mssql-server

LOW

maintainer too 32 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt Microsoft .deb from an official Microsoft domain (packages.microsoft.com) for a supported Ubuntu version; while the host is not a typical AUR source, it is Microsoft's own distribution infrastructure, and the binary is expected to be identical across distributions with only link-time dependencies differing.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Microsoft .deb from an official Microsoft domain (packages.microsoft.com) for a supported Ubuntu version; while the host is not a typical AUR source, it is Microsoft's own distribution infrastructure, and the binary is expected to be identical across distributions with only link-time dependencies differing.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 source=("https://packages.microsoft.com/ubuntu/24.04/mssql-server-2025/pool/main/m/${pkgname}/${_debfile}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: too <turecki@gmail.com>
    
      2# Maintainer: DoctorZeus(Dan) <contact@techtonicsoftware.com>
    
      3# Contributor: Gabriel Morrison Lima Dantas <gabrielmldantas@gmail.com>
    
      4# Contributor: Aleksey Kamenskikh <aleksey.kamenskikh@gmail.com>
    
      5pkgname=mssql-server
    
      6pkgver=17.0.4085.5
    
      7_remRevision=1
    
      8_prodver=${pkgver}-${_remRevision}
    
      9pkgrel=1
    
      10pkgdesc="Microsoft SQL Server 2025 for Linux"
    
      11arch=('x86_64')
    
      12# Prebuilt Microsoft binaries: never strip them (it breaks crash-dump
    
      13# symbolication) and do not try to split a debug package out of them.
    
      14options=('!strip' '!debug')
    
      15url="https://learn.microsoft.com/en-us/sql/linux/sql-server-linux-overview?view=sql-server-ver17"
    
      16license=('LicenseRef-Microsoft-SQL-Server-EULA')
    
      17
    
      18# Upstream ships identical payloads for every distro; only the build's link-time
    
      19# dependencies differ. The Ubuntu 24.04 build is the one that matches Arch:
    
      20#   - RHEL 8/9/10 builds need EVP_md2, which Arch's openssl does not provide
    
      21#     (MD2 is a RHEL-only patch), so sqlservr dies at startup with
    
      22#     "undefined symbol: EVP_md2, version OPENSSL_3.0.0".
    
      23#   - The Ubuntu 22.04 build needs libldap-2.5.so.0 / liblber-2.5.so.0.
    
      24#   - The Ubuntu 24.04 build links libssl.so.3, libcrypto.so.3, libldap.so.2 and
    
      25#     liblber.so.2 exactly as Arch ships them, so no bundled or legacy TLS/LDAP
    
      26#     libraries and no AUR-only dependencies are needed.
    
      27_debfile="${pkgname}_${_prodver}_amd64.deb"
    
      28source=("https://packages.microsoft.com/ubuntu/24.04/mssql-server-2025/pool/main/m/${pkgname}/${_debfile}"
    
      29        "${pkgname}.sysusers")
    
      30noextract=("${_debfile}")
    
      31sha256sums=('ed3c98104b67a331b8a12dad713f64bb0cbff4aa719584d5459ae728032c2223'
    
      32            '92e34c7fbbb1fd9860fae32a54f4374b660e7834fca85b0afc626bc19157d71f')
    
      33
    
      34# Everything below is linked directly by /opt/mssql/bin/sqlservr, except python
    
      35# (mssql-conf) and tzdata (AT TIME ZONE). libc++, libc++abi, libunwind and
    
      36# liburing are bundled by upstream in /opt/mssql/lib and are intentionally not
    
      37# listed. No dependency here lives outside the official repositories.
    
      38depends=(
    
      39	'glibc'
    
      40	'libgcc'
    
      41	'libstdc++'
    
      42	'libatomic'
    
      43	'openssl'
    
      44	'krb5'
    
      45	'e2fsprogs'
    
      46	'libldap'
    
      47	'numactl'
    
      48	'pam'
    
      49	'sssd'
    
      50	'systemd-libs'
    
      51	'util-linux-libs'
    
      52	'python'
    
      53	'tzdata'
    
      54)
    
      55
    
      56optdepends=(
    
      57	'gdb: capture core dumps when the engine crashes'
    
      58	'lsof: extra diagnostics in the crash handler'
    
      59	'cyrus-sasl-gssapi: SASL/GSSAPI (Active Directory) authentication'
    
      60	'python-pyodbc: external script / extensibility features'
    
      61	'debugedit: symbol handling for crash dumps'
    
      62)
    
      63
    
      64install=$pkgname.install
    
      65
    
      66prepare() {
    
      67	# makepkg unpacks the ar archive but will not recurse into the payload
    
      68	# member, so do that by hand. Do not hardcode the compression suffix.
    
      69	local _payload
    
      70	_payload=$(bsdtar -tf "$srcdir/$_debfile" | grep -m1 '^data\.tar\.')
    
      71	[ -n "$_payload" ] || { echo "no data.tar.* member in $_debfile" >&2; return 1; }
    
      72	bsdtar -xOf "$srcdir/$_debfile" "$_payload" | bsdtar -xf - -C "$srcdir"
    
      73}
    
      74
    
      75package() {
    
      76	cp -a "$srcdir/opt" "$pkgdir/opt"
    
      77	cp -a "$srcdir/usr" "$pkgdir/usr"
    
      78
    
      79	# Debian ships these gzipped; drop the Debian-only changelog.
    
      80	rm -f "$pkgdir/usr/share/doc/$pkgname/changelog.Debian.gz"
    
      81	find "$pkgdir/usr/share/doc/$pkgname" -name '*.gz' -exec gunzip {} +
    
      82
    
      83	install -Dm644 "$srcdir/$pkgname.sysusers" \
    
      84		"$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      85
    
      86	install -Dm644 "$pkgdir/usr/share/doc/$pkgname/license/1033/license.txt" \
    
      87		"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      88
    
      89	chmod 644 "$pkgdir/usr/lib/systemd/system/$pkgname.service"
    
      90}
    
      91

Changes since previous scan

--- PKGBUILD @ 2026-09-13 09:14
+++ PKGBUILD @ 2026-09-17 00:27
@@ -3,54 +3,89 @@
 # Contributor: Gabriel Morrison Lima Dantas <gabrielmldantas@gmail.com>
 # Contributor: Aleksey Kamenskikh <aleksey.kamenskikh@gmail.com>
 pkgname=mssql-server
-pkgver=16.0.4225.2
-_remRevision=2
+pkgver=17.0.4085.5
+_remRevision=1
 _prodver=${pkgver}-${_remRevision}
 pkgrel=1
-pkgdesc="Microsoft SQL Server for Linux"
+pkgdesc="Microsoft SQL Server 2025 for Linux"
 arch=('x86_64')
-url="https://learn.microsoft.com/en-us/sql/linux/sql-server-linux-overview?view=sql-server-ver16"
-license=('unknown')
+# Prebuilt Microsoft binaries: never strip them (it breaks crash-dump
+# symbolication) and do not try to split a debug package out of them.
+options=('!strip' '!debug')
+url="https://learn.microsoft.com/en-us/sql/linux/sql-server-linux-overview?view=sql-server-ver17"
+license=('LicenseRef-Microsoft-SQL-Server-EULA')
+
+# Upstream ships identical payloads for every distro; only the build's link-time
+# dependencies differ. The Ubuntu 24.04 build is the one that matches Arch:
+#   - RHEL 8/9/10 builds need EVP_md2, which Arch's openssl does not provide
+#     (MD2 is a RHEL-only patch), so sqlservr dies at startup with
+#     "undefined symbol: EVP_md2, version OPENSSL_3.0.0".
+#   - The Ubuntu 22.04 build needs libldap-2.5.so.0 / liblber-2.5.so.0.
+#   - The Ubuntu 24.04 build links libssl.so.3, libcrypto.so.3, libldap.so.2 and
+#     liblber.so.2 exactly as Arch ships them, so no bundled or legacy TLS/LDAP
+#     libraries and no AUR-only dependencies are needed.
+_debfile="${pkgname}_${_prodver}_amd64.deb"
+source=("https://packages.microsoft.com/ubuntu/24.04/mssql-server-2025/pool/main/m/${pkgname}/${_debfile}"
+        "${pkgname}.sysusers")
+noextract=("${_debfile}")
+sha256sums=('ed3c98104b67a331b8a12dad713f64bb0cbff4aa719584d5459ae728032c2223'
+            '92e34c7fbbb1fd9860fae32a54f4374b660e7834fca85b0afc626bc19157d71f')
+
+# Everything below is linked directly by /opt/mssql/bin/sqlservr, except python
+# (mssql-conf) and tzdata (AT TIME ZONE). libc++, libc++abi, libunwind and
+# liburing are bundled by upstream in /opt/mssql/lib and are intentionally not
+# listed. No dependency here lives outside the official repositories.
 depends=(
-	'libatomic_ops'
-	'libunwind'
-	'numactl' 
 	'glibc'
-	'libc++'
-	'gdb'
-	'openssl-1.1'
+	'libgcc'
+	'libstdc++'
+	'libatomic'
+	'openssl'
 	'krb5'
-	'nss'
+	'e2fsprogs'
+	'libldap'
+	'numactl'
+	'pam'
 	'sssd'
-	'gawk'
-	'sed'
-	'pam'
-	'libldap24'
-);
+	'systemd-libs'
+	'util-linux-libs'
+	'python'
+	'tzdata'
+)
+
 optdepends=(
-	'python-pyodbc'
-	'debugedit'
-);
-
-#This is a local azure instance that resolves as an alias of "packages.microsoft.com/rhel/8/mssql-server-2022" as some regions have different dir structures
-source=("https://pmc-prod-afd-endpoint-evdhh8f8byhsezfp.b01.azurefd.net/rhel/8/mssql-server-2022/Packages/m/${pkgname}-${_prodver}.x86_64.rpm")
-
-sha256sums=('852f3d2cda6660181ac54e76d6bbac559f9a79a77f42c7f67b103184a81a5ef3')
+	'gdb: capture core dumps when the engine crashes'
+	'lsof: extra diagnostics in the crash handler'
+	'cyrus-sasl-gssapi: SASL/GSSAPI (Active Directory) authentication'
+	'python-pyodbc: external script / extensibility features'
+	'debugedit: symbol handling for crash dumps'
+)
 
