neo4j-community-bin (MEDIUM)

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "https://dist.neo4j.org/deb/neo4j_${pkgver}_all.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Glucy2 <glucy-2@outlook.com>
    
      2# Contributor: rubin55 <me@rubin55.org>
    
      3
    
      4_pkgname=neo4j-community
    
      5pkgname=${_pkgname}-bin
    
      6pkgver="2026.09.0"
    
      7pkgrel="1"
    
      8pkgdesc='A fully transactional graph database implemented in Java (binary package)'
    
      9license=('GPL-3.0-only')
    
      10arch=('any')
    
      11url="https://neo4j.com/deployment-center/#panel7"
    
      12_min_java_version="21"
    
      13depends=("java-runtime>=$_min_java_version" "psmisc")
    
      14provides=("${_pkgname}" "${_pkgname}=${pkgver}")
    
      15conflicts=("${_pkgname}" neo4j-enterprise)
    
      16source=(
    
      17    "https://dist.neo4j.org/deb/neo4j_${pkgver}_all.deb"
    
      18    "neo4j.sysusers"
    
      19    "neo4j.tmpfiles"
    
      20)
    
      21# https://dist.neo4j.org/deb/neo4j_${pkgver}_all.deb.sha256
    
      22sha256sums=('583b3b64fde62696d349e0aed6047e374e83695bf25ec3427dfa5eaac7a7f35a'
    
      23            '440874201629f436b3817be05d7f8240c9bef603a11dc0a125634287c0376b5d'
    
      24            'a4a12084b93c357adfc54d1c0736d710ff507418824e08e33cc1f30bdc8a67f8')
    
      25
    
      26package() {
    
      27    local data_archives=()
    
      28    local archive
    
      29    for archive in data.tar.xz data.tar.zst data.tar.gz; do
    
      30        [[ ! -f "$archive" ]] || data_archives+=("$archive")
    
      31    done
    
      32    if (( ${#data_archives[@]} != 1 )); then
    
      33        printf '%s\n' 'Expected exactly one data.tar.{xz,zst,gz}' >&2
    
      34        return 1
    
      35    fi
    
      36    bsdtar -xf "${data_archives[0]}" -C "${pkgdir}"
    
      37    install -Dm644 "$srcdir/neo4j.sysusers" "$pkgdir/usr/lib/sysusers.d/neo4j.conf"
    
      38    install -Dm644 "$srcdir/neo4j.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/neo4j.conf"
    
      39}
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-21 11:31
@@ -3,13 +3,13 @@
 
 _pkgname=neo4j-community
 pkgname=${_pkgname}-bin
-pkgver="2026.02.3"
-pkgrel=1
+pkgver="2026.09.0"
+pkgrel="1"
 pkgdesc='A fully transactional graph database implemented in Java (binary package)'
 license=('GPL-3.0-only')
 arch=('any')
 url="https://neo4j.com/deployment-center/#panel7"
-_min_java_version=21
+_min_java_version="21"
 depends=("java-runtime>=$_min_java_version" "psmisc")
 provides=("${_pkgname}" "${_pkgname}=${pkgver}")
 conflicts=("${_pkgname}" neo4j-enterprise)
@@ -19,14 +19,21 @@
     "neo4j.tmpfiles"
 )
 # https://dist.neo4j.org/deb/neo4j_${pkgver}_all.deb.sha256
-sha256sums=(
-    '7f7a56c7087d5be81446c31ad9c211a38682b2b1e303f0b9af8f1f7807812ddd'
-    '440874201629f436b3817be05d7f8240c9bef603a11dc0a125634287c0376b5d'
-    'a4a12084b93c357adfc54d1c0736d710ff507418824e08e33cc1f30bdc8a67f8'
-)
+sha256sums=('583b3b64fde62696d349e0aed6047e374e83695bf25ec3427dfa5eaac7a7f35a'
+            '440874201629f436b3817be05d7f8240c9bef603a11dc0a125634287c0376b5d'
+            'a4a12084b93c357adfc54d1c0736d710ff507418824e08e33cc1f30bdc8a67f8')
 
 package() {
-    bsdtar -xf data.tar.xz -C "${pkgdir}"
+    local data_archives=()
+    local archive
+    for archive in data.tar.xz data.tar.zst data.tar.gz; do
+        [[ ! -f "$archive" ]] || data_archives+=("$archive")
+    done
+    if (( ${#data_archives[@]} != 1 )); then
+        printf '%s\n' 'Expected exactly one data.tar.{xz,zst,gz}' >&2
+        return 1
+    fi
+    bsdtar -xf "${data_archives[0]}" -C "${pkgdir}"
     install -Dm644 "$srcdir/neo4j.sysusers" "$pkgdir/usr/lib/sysusers.d/neo4j.conf"
     install -Dm644 "$srcdir/neo4j.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/neo4j.conf"
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 11:31:16	Medium	1
2026-10-17 00:21:55	Clean	2
2026-10-16 09:15:55	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1