pgadmin4-desktop

LOW

maintainer higorslva 21 votes scanned 2026-10-19 00:03:55.276608

View on AUR

Why flagged

The package builds from a source tarball hosted on the official PostgreSQL project infrastructure, which is trustworthy; the non-whitelisted host is a false positive as ftp.postgresql.org is a legitimate and expected source for this software, and the build process is transparent and follows standard practices without executing untrusted code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a source tarball hosted on the official PostgreSQL project infrastructure, which is trustworthy; the non-whitelisted host is a false positive as ftp.postgresql.org is a legitimate and expected source for this software, and the build process is transparent and follows standard practices without executing untrusted code.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("pgadmin4-${pkgver}.tar.gz::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/v${pkgver}/source/pgadmin4-${pkgver}.tar.gz")

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=pgadmin4-desktop
    
      2pkgver=9.14
    
      3pkgrel=1
    
      4pkgdesc='The desktop user interface for pgAdmin. pgAdmin is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world.'
    
      5arch=('x86_64')
    
      6license=('PostgreSQL')
    
      7url='https://www.pgadmin.org/'
    
      8depends=("pgadmin4-server>=${pkgver}-1" 'xdg-utils' 'python-dbus')
    
      9makedepends=("nodejs" "corepack" "npm" "wget" "unzip" "syft")
    
      10provides=('pgadmin4-desktop')
    
      11source=("pgadmin4-${pkgver}.tar.gz::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/v${pkgver}/source/pgadmin4-${pkgver}.tar.gz")
    
      12sha256sums=('b8ebfa7afe41da6c2e46c12ae53e5cbbe3b3864cd91e8d5b0d79fdc51ff5c9d3')
    
      13
    
      14build() {
    
      15  cd "$srcdir/pgadmin4-${pkgver}"
    
      16
    
      17  export COREPACK_HOME="$srcdir/corepack_home"
    
      18  mkdir -p "$COREPACK_HOME/bin"
    
      19  corepack enable --install-directory "$COREPACK_HOME/bin"
    
      20  export PATH="$COREPACK_HOME/bin:$PATH"
    
      21  export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
    
      22  corepack prepare yarn@stable --activate
    
      23
    
      24  source pkg/linux/build-functions.sh
    
      25
    
      26  _setup_env "${PWD}/pkg/linux/DUMMY" "arch"
    
      27  _cleanup "pkg.tar.zst"
    
      28  _setup_dirs
    
      29  _build_runtime
    
      30  syft "${DESKTOPROOT}/" -o cyclonedx-json > "${DESKTOPROOT}/usr/${APP_NAME}/sbom-desktop.json"
    
      31}
    
      32
    
      33package() {
    
      34  cp -r "${srcdir}/pgadmin4-${pkgver}/arch-build/desktop/usr" "${pkgdir}/"
    
      35
    
      36  # no need to install the license, since pgadmin4-server has already done it
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 00:03:55	Low	3
2026-10-18 23:23:07	Medium	2
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1