 install=$pkgname.install
 
-package() {
-
-	#Setup
-	cd $pkgdir
-	mv $srcdir/opt .
-	mv $srcdir/usr .
-
-	#Create links to non-breaking libssl and libcrypto libs
-	ln -sf /lib/libssl.so.1.1 $pkgdir/opt/mssql/lib/libssl.so
-	ln -sf /lib/libcrypto.so.1.1 $pkgdir/opt/mssql/lib/libcrypto.so
-
-	#Set systemd service file perms
-	chmod 644 $pkgdir/usr/lib/systemd/system/mssql-server.service
+prepare() {
+	# makepkg unpacks the ar archive but will not recurse into the payload
+	# member, so do that by hand. Do not hardcode the compression suffix.
+	local _payload
+	_payload=$(bsdtar -tf "$srcdir/$_debfile" | grep -m1 '^data\.tar\.')
+	[ -n "$_payload" ] || { echo "no data.tar.* member in $_debfile" >&2; return 1; }
+	bsdtar -xOf "$srcdir/$_debfile" "$_payload" | bsdtar -xf - -C "$srcdir"
 }
 
+package() {
+	cp -a "$srcdir/opt" "$pkgdir/opt"
+	cp -a "$srcdir/usr" "$pkgdir/usr"
+
+	# Debian ships these gzipped; drop the Debian-only changelog.
+	rm -f "$pkgdir/usr/share/doc/$pkgname/changelog.Debian.gz"
+	find "$pkgdir/usr/share/doc/$pkgname" -name '*.gz' -exec gunzip {} +
+
+	install -Dm644 "$srcdir/$pkgname.sysusers" \
+		"$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
+
+	install -Dm644 "$pkgdir/usr/share/doc/$pkgname/license/1033/license.txt" \
+		"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+
+	chmod 644 "$pkgdir/usr/lib/systemd/system/$pkgname.service"
+}
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 11:14:35	Medium	1
2026-09-13 09:14:07	Medium	1
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2