joplin-server-bin

MEDIUM

maintainer Terrance 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD downloads and extracts layers from a Docker image hosted on Docker Hub without bundling the image in source=(), using an unverifiable checksum check; while the checksum verification mitigates risk, the lack of source transparency and reliance on runtime downloads from an untrusted host constitutes a supply-chain risk.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:38 token="$(curl -s "https://auth.docker.io/token?service=$_service&scope=repository:$_image:pull" | jq -r .access_token)"
PKGBUILD:40 idigest="$(curl -s -H "Authorization: Bearer $token" -H "Accept: $_accept" "https://$_registry/v2/$_image/manifests/$pkgver" \
PKGBUILD:48 curl -s -H "Authorization: Bearer $token" -H "Accept: $_vnd" "https://$_registry/v2/$_image/manifests/$idigest" \
PKGBUILD:52 count=$(curl -s --follow -H "Authorization: Bearer $token" "https://$_registry/v2/$_image/blobs/$ldigest" \

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The PKGBUILD downloads and extracts layers from a Docker image hosted on Docker Hub without bundling the image in source=(), using an unverifiable checksum check; while the checksum verification mitigates risk, the lack of source transparency and reliance on runtime downloads from an untrusted host constitutes a supply-chain risk.

PKGBUILD

4 offending line(s) highlighted

      1_pkgname=joplin-server
    
      2_image=joplin/server
    
      3
    
      4pkgname="$_pkgname-bin"
    
      5pkgver=3.7.3
    
      6pkgrel=1
    
      7pkgdesc='Joplin Server, via Docker image'
    
      8arch=('any')
    
      9url="https://hub.docker.com/r/$_image"
    
      10license=('custom:Joplin-Server-Personal-Use-License')
    
      11depends=('nodejs' 'pnpm' 'pm2')
    
      12makedepends=('jq')
    
      13source=(
    
      14  "$_pkgname.service"
    
      15  "$_pkgname.sysusers"
    
      16  "$_pkgname.tmpfiles"
    
      17  'https://raw.githubusercontent.com/laurent22/joplin/dev/.env-sample'
    
      18)
    
      19_imagesum='sha256:ed32018183f7771818f9d856b1bb9830b22424243496eae1ce08c957a42f296c'
    
      20sha256sums=('2b4bd101041ea99d90d735b65b6bd54573e7424e57fc127c90082034c19c1cde'
    
      21            '2f3cea9bed6f79d7c93721dd1acb7c3b5c0368be264ae2894bd66034634e694d'
    
      22            '55455d0ebfcb6ef72b8c4fe934a69ccfd9089f881058933d7cba0c07d7aaffc0'
    
      23            'e85770c7a0391baa7cf18edeeb64b6a8fe2ccb409d31294d2bde4cd8096cf80f')
    
      24backup=("etc/$_pkgname.env")
    
      25provides=("$_pkgname")
    
      26options=(!strip !debug)
    
      27
    
      28_vnd='application/vnd.docker.distribution.manifest.v2+json'
    
      29_vndlist='application/vnd.docker.distribution.manifest.list.v2+json'
    
      30_accept="$_vnd,$_vndlist"
    
      31_service=registry.docker.io
    
      32_registry=registry-1.docker.io
    
      33
    
      34_path=home/joplin/packages
    
      35
    
      36prepare() {
    
      37  echo "Authenticating to '$_service'"
    
      38  token="$(curl -s "https://auth.docker.io/token?service=$_service&scope=repository:$_image:pull" | jq -r .access_token)"
    
      39  echo "Looking up image '$_image:$pkgver' via '$_registry'"
    
      40  idigest="$(curl -s -H "Authorization: Bearer $token" -H "Accept: $_accept" "https://$_registry/v2/$_image/manifests/$pkgver" \
    
      41    | jq -r 'if .mediaType == "'"$_vndlist"'" then .manifests[0] else . end | .digest')"
    
