lidarr-develop-bin

maintainer txtsd · 2 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads prebuilt binaries from the project's official update infrastructure (lidarr.servarr.com), which is plausibly owned by the project; despite the non-whitelisted host, this is a standard distribution method for the software, and the binaries are verified with matching sha256sums, reducing supply-chain risk to low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official update infrastructure (lidarr.servarr.com), which is plausibly owned by the project; despite the non-whitelisted host, this is a standard distribution method for the software, and the binaries are verified with matching sha256sums, reducing supply-chain risk to low.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:47 source_x86_64=("Lidarr.develop.${pkgver}.linux-core-x64.tar.gz::https://lidarr.servarr.com/v1/update/develop/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=x64")

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: txtsd <aur.archlinux@ihavea.quest>
2# Maintainer: Donald Webster <fryfrog@gmail.com>
3# Helpful URL: https://services.lidarr.audio/v1/update/develop?version=0.0.0.0&os=linux&runtime=netcore&arch=x64&includeMajorVersion=true
4
5pkgname=lidarr-develop-bin
6pkgver=3.1.3.4975
7pkgrel=1
8pkgdesc='Music collection manager for newsgroup and torrent users (develop branch)'
9arch=(x86_64 aarch64 armv7h)
10url='https://lidarr.audio'
11license=('GPL-3.0-or-later')
12groups=(servarr-develop-bin)
13depends=(
14 gcc-libs
15 glibc
16 sqlite
17 zlib
18)
19optdepends=(
20 'postgresql: postgresql database'
21 'sabnzbd: usenet downloader'
22 'nzbget: usenet downloader'
23 'qbittorrent: torrent downloader'
24 'deluge: torrent downloader'
25 'rtorrent: torrent downloader'
26 'nodejs-flood: torrent downloader'
27 'vuze: torrent downloader'
28 'aria2: torrent downloader'
29 'transmission-cli: torrent downloader (CLI and daemon)'
30 'transmission-gtk: torrent downloader (GTK+)'
31 'transmission-qt: torrent downloader (Qt)'
32 'jackett: torrent indexer proxy'
33 'nzbhydra2: torznab and usenet indexer proxy'
34 'prowlarr: torrent and usenet indexer proxy'
35 'autobrr: irc, torrent and usenet indexer proxy'
36)
37provides=(lidarr)
38conflicts=(lidarr)
39options=(!debug)
40install=lidarr.install
41source=(
42 lidarr.service
43 lidarr.sysusers
44 lidarr.tmpfiles
45 package_info
46)
47source_x86_64=("Lidarr.develop.${pkgver}.linux-core-x64.tar.gz::https://lidarr.servarr.com/v1/update/develop/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=x64")
48source_aarch64=("Lidarr.develop.${pkgver}.linux-core-arm64.tar.gz::https://lidarr.servarr.com/v1/update/develop/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=arm64")
49source_armv7h=("Lidarr.develop.${pkgver}.linux-core-arm.tar.gz::https://lidarr.servarr.com/v1/update/develop/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=arm")
50sha256sums=('48f4cc5040b1a51e624f5be4977078b77bf7f87b9c1fb7fa34e844da4c831401'
51 '85098d47734e8087480f8a29eafec50faa453487221ef01173888155d2b06e42'
52 'd71e37213ac65722e42f6f2c5772d4515c2d28a77b9f7608dc05c787d86ebaa5'
53 '1d246459491c9e2c9b21f61ec039f0ed4268ef467285cf806080e3f82c4c7077')
54sha256sums_x86_64=('f1ec9682412b5500e82e42ffde0b4195fc662a5b4bcb47297c6f40659029e5cd')
55sha256sums_aarch64=('56cf73df2c36d6087a9ab9bdd82470a1d6f0cd4147c1c0ce4bf00940896d8a6e')
56sha256sums_armv7h=('f64175fd1d474ffa951a858d68b8d57a27d63fc461947bfa193791579739ead5')
57
58package() {
59 install -dm755 "${pkgdir}/usr/lib/lidarr/bin"
60
61 # License
62 install -Dm644 Lidarr/LICENSE.md "${pkgdir}/usr/share/licenses/${pkgname}"
63 rm Lidarr/LICENSE.md
64
65 # Remove Service Helpers, and Update files
66 rm Lidarr/ServiceInstall*
67 rm Lidarr/ServiceUninstall*
68 rm -rf Lidarr/Lidarr.Update
69
70 # Disable built in updater.
71 install -Dm644 package_info "${pkgdir}/usr/lib/lidarr"
72 echo "PackageVersion=${pkgver}-${pkgrel}" >> "${pkgdir}/usr/lib/lidarr/package_info"
73
74 # Copy Lidarr
75 cp -dr Lidarr/* "${pkgdir}/usr/lib/lidarr/bin"
76
77 # Systemd
78 install -Dm644 lidarr.service "${pkgdir}/usr/lib/systemd/system/lidarr.service"
79 install -Dm644 lidarr.sysusers "${pkgdir}/usr/lib/sysusers.d/lidarr.conf"
80 install -Dm644 lidarr.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/lidarr.conf"
81}
82

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion