pgadmin4-server-bin
MEDIUM
maintainer higorslva
4 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package installs a prebuilt .deb from an official but non-whitelisted PostgreSQL host and runs pip install on a requirements.txt fetched from GitHub without a checksum, creating a supply-chain risk if either source is compromised.
Triggered rules
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:31
"${pkgdir}/usr/pgadmin4/venv/bin/python" -m pip install --upgrade pip setuptools wheel
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
source=("pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}-1.noble_amd64.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt .deb from an official but non-whitelisted PostgreSQL host and runs pip install on a requirements.txt fetched from GitHub without a checksum, creating a supply-chain risk if either source is compromised.
PKGBUILD
2 offending line(s) highlighted
1
# Original Maintainer: bko <aur at bil dot co dot ua>
2
# Maintainer: higorslva <higor.slva at outlook dot com>
3
4
pkgname=pgadmin4-server-bin
5
pkgver=9.17
6
pkgrel=1
7
pkgdesc='The core server package for pgAdmin. pgAdmin is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world.'
8
arch=('x86_64')
9
license=('PostgreSQL')
10
makedepends=('python-pip')
11
depends=('python' 'libedit' 'krb5' 'sqlite' 'postgresql-libs')
12
provides=('pgadmin4-server')
13
conflicts=('pgadmin4-server')
14
source=("pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}-1.noble_amd64.deb"
15
"requirements.txt::https://raw.githubusercontent.com/pgadmin-org/pgadmin4/refs/heads/master/requirements.txt")
16
#source=("pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}_amd64.deb")
17
sha256sums=('cec06cafd20b5d13f6dec3e767e46e4359f3620cc6ddb6449800c43a65971fc4'
18
'SKIP')
19
20
package() {
21
# Extract package data
22
tar -x --zstd -f data.tar.zst -C "${pkgdir}"
23
sed -i "s|ALLOW_SAVE_TUNNEL_PASSWORD = False|ALLOW_SAVE_TUNNEL_PASSWORD = True|" "${pkgdir}/usr/pgadmin4/web/config.py"
24
25
msg2 "A criar ambiente virtual isolado para Python 3.14..."
26
rm -rf "${pkgdir}/usr/pgadmin4/venv"
27
python -m venv "${pkgdir}/usr/pgadmin4/venv"
28
29
msg2 "A instalar dependências do requirements.txt..."
30
31
"${pkgdir}/usr/pgadmin4/venv/bin/python" -m pip install --upgrade pip setuptools wheel
32
33
"${pkgdir}/usr/pgadmin4/venv/bin/python" -m pip install --no-cache-dir \
34
-r "${srcdir}/requirements.txt"
35
36
msg2 "A ajustar executáveis e caminhos do venv..."
37
ln -sf python "${pkgdir}/usr/pgadmin4/venv/bin/python3"
38
find "${pkgdir}/usr/pgadmin4/venv/bin" -type f -executable -exec sed -i "s|${pkgdir}||g" {} +
39
40
install -dm775 "${pkgdir}/var/lib/pgadmin"
41
install -dm775 "${pkgdir}/var/log/pgadmin"
42
}
43
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 3 |
| 2026-09-16 00:03:17 | Medium | 3 |
| 2026-09-15 00:25:31 | Medium | 3 |
| 2026-09-14 00:27:57 | Medium | 3 |
| 2026-09-13 00:19:54 | Medium | 3 |
| 2026-09-12 00:25:17 | Medium | 3 |
| 2026-09-11 00:19:22 | Medium | 3 |
| 2026-09-10 00:22:44 | Medium | 3 |
| 2026-09-09 00:04:09 | Medium | 3 |
| 2026-09-08 00:18:08 | Medium | 3 |
| 2026-09-07 00:30:15 | Medium | 3 |
| 2026-09-06 00:17:06 | Medium | 3 |
| 2026-09-05 00:16:27 | Medium | 3 |
| 2026-09-04 00:03:13 | Medium | 3 |
| 2026-09-03 00:15:47 | Medium | 3 |
| 2026-09-02 00:02:31 | Medium | 3 |
| 2026-09-01 00:11:19 | Medium | 3 |
| 2026-08-31 00:19:57 | Medium | 3 |
| 2026-08-30 00:04:14 | Medium | 3 |
| 2026-08-29 00:29:17 | Medium | 3 |