metabase

maintainer AlphaJack · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The JAR file is downloaded from downloads.metabase.com, which is the official release domain for Metabase, and is used to install the application; despite the non-whitelisted host, the source is legitimate and the package does not execute untrusted remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The JAR file is downloaded from downloads.metabase.com, which is the official release domain for Metabase, and is used to install the application; despite the non-whitelisted host, the source is legitimate and the package does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("metabase-$pkgver.jar::https://downloads.metabase.com/v$pkgver.x/metabase.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2# Co-Maintainer: Naxels <naxels at gmail dot com>
    
      3
    
      4# https://wiki.archlinux.org/title/Java_package_guidelines
    
      5# https://www.metabase.com/docs/latest/installation-and-operation/running-the-metabase-jar-file
    
      6# https://www.metabase.com/docs/latest/installation-and-operation/running-metabase-on-debian
    
      7
    
      8pkgname="metabase"
    
      9pkgver=0.63.2
    
      10pkgrel=1
    
      11pkgdesc="The simplest, fastest way to get business intelligence and analytics to everyone in your company"
    
      12arch=("x86_64" "aarch64")
    
      13url="https://www.metabase.com/"
    
      14license=("AGPL")
    
      15depends=("java-runtime-headless")
    
      16optdepends=("metabase-driver-clickhouse: connect to clickhouse databases"
    
      17            "metabase-driver-csv: connect to csv files"
    
      18            "metabase-driver-dremio: connect to dremio databases"
    
      19            "metabase-driver-duckdb: connect to duckdb files"
    
      20            "metabase-driver-teradata: connect to teradata databases"
    
      21           )
    
      22source=("metabase-$pkgver.jar::https://downloads.metabase.com/v$pkgver.x/metabase.jar"
    
      23        "metabase"
    
      24        "metabase.conf"
    
      25        "metabase.service"
    
      26        "metabase.sysusers"
    
      27        "metabase.tmpfiles"
    
      28        )
    
      29b2sums=('cc1e6ccf86438fbdabab63e58f533816e6c400ad5661887eb271f0fbe257b5c65935ec56829d064d018788f2135377d196948c8e973912a5be53a2ba55cfb690'
    
      30        '018307ca071fe70426c22b6bdf5801e74b6498735636ba9b8c97d0d6d3c96380fe56a81f608e564fb359fbfd62f44c8b0dbb7a5d4dceeed09111a8764cc23f5d'
    
      31        '7c97fd3a8adbe86d29ca92fed57a99b406f12cd742baf091a686c3dffcb6af837b3944299ca30e96ba041db851effee58df30d9eafef2abc967f4b7eb4c26c12'
    
      32        '52e9b37eaf29f24d3f10b29813b7bc36bb984ab55d20422b4d4b0df93ba19b62835081c4f261cf3c78d80baf973d9568fa6b910df17a07caeac098b2efe624fa'
    
      33        '4a0e18e9dac9bb3fe2a002e295e65bf5526967bd3c2f525936894ffde416b8b5855d3f9f37355d5c22bb9c25d2171c5f6884e964a6c4dcef9c4f158f84d777ac'
    
      34        '14c866a846c80d6f68fbe9c77ac1657bf5385cfc1ba90d43929a24bcdcedb81a2d9c5ecbeec77794d487e85a4c29a2e3dfe111146bb381c88895159c8987b55f')
    
      35noextract=("metabase-$pkgver.jar")
    
      36options=("!strip")
    
      37backup=("etc/metabase.conf")
    
      38
    
      39package(){
    
      40 install -d -m 750 "$pkgdir/var/lib/metabase"
    
      41 install -D -m 755 "metabase" "$pkgdir/usr/bin/metabase"
    
      42 install -D -m 644 "metabase-$pkgver.jar" "$pkgdir/usr/share/java/metabase/metabase.jar"
    
      43 install -D -m 640 "metabase.conf" "$pkgdir/etc/metabase.conf"
    
      44 install -D -m 644 "metabase.service" "$pkgdir/usr/lib/systemd/system/metabase.service"
    
      45 install -D -m 644 "metabase.sysusers" "$pkgdir/usr/lib/sysusers.d/metabase.conf"
    
      46 install -D -m 644 "metabase.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/metabase.conf"
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -6,7 +6,7 @@
 # https://www.metabase.com/docs/latest/installation-and-operation/running-metabase-on-debian
 
 pkgname="metabase"
-pkgver=0.63.1
+pkgver=0.63.2
 pkgrel=1
 pkgdesc="The simplest, fastest way to get business intelligence and analytics to everyone in your company"
 arch=("x86_64" "aarch64")
@@ -26,7 +26,7 @@
         "metabase.sysusers"
         "metabase.tmpfiles"
         )
-b2sums=('3967d0107ab68421baf50dddf3a8da60ef618c861180446466524d11fb5834ce993340e025a207c5f829a13d71ae7759e8f62c62f781e08c9a9f501a7f1468c7'
+b2sums=('cc1e6ccf86438fbdabab63e58f533816e6c400ad5661887eb271f0fbe257b5c65935ec56829d064d018788f2135377d196948c8e973912a5be53a2ba55cfb690'
         '018307ca071fe70426c22b6bdf5801e74b6498735636ba9b8c97d0d6d3c96380fe56a81f608e564fb359fbfd62f44c8b0dbb7a5d4dceeed09111a8764cc23f5d'
         '7c97fd3a8adbe86d29ca92fed57a99b406f12cd742baf091a686c3dffcb6af837b3944299ca30e96ba041db851effee58df30d9eafef2abc967f4b7eb4c26c12'
         '52e9b37eaf29f24d3f10b29813b7bc36bb984ab55d20422b4d4b0df93ba19b62835081c4f261cf3c78d80baf973d9568fa6b910df17a07caeac098b2efe624fa'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 15:15:12	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 13:27:52	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2