mongodb-compass-beta-bin
LOW
maintainer dpeukert
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt RPM from MongoDB's official download domain, which is a plausible project-owned host despite not being on the standard whitelist; the source is verified via b2sum, and the package installs only the official MongoDB Compass binary without executing unreviewed remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt RPM from MongoDB's official download domain, which is a plausible project-owned host despite not being on the standard whitelist; the source is verified via b2sum, and the package installs only the official MongoDB Compass binary without executing unreviewed remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:27
"$pkgname-$pkgver.rpm::https://downloads.mongodb.com/compass/$_betaprefix$_pkgname-$_pkgver.x86_64.rpm"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Daniel Peukert <daniel@peukert.cc>
2
# Maintainer: "Amhairghin" Oscar Garcia Amor (https://ogarcia.me)
3
_pkgname='mongodb-compass-beta'
4
_edition=' Beta'
5
pkgname="$_pkgname-bin"
6
_pkgver='1.49.11-beta.1'
7
pkgver="$(printf '%s' "$_pkgver" | tr '-' '.')"
8
pkgrel='1'
9
pkgdesc='The official GUI for MongoDB - beta version - binary version'
10
arch=('x86_64')
11
url='https://www.mongodb.com/products/compass'
12
license=('SSPL-1.0')
13
depends=(
14
# electron
15
'c-ares' 'dav1d' 'flac' 'fontconfig' 'freetype2' 'gcc-libs' 'glibc' 'gtk3'
16
'harfbuzz' 'icu' 'libdrm' 'libevent' 'libffi' 'libjpeg-turbo' 'libpng' 'libpulse'
17
'libwebp' 'libxml2' 'libxslt' 'minizip' 'nss' 'opus' 'zlib'
18
# compass
19
'krb5' 'libsecret'
20
)
21
optdepends=('org.freedesktop.secrets')
22
options=('!debug')
23
provides=("$_pkgname=$pkgver")
24
conflicts=("$_pkgname")
25
_betaprefix="$([[ "$_pkgname" =~ -beta$ ]] && printf 'beta/' || printf '')"
26
source=(
27
"$pkgname-$pkgver.rpm::https://downloads.mongodb.com/compass/$_betaprefix$_pkgname-$_pkgver.x86_64.rpm"
28
)
29
b2sums=('7b2b58332fe1c5aed517e4ca03252a9a328ce926c677ba1ff20d062ae2be8d8f89dd9c713ae8c8561eaae7d23d8b5cda6d53f733c9364c8847bad16a245b11cc')
30
31
check() {
32
_checkoutput="$(ELECTRON_OZONE_PLATFORM_HINT='auto' "$srcdir/usr/lib/$_pkgname/MongoDB Compass$_edition" --no-sandbox --version)"
33
printf '%s\n' "$_checkoutput"
34
printf '%s\n' "$_checkoutput" | grep -q "^MongoDB Compass$_edition $pkgver$"
35
}
36
37
package() {
38
cd "$srcdir/"
39
40
install -dm755 "$pkgdir/usr/lib/"
41
cp -r "usr/lib/$_pkgname/" "$pkgdir/usr/lib/$_pkgname/"
42
43
# Fix permissions
44
find "$pkgdir" -type d -exec chmod 755 {} +
45
find "$pkgdir" -type f -exec chmod 644 {} +
46
chmod +x "$pkgdir/usr/lib/$_pkgname/chrome_crashpad_handler"
47
chmod +x "$pkgdir/usr/lib/$_pkgname/chrome-sandbox"
48
chmod +x "$pkgdir/usr/lib/$_pkgname/MongoDB Compass$_edition"
49
50
install -dm755 "$pkgdir/usr/bin/"
51
ln -sf "/usr/lib/$_pkgname/MongoDB Compass$_edition" "$pkgdir/usr/bin/$_pkgname"
52
53
install -Dm644 "usr/share/applications/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
54
install -Dm644 "usr/share/pixmaps/$_pkgname.png" "$pkgdir/usr/share/pixmaps/$_pkgname.png"
55
56
install -dm755 "$pkgdir/usr/share/licenses/$pkgname/"
57
58
ln -sf "/usr/lib/$_pkgname/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/SSPL-1.0"
59
ln -sf "/usr/lib/$_pkgname/LICENSES.chromium.html" "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
60
}
61
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |