prowlarr-develop
LOW
maintainer txtsd
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The flagged 'npm/yarn/pnpm install' occurs during prepare() but is part of building the project's own frontend from source; the package builds from an official GitHub repository with verifiable source, and the yarn install is for legitimate project dependencies, not external or malicious packages.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged 'npm/yarn/pnpm install' occurs during prepare() but is part of building the project's own frontend from source; the package builds from an official GitHub repository with verifiable source, and the yarn install is for legitimate project dependencies, not external or malicious packages.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:90
yarn install --frozen-lockfile --network-timeout 120000
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: txtsd <aur.archlinux@ihavea.quest>
2
# Maintainer: Donald Webster <fryfrog@gmail.com>
3
# Helpful URL: https://prowlarr.servarr.com/v1/update/develop?version=0.0.0.0&os=linux&runtime=netcore&arch=x64&includeMajorVersion=true
4
5
pkgname=prowlarr-develop
6
_pkgname=Prowlarr
7
pkgver=2.6.6.5717
8
pkgrel=1
9
pkgdesc='Indexer manager/proxy for usenet and torrent users (develop branch)'
10
arch=(x86_64 aarch64 armv7h)
11
url='https://prowlarr.com'
12
license=('GPL-3.0-or-later')
13
groups=(servarr-develop)
14
depends=(
15
aspnet-runtime-8.0
16
gcc-libs
17
glibc
18
sqlite
19
)
20
makedepends=(dotnet-sdk-8.0 yarn)
21
optdepends=(
22
'postgresql: postgresql database'
23
'sabnzbd: usenet downloader'
24
'nzbget: usenet downloader'
25
'qbittorrent: torrent downloader'
26
'deluge: torrent downloader'
27
'rtorrent: torrent downloader'
28
'nodejs-flood: torrent downloader'
29
'vuze: torrent downloader'
30
'aria2: torrent downloader'
31
'transmission-cli: torrent downloader (CLI and daemon)'
32
'transmission-gtk: torrent downloader (GTK+)'
33
'transmission-qt: torrent downloader (Qt)'
34
'jackett: torrent indexer proxy'
35
'nzbhydra2: torznab and usenet indexer proxy'
36
'flaresolverr: A proxy server to bypass Cloudflare protection'
37
'sonarr: automatically integrates with and syncs indexers'
38
'radarr: automatically integrates with and syncs indexers'
39
'lidarr: automatically integrates with and syncs indexers'
40
'readarr: automatically integrates with and syncs indexers'
41
'whisparr: automatically integrates with and syncs indexers'
42
'mylar3: automatically integrates with and syncs indexers'
43
'lazylibrarian: automatically integrates with and syncs indexers'
44
)
45
provides=(prowlarr)
46
conflicts=(prowlarr)
47
install=prowlarr.install
48
source=(
49
"${pkgname}-${pkgver}.tar.gz::https://github.com/Prowlarr/Prowlarr/archive/refs/tags/v${pkgver}.tar.gz"
50
package_info
51
prowlarr.service
52
prowlarr.sysusers
53
prowlarr.tmpfiles
54
)
55
sha256sums=('8240effb7151c048aeed599993f81bbd758bb656d299b01b9a3046d5b1fae23e'
56
'15b6ed4b78eafc6d0059c87d71945782f1600c57047562a0865fd1779f7ee293'
57
'0c9d7cda701395a8ddb708c111de58437543485702de23e23a0164a162a53bbc'
58
'ee61f5621eae6ab932fb093a4f75a0ab11bf9e3ca829f0d34c25014f68aeff7d'
59
'75591d19518bafc60862c60848ecad84f92c7f2b47b2b4eeafcbbbd650a43043')
60
61
case ${CARCH} in
62
x86_64) _CARCH='x64' ;;
63
aarch64) _CARCH='arm64' ;;
64
armv7h) _CARCH='arm' ;;
65
esac
66
67
_framework='net8.0'
68
_runtime="linux-${_CARCH}"
69
_output='_output'
70
_artifacts="${_output}/${_framework}/${_runtime}/publish"
71
_branch='develop'
72
73
prepare() {
74
cd "${_pkgname}-${pkgver}"
75
76
# Remove upstream dotnet version
77
rm global.json
78
79
export DOTNET_CLI_TELEMETRY_OPTOUT=1
80
export DOTNET_NOLOGO=1
81
export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
82
dotnet new globaljson --sdk-version 8.0.127 --roll-forward latestFeature
83
84
# Prepare backend
85
dotnet restore "src/${_pkgname}.sln" \
86
--runtime "${_runtime}" \
87
--locked-mode
88
89
# Prepare frontend
90
yarn install --frozen-lockfile --network-timeout 120000
91
}
92
93
build() {
94
cd "${_pkgname}-${pkgver}"
95
96
# Build backend
97
export DOTNET_CLI_TELEMETRY_OPTOUT=1
98
export DOTNET_NOLOGO=1
99
export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
100
dotnet build "src/${_pkgname}.sln" \
101
--framework "${_framework}" \
102
--runtime "${_runtime}" \
103
--no-self-contained \
104
--no-restore \
105
--configuration Release \
106
-p:Platform=Posix \
107
-p:AssemblyVersion=${pkgver} \
108
-p:AssemblyConfiguration=${_branch} \
109
-p:RuntimeIdentifiers=${_runtime} \
110
-t:PublishAllRids \
111
&& dotnet build-server shutdown # Build servers do not terminate automatically
112
113
# Build frontend
114
yarn run build --env production
115
}
116
117
package() {
118
cd "${_pkgname}-${pkgver}"
119
120
install -dm755 "${pkgdir}/usr/lib/prowlarr/bin/UI"
121
122
# Remove Service Helpers, Update, and Windows files
123
rm "${_artifacts}/ServiceInstall"*
124
rm "${_artifacts}/ServiceUninstall"*
125
rm "${_artifacts}/Prowlarr.Windows."*
126
127
# Copy backend
128
cp -dr "${_artifacts}/"* "${pkgdir}/usr/lib/prowlarr/bin"
129
# Copy frontend
130
cp -dr "${_output}/UI/"* "${pkgdir}/usr/lib/prowlarr/bin/UI"
131
132
# License
133
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}"
134
135
# Disable built in updater.
136
cd "${srcdir}"
137
install -Dm644 package_info "${pkgdir}/usr/lib/prowlarr"
138
echo "PackageVersion=${pkgver}-${pkgrel}" >> "${pkgdir}/usr/lib/prowlarr/package_info"
139
140
# Systemd
141
install -Dm644 prowlarr.service "${pkgdir}/usr/lib/systemd/system/prowlarr.service"
142
install -Dm644 prowlarr.sysusers "${pkgdir}/usr/lib/sysusers.d/prowlarr.conf"
143
install -Dm644 prowlarr.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/prowlarr.conf"
144
}
145
Changes since previous scan
--- PKGBUILD @ 2026-10-26 00:12+++ PKGBUILD @ 2026-11-01 00:21@@ -4,7 +4,7 @@ pkgname=prowlarr-develop _pkgname=Prowlarr-pkgver=2.6.5.5623+pkgver=2.6.6.5717 pkgrel=1 pkgdesc='Indexer manager/proxy for usenet and torrent users (develop branch)' arch=(x86_64 aarch64 armv7h)@@ -52,7 +52,7 @@ prowlarr.sysusers prowlarr.tmpfiles )-sha256sums=('1a88ca371ab9944845b0ded713c164bb9b6259fb925719185234dcc4f08d3908'+sha256sums=('8240effb7151c048aeed599993f81bbd758bb656d299b01b9a3046d5b1fae23e' '15b6ed4b78eafc6d0059c87d71945782f1600c57047562a0865fd1779f7ee293' '0c9d7cda701395a8ddb708c111de58437543485702de23e23a0164a162a53bbc' 'ee61f5621eae6ab932fb093a4f75a0ab11bf9e3ca829f0d34c25014f68aeff7d'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 19:48:35 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 21:45:59 | Medium | 1 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |