metabase

LOW

maintainer AlphaJack 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt JAR from the official vendor's domain (metabase.com), which is a normal and expected practice for Java applications; the host is not on a default whitelist but is plausibly official and trustworthy for this software.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt JAR from the official vendor's domain (metabase.com), which is a normal and expected practice for Java applications; the host is not on a default whitelist but is plausibly official and trustworthy for this software.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("metabase-$pkgver.jar::https://downloads.metabase.com/v$pkgver.x/metabase.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2# Co-Maintainer: Naxels <naxels at gmail dot com>
    
      3
    
      4# https://wiki.archlinux.org/title/Java_package_guidelines
    
      5# https://www.metabase.com/docs/latest/installation-and-operation/running-the-metabase-jar-file
    
      6# https://www.metabase.com/docs/latest/installation-and-operation/running-metabase-on-debian
    
      7
    
      8pkgname="metabase"
    
      9pkgver=0.63.17
    
      10pkgrel=1
    
      11pkgdesc="The simplest, fastest way to get business intelligence and analytics to everyone in your company"
    
      12arch=("x86_64" "aarch64")
    
      13url="https://www.metabase.com/"
    
      14license=("AGPL")
    
      15depends=("java-runtime-headless")
    
      16optdepends=("metabase-driver-clickhouse: connect to clickhouse databases"
    
      17            "metabase-driver-csv: connect to csv files"
    
      18            "metabase-driver-dremio: connect to dremio databases"
    
      19            "metabase-driver-duckdb: connect to duckdb files"
    
      20            "metabase-driver-teradata: connect to teradata databases"
    
      21           )
    
      22source=("metabase-$pkgver.jar::https://downloads.metabase.com/v$pkgver.x/metabase.jar"
    
      23        "metabase"
    
      24        "metabase.conf"
    
      25        "metabase.service"
    
      26        "metabase.sysusers"
    
      27        "metabase.tmpfiles"
    
      28        )
    
      29b2sums=('9cba5512d762625f88329b952ee67eead67567f3a878a2e7b8e1be61066c8f207b4078fd99c2c81920f498cbbd702d8e0c2296f534dc073bbd2903361dac0701'
    
      30        '018307ca071fe70426c22b6bdf5801e74b6498735636ba9b8c97d0d6d3c96380fe56a81f608e564fb359fbfd62f44c8b0dbb7a5d4dceeed09111a8764cc23f5d'
    
      31        '7c97fd3a8adbe86d29ca92fed57a99b406f12cd742baf091a686c3dffcb6af837b3944299ca30e96ba041db851effee58df30d9eafef2abc967f4b7eb4c26c12'
    
      32        '52e9b37eaf29f24d3f10b29813b7bc36bb984ab55d20422b4d4b0df93ba19b62835081c4f261cf3c78d80baf973d9568fa6b910df17a07caeac098b2efe624fa'
    
      33        '4a0e18e9dac9bb3fe2a002e295e65bf5526967bd3c2f525936894ffde416b8b5855d3f9f37355d5c22bb9c25d2171c5f6884e964a6c4dcef9c4f158f84d777ac'
    
      34        '14c866a846c80d6f68fbe9c77ac1657bf5385cfc1ba90d43929a24bcdcedb81a2d9c5ecbeec77794d487e85a4c29a2e3dfe111146bb381c88895159c8987b55f')
    
      35noextract=("metabase-$pkgver.jar")
    
      36options=("!strip")
    
      37backup=("etc/metabase.conf")
    
      38
    
      39package(){
    
      40 install -d -m 750 "$pkgdir/var/lib/metabase"
    
      41 install -D -m 755 "metabase" "$pkgdir/usr/bin/metabase"
    
      42 install -D -m 644 "metabase-$pkgver.jar" "$pkgdir/usr/share/java/metabase/metabase.jar"
    
      43 install -D -m 640 "metabase.conf" "$pkgdir/etc/metabase.conf"
    
      44 install -D -m 644 "metabase.service" "$pkgdir/usr/lib/systemd/system/metabase.service"
    
      45 install -D -m 644 "metabase.sysusers" "$pkgdir/usr/lib/sysusers.d/metabase.conf"
    
      46 install -D -m 644 "metabase.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/metabase.conf"
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-09-12 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -6,7 +6,7 @@
 # https://www.metabase.com/docs/latest/installation-and-operation/running-metabase-on-debian
 
 pkgname="metabase"
-pkgver=0.63.16
+pkgver=0.63.17
 pkgrel=1
 pkgdesc="The simplest, fastest way to get business intelligence and analytics to everyone in your company"
 arch=("x86_64" "aarch64")
@@ -26,7 +26,7 @@
         "metabase.sysusers"
         "metabase.tmpfiles"
         )
-b2sums=('67ab74a3e549c76411a21fec71fa0865c0cc40ca9cdcfc7f0ceeea2b42d64f85498bcba8f83adf1fa1da976c01031ad94b904cec6725d55c9f119f4068025840'
+b2sums=('9cba5512d762625f88329b952ee67eead67567f3a878a2e7b8e1be61066c8f207b4078fd99c2c81920f498cbbd702d8e0c2296f534dc073bbd2903361dac0701'
         '018307ca071fe70426c22b6bdf5801e74b6498735636ba9b8c97d0d6d3c96380fe56a81f608e564fb359fbfd62f44c8b0dbb7a5d4dceeed09111a8764cc23f5d'
         '7c97fd3a8adbe86d29ca92fed57a99b406f12cd742baf091a686c3dffcb6af837b3944299ca30e96ba041db851effee58df30d9eafef2abc967f4b7eb4c26c12'
         '52e9b37eaf29f24d3f10b29813b7bc36bb984ab55d20422b4d4b0df93ba19b62835081c4f261cf3c78d80baf973d9568fa6b910df17a07caeac098b2efe624fa'

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 19:12:35	Medium	1
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 09:16:51	Medium	1
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2