pgadmin4-server

MEDIUM

maintainer higorslva 17 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package installs a prebuilt Debian binary from a non-standard but project-official host (ftp.postgresql.org), which is a supply-chain risk due to unverifiable origin; however, it is not actively malicious as the source is from the official project infrastructure.

Triggered rules

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:44 ./venv/bin/python -m pip install --upgrade pip setuptools wheel
PKGBUILD:45 ./venv/bin/python -m pip install --no-cache-dir -r "${srcdir}/requirements-${pkgver}.txt"

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}-1.noble_amd64.deb"

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt Debian binary from a non-standard but project-official host (ftp.postgresql.org), which is a supply-chain risk due to unverifiable origin; however, it is not actively malicious as the source is from the official project infrastructure.

PKGBUILD

3 offending line(s) highlighted

      1# Original Maintainer: bko <aur at bil dot co dot ua>
    
      2# Maintainer: higorslva <higor.slva at outlook dot com>
    
      3
    
      4pkgname=pgadmin4-server
    
      5pkgver=9.18
    
      6pkgrel=1
    
      7pkgdesc='The core server package for pgAdmin (binary from Ubuntu). pgAdmin is the most popular administration platform for PostgreSQL.'
    
      8arch=('x86_64')
    
      9url='https://www.pgadmin.org/'
    
      10license=('PostgreSQL')
    
      11makedepends=('python-pip' 'libarchive' 'tar' 'zstd')
    
      12depends=('python' 'libedit' 'krb5' 'sqlite' 'postgresql-libs')
    
      13
    
      14# The requirements URL points to the released tag, with '.' replaced by '_' in the version
    
      15source=(
    
      16  "pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}-1.noble_amd64.deb"
    
      17  "requirements-${pkgver}.txt::https://raw.githubusercontent.com/pgadmin-org/pgadmin4/refs/tags/REL-${pkgver//./_}/requirements.txt"
    
      18)
    
      19
    
      20# Real SHA256 of the pinned requirements file (maintained by the update script)
    
      21sha256sums=(
    
      22  '242ff77edfa1a380fdbd26bab10495608ecfc9d9332b503ec3b37b909160c12c'
    
      23  'a4927028b94ac02664c1184c70f9c13e3f155d7a7c164f4ff9e7c117635abcbf'
    
      24)
    
      25
    
      26prepare() {
    
      27  msg2 "Extracting the debian package..."
    
      28  mkdir -p "${srcdir}/deb-content"
    
      29  
    
      30  bsdtar -xf "pgadmin4-server-${pkgver}-x86_64.deb" -C "${srcdir}"
    
      31  tar -x --zstd -f "${srcdir}/data.tar.zst" -C "${srcdir}/deb-content"
    
      32
    
      33  sed -i "s|ALLOW_SAVE_TUNNEL_PASSWORD = False|ALLOW_SAVE_TUNNEL_PASSWORD = True|" "${srcdir}/deb-content/usr/pgadmin4/web/config.py"
    
      34}
    
      35
    
      36build() {
    
      37  msg2 "Creating isolated Python virtual environment..."
    
      38  cd "${srcdir}/deb-content/usr/pgadmin4"
    
      39  
    
      40  rm -rf venv
    
      41  python -m venv venv
    
      42
    
      43  msg2 "Installing dependencies via pip (exact version ${pkgver})..."
    
      44  ./venv/bin/python -m pip install --upgrade pip setuptools wheel
    
      45  ./venv/bin/python -m pip install --no-cache-dir -r "${srcdir}/requirements-${pkgver}.txt"
    
      46}
    
      47
    
      48package() {
    
      49  msg2 "Installing files into the package..."
    
      50  cp -r "${srcdir}/deb-content/usr" "${pkgdir}/"
    
      51
    
      52  msg2 "Safely cleaning absolute VENV paths..."
    
      53  ln -sf python "${pkgdir}/usr/pgadmin4/venv/bin/python3"
    
      54  
    
      55  # Only alter text files inside the virtual environment
    
      56  find "${pkgdir}/usr/pgadmin4/venv/bin" -type f -executable -exec grep -Il '' {} + | xargs sed -i "s|${srcdir}/deb-content||g"
    
      57  
    
      58  install -dm755 "${pkgdir}/var/lib/pgadmin"
    
      59  install -dm755 "${pkgdir}/var/log/pgadmin"
    
