mssql-server

MEDIUM

maintainer too 31 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt Debian package from Microsoft's official Ubuntu repository, which is a trusted source for this software; however, the use of a non-standard host (ubuntu/24.04 path on packages.microsoft.com) triggers a medium severity flag due to potential supply-chain risk if the host were compromised, though the checksums are verified and the source is legitimate for this package.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:28 source=("https://packages.microsoft.com/ubuntu/24.04/mssql-server-2025/pool/main/m/${pkgname}/${_debfile}"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Debian package from Microsoft's official Ubuntu repository, which is a trusted source for this software; however, the use of a non-standard host (ubuntu/24.04 path on packages.microsoft.com) triggers a medium severity flag due to potential supply-chain risk if the host were compromised, though the checksums are verified and the source is legitimate for this package.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: too <turecki@gmail.com>
    
      2# Maintainer: DoctorZeus(Dan) <contact@techtonicsoftware.com>
    
      3# Contributor: Gabriel Morrison Lima Dantas <gabrielmldantas@gmail.com>
    
      4# Contributor: Aleksey Kamenskikh <aleksey.kamenskikh@gmail.com>
    
      5pkgname=mssql-server
    
      6pkgver=17.0.5035.5
    
      7_remRevision=3
    
      8_prodver=${pkgver}-${_remRevision}
    
      9pkgrel=1
    
      10pkgdesc="Microsoft SQL Server 2025 for Linux"
    
      11arch=('x86_64')
    
      12# Prebuilt Microsoft binaries: never strip them (it breaks crash-dump
    
      13# symbolication) and do not try to split a debug package out of them.
    
      14options=('!strip' '!debug')
    
      15url="https://learn.microsoft.com/en-us/sql/linux/sql-server-linux-overview?view=sql-server-ver17"
    
      16license=('LicenseRef-Microsoft-SQL-Server-EULA')
    
      17
    
      18# Upstream ships identical payloads for every distro; only the build's link-time
    
      19# dependencies differ. The Ubuntu 24.04 build is the one that matches Arch:
    
      20#   - RHEL 8/9/10 builds need EVP_md2, which Arch's openssl does not provide
    
      21#     (MD2 is a RHEL-only patch), so sqlservr dies at startup with
    
      22#     "undefined symbol: EVP_md2, version OPENSSL_3.0.0".
    
      23#   - The Ubuntu 22.04 build needs libldap-2.5.so.0 / liblber-2.5.so.0.
    
      24#   - The Ubuntu 24.04 build links libssl.so.3, libcrypto.so.3, libldap.so.2 and
    
      25#     liblber.so.2 exactly as Arch ships them, so no bundled or legacy TLS/LDAP
    
      26#     libraries and no AUR-only dependencies are needed.
    
      27_debfile="${pkgname}_${_prodver}_amd64.deb"
    
      28source=("https://packages.microsoft.com/ubuntu/24.04/mssql-server-2025/pool/main/m/${pkgname}/${_debfile}"
    
      29        "${pkgname}.sysusers")
    
      30noextract=("${_debfile}")
    
      31sha256sums=('ff7b9be8555cec33bb647e4cc4590bff1ded75b2714cb296a78e03858f67f119'
    
      32            '92e34c7fbbb1fd9860fae32a54f4374b660e7834fca85b0afc626bc19157d71f')
    
      33
    
      34# Everything below is linked directly by /opt/mssql/bin/sqlservr, except python
    
      35# (mssql-conf) and tzdata (AT TIME ZONE). libc++, libc++abi, libunwind and
    
      36# liburing are bundled by upstream in /opt/mssql/lib and are intentionally not
    
      37# listed. No dependency here lives outside the official repositories.
    
      38depends=(
    
      39	'glibc'
    
      40	'libgcc'
    
      41	'libstdc++'
    
      42	'libatomic'
    
      43	'openssl'
    
      44	'krb5'
    
      45	'e2fsprogs'
    
      46	'libldap'
    
      47	'numactl'
    
      48	'pam'
    
      49	'sssd'
    
      50	'systemd-libs'
    
      51	'util-linux-libs'
    
      52	'python'
    
      53	'tzdata'
    
      54)
    
      55
    
      56optdepends=(
    
      57	'gdb: capture core dumps when the engine crashes'
    
      58	'lsof: extra diagnostics in the crash handler'
    
      59	'cyrus-sasl-gssapi: SASL/GSSAPI (Active Directory) authentication'
    
      60	'python-pyodbc: external script / extensibility features'
    
      61	'debugedit: symbol handling for crash dumps'
    
      62)
    
      63
    
      64install=$pkgname.install
    
      65
    
      66prepare() {
    
      67	# makepkg unpacks the ar archive but will not recurse into the payload
    
      68	# member, so do that by hand. Do not hardcode the compression suffix.
    
      69	local _payload
    
      70	_payload=$(bsdtar -tf "$srcdir/$_debfile" | grep -m1 '^data\.tar\.')
    
      71	[ -n "$_payload" ] || { echo "no data.tar.* member in $_debfile" >&2; return 1; }
    
      72	bsdtar -xOf "$srcdir/$_debfile" "$_payload" | bsdtar -xf - -C "$srcdir"
    
      73}
    
      74
    
      75package() {
    
      76	cp -a "$srcdir/opt" "$pkgdir/opt"
    
      77	cp -a "$srcdir/usr" "$pkgdir/usr"
    
      78
    
      79	# Debian ships these gzipped; drop the Debian-only changelog.
    
      80	rm -f "$pkgdir/usr/share/doc/$pkgname/changelog.Debian.gz"
    
      81	find "$pkgdir/usr/share/doc/$pkgname" -name '*.gz' -exec gunzip {} +
    
      82
    
      83	install -Dm644 "$srcdir/$pkgname.sysusers" \
    
      84		"$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      85
    
      86	install -Dm644 "$pkgdir/usr/share/doc/$pkgname/license/1033/license.txt" \
    
      87		"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      88
    
      89	chmod 644 "$pkgdir/usr/lib/systemd/system/$pkgname.service"
    
      90}
    
      91

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -3,8 +3,8 @@
 # Contributor: Gabriel Morrison Lima Dantas <gabrielmldantas@gmail.com>
 # Contributor: Aleksey Kamenskikh <aleksey.kamenskikh@gmail.com>
 pkgname=mssql-server
-pkgver=17.0.5005.3
-_remRevision=1
+pkgver=17.0.5035.5
+_remRevision=3
 _prodver=${pkgver}-${_remRevision}
 pkgrel=1
 pkgdesc="Microsoft SQL Server 2025 for Linux"
@@ -28,7 +28,7 @@
 source=("https://packages.microsoft.com/ubuntu/24.04/mssql-server-2025/pool/main/m/${pkgname}/${_debfile}"
         "${pkgname}.sysusers")
 noextract=("${_debfile}")
-sha256sums=('2494143ed6b9921c078e56c0c3877e5014d6a998fc19957fe6857a34a737061e'
+sha256sums=('ff7b9be8555cec33bb647e4cc4590bff1ded75b2714cb296a78e03858f67f119'
             '92e34c7fbbb1fd9860fae32a54f4374b660e7834fca85b0afc626bc19157d71f')
 
 # Everything below is linked directly by /opt/mssql/bin/sqlservr, except python

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 15:52:51	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2