pgadmin4-server

maintainer evatakacs · 17 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the official PostgreSQL project source tarball hosted on ftp.postgresql.org, a legitimate and project-owned host, and installs only the project's own code and declared dependencies; the pip installs are part of the normal build process for the application's own requirements, not external or malicious packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official PostgreSQL project source tarball hosted on ftp.postgresql.org, a legitimate and project-owned host, and installs only the project's own code and declared dependencies; the pip installs are part of the normal build process for the application's own requirements, not external or malicious packages.

3 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:35 venv/bin/python3 -m pip install --no-cache-dir -r requirements.txt
PKGBUILD:36 venv/bin/python3 -m pip install --no-cache-dir sphinx sphinxcontrib-youtube

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("pgadmin4-${pkgver}.tar.gz::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/v${pkgver}/source/pgadmin4-${pkgver}.tar.gz"

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

3 offending line(s) highlighted

      1pkgname=pgadmin4-server
    
      2pkgver=9.14
    
      3pkgrel=1
    
      4pkgdesc='The core server package for pgAdmin. pgAdmin is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world.'
    
      5arch=('x86_64')
    
      6license=('PostgreSQL')
    
      7url='https://www.pgadmin.org/'
    
      8depends=('postgresql-libs' 'krb5' 'python-dbus')
    
      9makedepends=("python" "python-pip" "postgresql-libs" "gcc" "nodejs" "corepack" "pkgconf" "cmake" "dbus" "npm" "wget" "unzip" "syft" "patch")
    
      10provides=('pgadmin4-server')
    
      11source=("pgadmin4-${pkgver}.tar.gz::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/v${pkgver}/source/pgadmin4-${pkgver}.tar.gz"
    
      12  "server.patch")
    
      13sha256sums=('b8ebfa7afe41da6c2e46c12ae53e5cbbe3b3864cd91e8d5b0d79fdc51ff5c9d3'
    
      14  'd276423ab3eaa7abaf14e720c51f49cc18a528d2e1b6324d4d05257d5d58f556')
    
      15
    
      16prepare() {
    
      17  cd "$srcdir/pgadmin4-${pkgver}"
    
      18  patch -p1 <"../server.patch"
    
      19}
    
      20
    
      21build() {
    
      22  cd "$srcdir/pgadmin4-${pkgver}"
    
      23
    
      24  export COREPACK_HOME="$srcdir/corepack_home"
    
      25  mkdir -p "$COREPACK_HOME/bin"
    
      26  corepack enable --install-directory "$COREPACK_HOME/bin"
    
      27  export PATH="$COREPACK_HOME/bin:$PATH"
    
      28  export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
    
      29  corepack prepare yarn@stable --activate
    
      30
    
      31  pushd . && cd web
    
      32  yarn install && yarn run bundle
    
      33  popd
    
      34  python -m venv venv
    
      35  venv/bin/python3 -m pip install --no-cache-dir -r requirements.txt
    
      36  venv/bin/python3 -m pip install --no-cache-dir sphinx sphinxcontrib-youtube
    
      37  source venv/bin/activate
    
      38
    
      39  export PYTHONDONTWRITEBYTECODE=1
    
      40
    
      41  source pkg/linux/build-functions.sh
    
      42
    
      43  _setup_env "${PWD}/pkg/linux/DUMMY" "arch"
    
      44  _cleanup "pkg.tar.zst"
    
      45  _setup_dirs
    
      46  _create_python_virtualenv "arch"
    
      47  _build_docs "arch"
    
      48  _copy_code "arch"
    
      49  _generate_sbom
    
      50}
    
      51
    
      52package() {
    
      53  cp -r "${srcdir}/pgadmin4-${pkgver}/arch-build/server/usr"  "${pkgdir}/"
    
      54
    
      55  # Install license
    
      56  install -Dm644 "$srcdir/pgadmin4-${pkgver}/LICENSE" \
    
      57    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	4
2026-08-02 00:16:08	LOW	4
2026-08-01 00:11:18	LOW	4
2026-07-31 00:14:10	LOW	4
2026-07-30 00:17:23	LOW	4
2026-07-29 11:11:22	MEDIUM	3
2026-06-19 19:07:35	CLEAN	3
2026-06-18 16:11:54	MEDIUM	2