate detection, and facial recognition'
164 )
165
166 (
167 cd "${srcdir}/${pkgbase}-${pkgver}"
168
169 # install server
170 # from: server/Dockerfile COPY commands after build
171 # * start*.sh not required
172 # * setting NODE_ENV=production picked up in systemd service file
173 install -dm755 "${pkgdir}/usr/lib/immich/app/server"
174 cp -rT output/server-pruned "${pkgdir}/usr/lib/immich/app/server"
175
176 # install web
177 install -dm755 "${pkgdir}/usr/lib/immich/build"
178 cp -r web/build "${pkgdir}/usr/lib/immich/build/www"
179
180 # install plugins
181 install -dm755 "${pkgdir}/usr/lib/immich/build/plugins/immich-plugin-core"
182 cp -r packages/plugin-core/dist "${pkgdir}/usr/lib/immich/build/plugins/immich-plugin-core/dist"
183 install -Dm644 packages/plugin-core/manifest.json "${pkgdir}/usr/lib/immich/build/plugins/immich-plugin-core/manifest.json"
184 )
185
186 # install reverse-geocoding data
187 # https://github.com/immich-app/base-images/blob/main/server/Dockerfile
188 install -dm755 "${pkgdir}/usr/lib/immich/build/geodata"
189 install -Dm644 cities500.txt "${pkgdir}/usr/lib/immich/build/geodata/cities500.txt"
190 install -Dm644 countryInfo.txt "${pkgdir}/usr/lib/immich/build/geodata/countryInfo.txt"
191 install -Dm644 admin1CodesASCII.txt "${pkgdir}/usr/lib/immich/build/geodata/admin1CodesASCII.txt"
192 install -Dm644 admin2Codes.txt "${pkgdir}/usr/lib/immich/build/geodata/admin2Codes.txt"
193 install -Dm644 ne_10m_admin_0_countries.geojson "${pkgdir}/usr/lib/immich/build/geodata/ne_10m_admin_0_countries.geojson"
194 echo "${TIME}" > "${pkgdir}/usr/lib/immich/build/geodata/geodata-date.txt"
195
196 # install systemd service files
197 install -Dm644 immich-server.service "${pkgdir}/usr/lib/systemd/system/immich-server.service"
198
199 # install configuration files
200 install -Dm644 immich.sysusers "${pkgdir}/usr/lib/sysusers.d/immich.conf"
201 install -Dm644 immich.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/immich.conf"
202 install -Dm644 immich.conf "${pkgdir}/etc/immich.conf"
203 install -Dm644 nginx.immich.conf "${pkgdir}/usr/share/doc/immich/examples/nginx.conf"
204
205 # we don't create a build-lock.json because if the file is empty
206 # it just detects the right versions from the environment
207 # see server/src/repositories/server-info.repository.ts
208
209 # symlink to server management scripts
210 install -dm755 "${pkgdir}/usr/bin"
211 ln -s ../lib/immich/app/server/bin/immich-healthcheck "${pkgdir}/usr/bin/immich-healthcheck"
212 cat <<-EOF > "${pkgdir}/usr/bin/immich-admin"
213 #!/usr/bin/env sh
214 cd /usr/lib/immich/app/server/bin/
215 ./start.sh immich-admin "$@"
216 EOF
217}
218
219package_immich-cli() {
220 pkgdesc+=" (command-line client)"
221 arch=('any')
222 depends=('nodejs>=22')
223
224 cd "${srcdir}/${pkgbase}-${pkgver}/"
225 install -dm755 "${pkgdir}/usr/lib/immich/cli"
226 cp -rT output/cli-pruned "${pkgdir}/usr/lib/immich/cli"
227
228 # setup symlink to allow immich command to be run from shell
229 install -dm755 "${pkgdir}/usr/bin"
230 ln -s ../lib/immich/cli/bin/immich "${pkgdir}/usr/bin/immich"
231}
232

Changes since previous scan

--- PKGBUILD @ 2026-10-21 07:31
+++ PKGBUILD @ 2026-11-01 00:21
@@ -8,7 +8,7 @@
pkgbase=immich
pkgname=('immich-server' 'immich-cli')
pkgrel=1
-pkgver=3.3.3
+pkgver=3.3.4
pkgdesc='Self-hosted photos and videos backup tool'
url='https://github.com/immich-app/immich'
license=('AGPL-3.0-only')
@@ -76,7 +76,7 @@
'https://download.geonames.org/export/dump/admin2Codes.txt'
'https://raw.githubusercontent.com/nvkelso/natural-earth-vector/v5.1.2/geojson/ne_10m_admin_0_countries.geojson'
'https://download.geonames.org/export/dump/countryInfo.txt')
-b2sums=('7df60f96ba885a0475b5d7dc155495aa7faaa35253086a2163f321233d69b7c16a2231ce127f14ae8f0a9e5c831e0ec996573f40749052967bfe6253e276542c'
+b2sums=('88e89f42cc7a32aad848b05f9f1a3928399f045786c897ecbc0c3e60b4ecc12c53a32423690381c1d8bc33c1454e8bbcf4e317e3c856ee431085857cd418248b'
'6c8decad88b49a2d62c1ffbcc682c26250e459c0205f2e300973a837578841d896a51dfabf9ec8a4bc288e966303cf32dae02cebb9f78fdad807b07b3fd410c6'
'2d94fcc21861067920f0df1e6e5ac74b4413515777b204070c5d8fc01026c54e993e4eff65dabeb3629ee24d238a1a52793c061947009ddac5f0ebf64a58312d'
'48cf0c345047b50831f1f5a4fc0f5478aedddc50c6d62faf4205a6a093213a402e15567594a10987c9a97fb69f47894835409a9461d0cda9bf579e25e0d0e42b'

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 3
2026-10-31 00:07:41 Low 3
2026-10-30 00:29:30 Low 3
2026-10-29 00:13:55 Low 3
2026-10-28 00:06:54 Low 3
2026-10-27 00:23:28 Low 3
2026-10-26 00:12:40 Low 3
2026-10-25 00:20:48 Low 3
2026-10-24 00:14:55 Low 3
2026-10-23 00:02:19 Low 3
2026-10-22 00:13:10 Low 3
2026-10-21 19:33:05 Medium 2
2026-10-21 07:31:05 Medium 2
2026-10-21 00:12:50 Low 3
2026-10-20 00:10:31 Low 3
2026-10-19 00:03:55 Low 3
2026-10-18 00:06:55 Low 3
2026-10-17 00:21:55 Low 3
2026-10-16 00:12:47 Low 3
2026-10-15 00:28:05 Low 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion