metabase

LOW

maintainer AlphaJack 2 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The JAR file is downloaded from the official project's domain (downloads.metabase.com), which is a standard and expected source for the software, making it a legitimate build despite the non-whitelisted host flag.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The JAR file is downloaded from the official project's domain (downloads.metabase.com), which is a standard and expected source for the software, making it a legitimate build despite the non-whitelisted host flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("metabase-$pkgver.jar::https://downloads.metabase.com/v$pkgver.x/metabase.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2# Co-Maintainer: Naxels <naxels at gmail dot com>
    
      3
    
      4# https://wiki.archlinux.org/title/Java_package_guidelines
    
      5# https://www.metabase.com/docs/latest/installation-and-operation/running-the-metabase-jar-file
    
      6# https://www.metabase.com/docs/latest/installation-and-operation/running-metabase-on-debian
    
      7
    
      8pkgname="metabase"
    
      9pkgver=0.64.3
    
      10pkgrel=1
    
      11pkgdesc="The simplest, fastest way to get business intelligence and analytics to everyone in your company"
    
      12arch=("x86_64" "aarch64")
    
      13url="https://www.metabase.com/"
    
      14license=("AGPL")
    
      15depends=("java-runtime-headless")
    
      16optdepends=("metabase-driver-clickhouse: connect to clickhouse databases"
    
      17            "metabase-driver-csv: connect to csv files"
    
      18            "metabase-driver-dremio: connect to dremio databases"
    
      19            "metabase-driver-duckdb: connect to duckdb files"
    
      20            "metabase-driver-teradata: connect to teradata databases"
    
      21           )
    
      22source=("metabase-$pkgver.jar::https://downloads.metabase.com/v$pkgver.x/metabase.jar"
    
      23        "metabase"
    
      24        "metabase.conf"
    
      25        "metabase.service"
    
      26        "metabase.sysusers"
    
      27        "metabase.tmpfiles"
    
      28        )
    
      29b2sums=('c47f4587c1b034e16f3dcf045d3a38a6f142fab60f12225c2071b515d4c74b90379a41e0f5a482f1f0c85f7d13f3457de14d3c1b11d613e27167ad9ddbbf58ce'
    
      30        '018307ca071fe70426c22b6bdf5801e74b6498735636ba9b8c97d0d6d3c96380fe56a81f608e564fb359fbfd62f44c8b0dbb7a5d4dceeed09111a8764cc23f5d'
    
      31        '7c97fd3a8adbe86d29ca92fed57a99b406f12cd742baf091a686c3dffcb6af837b3944299ca30e96ba041db851effee58df30d9eafef2abc967f4b7eb4c26c12'
    
      32        '52e9b37eaf29f24d3f10b29813b7bc36bb984ab55d20422b4d4b0df93ba19b62835081c4f261cf3c78d80baf973d9568fa6b910df17a07caeac098b2efe624fa'
    
      33        '4a0e18e9dac9bb3fe2a002e295e65bf5526967bd3c2f525936894ffde416b8b5855d3f9f37355d5c22bb9c25d2171c5f6884e964a6c4dcef9c4f158f84d777ac'
    
      34        '14c866a846c80d6f68fbe9c77ac1657bf5385cfc1ba90d43929a24bcdcedb81a2d9c5ecbeec77794d487e85a4c29a2e3dfe111146bb381c88895159c8987b55f')
    
      35noextract=("metabase-$pkgver.jar")
    
      36options=("!strip")
    
      37backup=("etc/metabase.conf")
    
      38
    
      39package(){
    
      40 install -d -m 750 "$pkgdir/var/lib/metabase"
    
      41 install -D -m 755 "metabase" "$pkgdir/usr/bin/metabase"
    
      42 install -D -m 644 "metabase-$pkgver.jar" "$pkgdir/usr/share/java/metabase/metabase.jar"
    
      43 install -D -m 640 "metabase.conf" "$pkgdir/etc/metabase.conf"
    
      44 install -D -m 644 "metabase.service" "$pkgdir/usr/lib/systemd/system/metabase.service"
    
      45 install -D -m 644 "metabase.sysusers" "$pkgdir/usr/lib/sysusers.d/metabase.conf"
    
      46 install -D -m 644 "metabase.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/metabase.conf"
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -6,7 +6,7 @@
 # https://www.metabase.com/docs/latest/installation-and-operation/running-metabase-on-debian
 
 pkgname="metabase"
-pkgver=0.64.1
+pkgver=0.64.3
 pkgrel=1
 pkgdesc="The simplest, fastest way to get business intelligence and analytics to everyone in your company"
 arch=("x86_64" "aarch64")
@@ -26,7 +26,7 @@
         "metabase.sysusers"
         "metabase.tmpfiles"
         )
-b2sums=('82a4a543bde237e7843c5cc5d4113c9a1add05104ccbd1bb9c132fd7c3b1faa4a64dba0a62e0689588affcc040d0cfa85e375b7d422cd793a0c39ad259904e84'
+b2sums=('c47f4587c1b034e16f3dcf045d3a38a6f142fab60f12225c2071b515d4c74b90379a41e0f5a482f1f0c85f7d13f3457de14d3c1b11d613e27167ad9ddbbf58ce'
         '018307ca071fe70426c22b6bdf5801e74b6498735636ba9b8c97d0d6d3c96380fe56a81f608e564fb359fbfd62f44c8b0dbb7a5d4dceeed09111a8764cc23f5d'
         '7c97fd3a8adbe86d29ca92fed57a99b406f12cd742baf091a686c3dffcb6af837b3944299ca30e96ba041db851effee58df30d9eafef2abc967f4b7eb4c26c12'
         '52e9b37eaf29f24d3f10b29813b7bc36bb984ab55d20422b4d4b0df93ba19b62835081c4f261cf3c78d80baf973d9568fa6b910df17a07caeac098b2efe624fa'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 15:52:51	Medium	1
2026-10-29 00:13:55	Low	2
2026-10-28 13:50:29	Medium	1
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2