      60}

Changes since previous scan

--- PKGBUILD @ 2026-10-30 00:29
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,59 +1,60 @@
+# Original Maintainer: bko <aur at bil dot co dot ua>
+# Maintainer: higorslva <higor.slva at outlook dot com>
+
 pkgname=pgadmin4-server
-pkgver=9.14
+pkgver=9.18
 pkgrel=1
-pkgdesc='The core server package for pgAdmin. pgAdmin is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world.'
+pkgdesc='The core server package for pgAdmin (binary from Ubuntu). pgAdmin is the most popular administration platform for PostgreSQL.'
 arch=('x86_64')
+url='https://www.pgadmin.org/'
 license=('PostgreSQL')
-url='https://www.pgadmin.org/'
-depends=('postgresql-libs' 'krb5' 'python-dbus')
-makedepends=("python" "python-pip" "postgresql-libs" "gcc" "nodejs" "corepack" "pkgconf" "cmake" "dbus" "npm" "wget" "unzip" "syft" "patch")
-provides=('pgadmin4-server')
-source=("pgadmin4-${pkgver}.tar.gz::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/v${pkgver}/source/pgadmin4-${pkgver}.tar.gz"
-  "server.patch")
-sha256sums=('b8ebfa7afe41da6c2e46c12ae53e5cbbe3b3864cd91e8d5b0d79fdc51ff5c9d3'
-  'd276423ab3eaa7abaf14e720c51f49cc18a528d2e1b6324d4d05257d5d58f556')
+makedepends=('python-pip' 'libarchive' 'tar' 'zstd')
+depends=('python' 'libedit' 'krb5' 'sqlite' 'postgresql-libs')
+
+# The requirements URL points to the released tag, with '.' replaced by '_' in the version
+source=(
+  "pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}-1.noble_amd64.deb"
+  "requirements-${pkgver}.txt::https://raw.githubusercontent.com/pgadmin-org/pgadmin4/refs/tags/REL-${pkgver//./_}/requirements.txt"
+)
+
+# Real SHA256 of the pinned requirements file (maintained by the update script)
+sha256sums=(
+  '242ff77edfa1a380fdbd26bab10495608ecfc9d9332b503ec3b37b909160c12c'
+  'a4927028b94ac02664c1184c70f9c13e3f155d7a7c164f4ff9e7c117635abcbf'
+)
 
 prepare() {
-  cd "$srcdir/pgadmin4-${pkgver}"
-  patch -p1 <"../server.patch"
+  msg2 "Extracting the debian package..."
+  mkdir -p "${srcdir}/deb-content"
+  
+  bsdtar -xf "pgadmin4-server-${pkgver}-x86_64.deb" -C "${srcdir}"
+  tar -x --zstd -f "${srcdir}/data.tar.zst" -C "${srcdir}/deb-content"
+
+  sed -i "s|ALLOW_SAVE_TUNNEL_PASSWORD = False|ALLOW_SAVE_TUNNEL_PASSWORD = True|" "${srcdir}/deb-content/usr/pgadmin4/web/config.py"
 }
 
 build() {
-  cd "$srcdir/pgadmin4-${pkgver}"
+  msg2 "Creating isolated Python virtual environment..."
+  cd "${srcdir}/deb-content/usr/pgadmin4"
+  
+  rm -rf venv
+  python -m venv venv
 
-  export COREPACK_HOME="$srcdir/corepack_home"
-  mkdir -p "$COREPACK_HOME/bin"
-  corepack enable --install-directory "$COREPACK_HOME/bin"
-  export PATH="$COREPACK_HOME/bin:$PATH"
-  export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
-  corepack prepare yarn@stable --activate
-
-  pushd . && cd web
-  yarn install && yarn run bundle
-  popd
-  python -m venv venv
-  venv/bin/python3 -m pip install --no-cache-dir -r requirements.txt
-  venv/bin/python3 -m pip install --no-cache-dir sphinx sphinxcontrib-youtube
-  source venv/bin/activate
-
-  export PYTHONDONTWRITEBYTECODE=1
-
-  source pkg/linux/build-functions.sh
-
-  _setup_env "${PWD}/pkg/linux/DUMMY" "arch"
-  _cleanup "pkg.tar.zst"
-  _setup_dirs
-  _create_python_virtualenv "arch"
-  _build_docs "arch"
-  _copy_code "arch"
-  _generate_sbom
+  msg2 "Installing dependencies via pip (exact version ${pkgver})..."
+  ./venv/bin/python -m pip install --upgrade pip setuptools wheel
+  ./venv/bin/python -m pip install --no-cache-dir -r "${srcdir}/requirements-${pkgver}.txt"
 }
 
 package() {
-  cp -r "${srcdir}/pgadmin4-${pkgver}/arch-build/server/usr"  "${pkgdir}/"
+  msg2 "Installing files into the package..."
+  cp -r "${srcdir}/deb-content/usr" "${pkgdir}/"
 
-  # Install license
-  install -Dm644 "$srcdir/pgadmin4-${pkgver}/LICENSE" \
-    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+  msg2 "Safely cleaning absolute VENV paths..."
+  ln -sf python "${pkgdir}/usr/pgadmin4/venv/bin/python3"
+  
+  # Only alter text files inside the virtual environment
+  find "${pkgdir}/usr/pgadmin4/venv/bin" -type f -executable -exec grep -Il '' {} + | xargs sed -i "s|${srcdir}/deb-content||g"
+  
+  install -dm755 "${pkgdir}/var/lib/pgadmin"
+  install -dm755 "${pkgdir}/var/log/pgadmin"
 }
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	4
2026-10-31 19:58:49	Medium	4
2026-10-31 00:07:41	Medium	4
2026-10-30 03:55:04	Medium	4
2026-10-30 00:29:30	Low	4
2026-10-29 00:13:55	Low	4
2026-10-28 00:06:54	Low	4
2026-10-27 00:23:28	Low	4
2026-10-26 00:12:40	Low	4
2026-10-25 00:20:48	Low	4
2026-10-24 00:14:55	Low	4
2026-10-23 00:02:19	Low	4
2026-10-22 00:13:10	Low	4
2026-10-21 00:12:50	Low	4
2026-10-20 00:10:31	Low	4
2026-10-19 13:25:12	Medium	3
2026-10-19 00:03:55	Low	4
2026-10-18 23:23:07	Medium	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3