joplin-server-bin

maintainer Terrance · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD pulls Joplin Server from the official Docker Hub registry (registry-1.docker.io) using the standard Docker Registry v2 API with bearer token authentication - a known and legitimate pattern for packaging Docker-image-based software in AUR. The source is the official joplin/server image from a well-known vendor. The cheaper model's HIGH rating is a false positive in terms of malware/RCE. However, there is a genuine medium-severity concern: the Docker image layers are fetched in prepare() outside of the source=() array, bypassing makepkg's integrity verification. The manifest digest is used to identify the correct manifest, but the individual layer blobs are extracted without verifying their digests against the manifest's declared layer digests (even though those digests are available in the manifest JSON). This means a compromised registry response or MITM could substitute layer content. This is a real but non-malicious packaging weakness - the maintainer is not acting maliciously, but the lack of layer digest verification is a legitimate security concern worth flagging at medium severity.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:37 token="$(curl -s "https://auth.docker.io/token?service=$_service&scope=repository:$_image:pull" | jq -r .access_token)"
PKGBUILD:39 idigest="$(curl -s -H "Authorization: Bearer $token" -H "Accept: $_accept" "https://$_registry/v2/$_image/manifests/$pkgver" \
PKGBUILD:42 curl -s -H "Authorization: Bearer $token" -H "Accept: $_vnd" "https://$_registry/v2/$_image/manifests/$idigest" \
PKGBUILD:46 count=$(curl -s --follow -H "Authorization: Bearer $token" "https://$_registry/v2/$_image/blobs/$ldigest" \

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD pulls Joplin Server from the official Docker Hub registry (registry-1.docker.io) using the standard Docker Registry v2 API with bearer token authentication - a known and legitimate pattern for packaging Docker-image-based software in AUR. The source is the official joplin/server image from a well-known vendor. The cheaper model's HIGH rating is a false positive in terms of malware/RCE. However, there is a genuine medium-severity concern: the Docker image layers are fetched in prepare() outside of the source=() array, bypassing makepkg's integrity verification. The manifest digest is used to identify the correct manifest, but the individual layer blobs are extracted without verifying their digests against the manifest's declared layer digests (even though those digests are available in the manifest JSON). This means a compromised registry response or MITM could substitute layer content. This is a real but non-malicious packaging weakness - the maintainer is not acting maliciously, but the lack of layer digest verification is a legitimate security concern worth flagging at medium severity.

PKGBUILD

4 offending line(s) highlighted

      1_pkgname=joplin-server
    
      2_image=joplin/server
    
      3
    
      4pkgname="$_pkgname-bin"
    
      5pkgver=3.7.1
    
      6pkgrel=1
    
      7pkgdesc='Joplin Server, via Docker image'
    
      8arch=('any')
    
      9url="https://hub.docker.com/r/$_image"
    
      10license=('custom:Joplin-Server-Personal-Use-License')
    
      11depends=('nodejs' 'pnpm' 'pm2')
    
      12makedepends=('jq')
    
      13source=(
    
      14  "$_pkgname.service"
    
      15  "$_pkgname.sysusers"
    
      16  "$_pkgname.tmpfiles"
    
      17  'https://raw.githubusercontent.com/laurent22/joplin/dev/.env-sample'
    
      18)
    
      19sha256sums=('adac9f3a6df5a29c4fa865249e9c8b65cd6b582271fb9e69d99c4b9ebc83f5fa'
    
      20            '2f3cea9bed6f79d7c93721dd1acb7c3b5c0368be264ae2894bd66034634e694d'
    
      21            '55455d0ebfcb6ef72b8c4fe934a69ccfd9089f881058933d7cba0c07d7aaffc0'
    
      22            'e85770c7a0391baa7cf18edeeb64b6a8fe2ccb409d31294d2bde4cd8096cf80f')
    
      23backup=("etc/$_pkgname.env")
    
      24provides=("$_pkgname")
    
      25options=(!strip !debug)
    
      26
    
      27_vnd='application/vnd.docker.distribution.manifest.v2+json'
    
      28_vndlist='application/vnd.docker.distribution.manifest.list.v2+json'
    
      29_accept="$_vnd,$_vndlist"
    
      30_service=registry.docker.io
    
      31_registry=registry-1.docker.io
    
      32
    
      33_path=home/joplin/packages
    
      34
    
      35prepare() {
    
      36  echo "Authenticating to '$_service'"
    
      37  token="$(curl -s "https://auth.docker.io/token?service=$_service&scope=repository:$_image:pull" | jq -r .access_token)"
    
      38  echo "Looking up image '$_image:$pkgver' via '$_registry'"
    
      39  idigest="$(curl -s -H "Authorization: Bearer $token" -H "Accept: $_accept" "https://$_registry/v2/$_image/manifests/$pkgver" \
    
      40    | jq -r 'if .mediaType == "'"$_vndlist"'" then .manifests[0] else . end | .digest')"
    
      41  echo "Listing layers for manifest '$idigest'"
    
      42  curl -s -H "Authorization: Bearer $token" -H "Accept: $_vnd" "https://$_registry/v2/$_image/manifests/$idigest" \
    
      43    | jq -r '.layers[].digest' \
    
      44    | while read ldigest; do
    
      45        echo "Fetching layer '$ldigest'"
    
      46        count=$(curl -s --follow -H "Authorization: Bearer $token" "https://$_registry/v2/$_image/blobs/$ldigest" \
    
      47          | 2>&1 tar xzv $_path | grep -Ev 'Not found in archive|Exiting with failure status' | wc -l)
    
      48        if [ $count -gt 0 ]; then echo "* unpacked $count files"; fi
    
      49      done
    
      50}
    
      51
    
      52package() {
    
      53  install -d -m 0755 "$pkgdir/usr/lib/$_pkgname"
    
      54  cp -a "$_path/"* "$pkgdir/usr/lib/$_pkgname/"
    
      55  install -D -m 0644 "$_path/server/LICENSE.md" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      56
    
      57  install -D -m 0640 .env-sample "$pkgdir/etc/$_pkgname.env"
    
      58  ln -s '/var/lib/joplin/logs' "$pkgdir/usr/lib/$_pkgname/server/logs"
    
      59  ln -s '/var/lib/joplin/temp' "$pkgdir/usr/lib/$_pkgname/server/temp"
    
      60  install -D -m 0644 "$_pkgname.service" "$pkgdir/usr/lib/systemd/system/$_pkgname.service"
    
      61  install -D -m 0644 "$_pkgname.sysusers" "$pkgdir/usr/lib/sysusers.d/$_pkgname.conf"
    
      62  install -D -m 0644 "$_pkgname.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$_pkgname.conf"
    
      63}
    
      64

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2