      42  if ! [ "$idigest" = "$_imagesum" ]; then
    
      43    echo >&2 "Error: image checksum mismatch for '$_image:$pkgver'"
    
      44    echo >&2 "(expected '$_imagesum', found '$idigest')"
    
      45    exit 1
    
      46  fi
    
      47  echo "Listing layers for manifest '$idigest'"
    
      48  curl -s -H "Authorization: Bearer $token" -H "Accept: $_vnd" "https://$_registry/v2/$_image/manifests/$idigest" \
    
      49    | jq -r '.layers[].digest' \
    
      50    | while read ldigest; do
    
      51        echo "Fetching layer '$ldigest'"
    
      52        count=$(curl -s --follow -H "Authorization: Bearer $token" "https://$_registry/v2/$_image/blobs/$ldigest" \
    
      53          | 2>&1 tar xzv $_path | grep -Ev 'Not found in archive|Exiting with failure status' | wc -l)
    
      54        if [ $count -gt 0 ]; then echo "* unpacked $count files"; fi
    
      55      done
    
      56}
    
      57
    
      58package() {
    
      59  install -d -m 0755 "$pkgdir/usr/lib/$_pkgname"
    
      60  cp -a "$_path/"* "$pkgdir/usr/lib/$_pkgname/"
    
      61  install -D -m 0644 "$_path/server/LICENSE.md" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      62
    
      63  install -D -m 0640 .env-sample "$pkgdir/etc/$_pkgname.env"
    
      64  ln -s '/var/lib/joplin/logs' "$pkgdir/usr/lib/$_pkgname/server/logs"
    
      65  ln -s '/var/lib/joplin/temp' "$pkgdir/usr/lib/$_pkgname/server/temp"
    
      66  install -D -m 0644 "$_pkgname.service" "$pkgdir/usr/lib/systemd/system/$_pkgname.service"
    
      67  install -D -m 0644 "$_pkgname.sysusers" "$pkgdir/usr/lib/sysusers.d/$_pkgname.conf"
    
      68  install -D -m 0644 "$_pkgname.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$_pkgname.conf"
    
      69}
    
      70

Changes since previous scan

--- PKGBUILD @ 2026-10-23 00:02
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
 _image=joplin/server
 
 pkgname="$_pkgname-bin"
-pkgver=3.7.2
+pkgver=3.7.3
 pkgrel=1
 pkgdesc='Joplin Server, via Docker image'
 arch=('any')
@@ -16,6 +16,7 @@
   "$_pkgname.tmpfiles"
   'https://raw.githubusercontent.com/laurent22/joplin/dev/.env-sample'
 )
+_imagesum='sha256:ed32018183f7771818f9d856b1bb9830b22424243496eae1ce08c957a42f296c'
 sha256sums=('2b4bd101041ea99d90d735b65b6bd54573e7424e57fc127c90082034c19c1cde'
             '2f3cea9bed6f79d7c93721dd1acb7c3b5c0368be264ae2894bd66034634e694d'
             '55455d0ebfcb6ef72b8c4fe934a69ccfd9089f881058933d7cba0c07d7aaffc0'
@@ -38,6 +39,11 @@
   echo "Looking up image '$_image:$pkgver' via '$_registry'"
   idigest="$(curl -s -H "Authorization: Bearer $token" -H "Accept: $_accept" "https://$_registry/v2/$_image/manifests/$pkgver" \
     | jq -r 'if .mediaType == "'"$_vndlist"'" then .manifests[0] else . end | .digest')"
+  if ! [ "$idigest" = "$_imagesum" ]; then
+    echo >&2 "Error: image checksum mismatch for '$_image:$pkgver'"
+    echo >&2 "(expected '$_imagesum', found '$idigest')"
+    exit 1
+  fi
   echo "Listing layers for manifest '$idigest'"
   curl -s -H "Authorization: Bearer $token" -H "Accept: $_vnd" "https://$_registry/v2/$_image/manifests/$idigest" \
     | jq -r '.layers[].digest' \

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 21:38:30	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2