msodbcsql17

LOW

maintainer leo980 2 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt RPM from Microsoft's official package repository, which is a legitimate source for the driver; the non-whitelisted host is Microsoft's own domain, and the package installs only the official Microsoft ODBC driver with proper license and documentation, posing no active threat.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt RPM from Microsoft's official package repository, which is a legitimate source for the driver; the non-whitelisted host is Microsoft's own domain, and the package installs only the official Microsoft ODBC driver with proper license and documentation, posing no active threat.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(https://packages.microsoft.com/rhel/8/prod/msodbcsql17-$pkgver-1.x86_64.rpm)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Elmer Skjødt Henriksen <esh@fjerhammer.dk>
    
      2# Contributor: Massimiliano Torromeo <massimiliano.torromeo@gmail.com>
    
      3
    
      4pkgname=msodbcsql17
    
      5pkgver=17.10.2.1
    
      6pkgrel=1
    
      7pkgdesc="Microsoft® ODBC Driver 17 for SQL Server®"
    
      8arch=('x86_64')
    
      9url="https://techcommunity.microsoft.com/t5/sql-server-blog/bg-p/SQLServer/label-name/SQLServerDrivers"
    
      10license=('custom')
    
      11depends=('unixodbc' 'krb5' 'curl')
    
      12provides=("msodbcsql=${pkgver}")
    
      13options=('!strip')
    
      14source=(https://packages.microsoft.com/rhel/8/prod/msodbcsql17-$pkgver-1.x86_64.rpm)
    
      15sha256sums=('c3adf8bae5bc2f771c7d40b9805b38539294ad0b3a654bf9f3d40d93365a5f7d')
    
      16install=msodbcsql17.install
    
      17
    
      18package() {
    
      19  install -Dm0644 usr/share/doc/msodbcsql17/RELEASE_NOTES "$pkgdir"/usr/share/doc/$pkgname/RELEASE_NOTES
    
      20  install -Dm0644 usr/share/doc/msodbcsql17/LICENSE.txt "$pkgdir"/usr/share/licenses/$pkgname/LICENSE.txt
    
      21  mv opt "$pkgdir"
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	3
2026-10-31 00:07:41	Low	3
2026-10-30 00:29:30	Low	3
2026-10-29 00:13:55	Low	3
2026-10-28 00:06:54	Low	3
2026-10-27 00:23:28	Low	3
2026-10-26 00:12:40	Low	3
2026-10-25 00:20:48	Low	3
2026-10-24 00:14:55	Low	3
2026-10-23 00:02:19	Low	3
2026-10-22 03:33:54	Medium	2
2026-10-22 00:13:10	Low	3
2026-10-21 00:12:50	Low	3
2026-10-20 00:10:31	Low	3
2026-10-19 11:25:12	Medium	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2