pgadmin4-server-bin

maintainer higorslva · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt .deb from an official but non-whitelisted PostgreSQL host and runs pip install on a requirements.txt fetched from GitHub without a checksum, creating a supply-chain risk if either source is compromised.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:31 "${pkgdir}/usr/pgadmin4/venv/bin/python" -m pip install --upgrade pip setuptools wheel

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}-1.noble_amd64.deb"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt .deb from an official but non-whitelisted PostgreSQL host and runs pip install on a requirements.txt fetched from GitHub without a checksum, creating a supply-chain risk if either source is compromised.

PKGBUILD

2 offending line(s) highlighted

      1# Original Maintainer: bko <aur at bil dot co dot ua>
    
      2# Maintainer: higorslva <higor.slva at outlook dot com>
    
      3
    
      4pkgname=pgadmin4-server-bin
    
      5pkgver=9.17
    
      6pkgrel=1
    
      7pkgdesc='The core server package for pgAdmin. pgAdmin is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world.'
    
      8arch=('x86_64')
    
      9license=('PostgreSQL')
    
      10makedepends=('python-pip')
    
      11depends=('python' 'libedit' 'krb5' 'sqlite' 'postgresql-libs')
    
      12provides=('pgadmin4-server')
    
      13conflicts=('pgadmin4-server')
    
      14source=("pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}-1.noble_amd64.deb"
    
      15        "requirements.txt::https://raw.githubusercontent.com/pgadmin-org/pgadmin4/refs/heads/master/requirements.txt")
    
      16#source=("pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}_amd64.deb")
    
      17sha256sums=('cec06cafd20b5d13f6dec3e767e46e4359f3620cc6ddb6449800c43a65971fc4'
    
      18            'SKIP')
    
      19
    
      20package() {
    
      21  # Extract package data
    
      22  tar -x --zstd -f data.tar.zst -C "${pkgdir}"
    
      23  sed -i "s|ALLOW_SAVE_TUNNEL_PASSWORD = False|ALLOW_SAVE_TUNNEL_PASSWORD = True|" "${pkgdir}/usr/pgadmin4/web/config.py"
    
      24
    
      25  msg2 "A criar ambiente virtual isolado para Python 3.14..."
    
      26  rm -rf "${pkgdir}/usr/pgadmin4/venv"
    
      27  python -m venv "${pkgdir}/usr/pgadmin4/venv"
    
      28
    
      29  msg2 "A instalar dependências do requirements.txt..."
    
      30  
    
      31  "${pkgdir}/usr/pgadmin4/venv/bin/python" -m pip install --upgrade pip setuptools wheel
    
      32
    
      33  "${pkgdir}/usr/pgadmin4/venv/bin/python" -m pip install --no-cache-dir \
    
      34    -r "${srcdir}/requirements.txt"
    
      35
    
      36  msg2 "A ajustar executáveis e caminhos do venv..."
    
      37  ln -sf python "${pkgdir}/usr/pgadmin4/venv/bin/python3"
    
      38  find "${pkgdir}/usr/pgadmin4/venv/bin" -type f -executable -exec sed -i "s|${pkgdir}||g" {} +
    
      39
    
      40  install -dm775 "${pkgdir}/var/lib/pgadmin"
    
      41  install -dm775 "${pkgdir}/var/log/pgadmin"
    
      42}
    
      43

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 # Maintainer: higorslva <higor.slva at outlook dot com>
 
 pkgname=pgadmin4-server-bin
-pkgver=9.15
+pkgver=9.17
 pkgrel=1
 pkgdesc='The core server package for pgAdmin. pgAdmin is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world.'
 arch=('x86_64')
@@ -14,7 +14,7 @@
 source=("pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}-1.noble_amd64.deb"
         "requirements.txt::https://raw.githubusercontent.com/pgadmin-org/pgadmin4/refs/heads/master/requirements.txt")
 #source=("pgadmin4-server-${pkgver}-x86_64.deb::https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/noble/dists/pgadmin4/main/binary-amd64/pgadmin4-server_${pkgver}_amd64.deb")
-sha256sums=('97c2459419344e7765f16e8461f25bbde534aca3cab8bdd685bfb740eedc1b35'
+sha256sums=('cec06cafd20b5d13f6dec3e767e46e4359f3620cc6ddb6449800c43a65971fc4'
             'SKIP')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 03:19:42	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3