prowlarr-develop-bin
LOW
maintainer txtsd
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads prebuilt binaries from the project's official update server (prowlarr.servarr.com), which is plausibly controlled by the project maintainers; despite the non-whitelisted host, the binaries are verified via sha256sums and the worst case of a malicious swap is limited to code execution within the service sandbox, but given the source is the official project infrastructure, this is a standard and expected AUR packaging pattern.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official update server (prowlarr.servarr.com), which is plausibly controlled by the project maintainers; despite the non-whitelisted host, the binaries are verified via sha256sums and the worst case of a malicious swap is limited to code execution within the service sandbox, but given the source is the official project infrastructure, this is a standard and expected AUR packaging pattern.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:53
source_x86_64=("Prowlarr.develop.${pkgver}.linux-core-x64.tar.gz::https://prowlarr.servarr.com/v1/update/develop/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=x64")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: txtsd <aur.archlinux@ihavea.quest>
2
# Maintainer: Donald Webster <fryfrog@gmail.com>
3
# Helpful URL: https://prowlarr.servarr.com/v1/update/develop?version=0.0.0.0&os=linux&runtime=netcore&arch=x64&includeMajorVersion=true
4
5
pkgname=prowlarr-develop-bin
6
pkgver=2.7.0.5723
7
pkgrel=1
8
pkgdesc='Indexer manager/proxy for usenet and torrent users (develop branch)'
9
arch=(x86_64 aarch64 armv7h)
10
url='https://prowlarr.com'
11
license=('GPL-3.0-or-later')
12
groups=(servarr-develop-bin)
13
depends=(
14
gcc-libs
15
glibc
16
sqlite
17
zlib
18
)
19
optdepends=(
20
'postgresql: postgresql database'
21
'sabnzbd: usenet downloader'
22
'nzbget: usenet downloader'
23
'qbittorrent: torrent downloader'
24
'deluge: torrent downloader'
25
'rtorrent: torrent downloader'
26
'nodejs-flood: torrent downloader'
27
'vuze: torrent downloader'
28
'aria2: torrent downloader'
29
'transmission-cli: torrent downloader (CLI and daemon)'
30
'transmission-gtk: torrent downloader (GTK+)'
31
'transmission-qt: torrent downloader (Qt)'
32
'jackett: torrent indexer proxy'
33
'nzbhydra2: torznab and usenet indexer proxy'
34
'flaresolverr: A proxy server to bypass Cloudflare protection'
35
'sonarr: automatically integrates with and syncs indexers'
36
'radarr: automatically integrates with and syncs indexers'
37
'lidarr: automatically integrates with and syncs indexers'
38
'readarr: automatically integrates with and syncs indexers'
39
'whisparr: automatically integrates with and syncs indexers'
40
'mylar3: automatically integrates with and syncs indexers'
41
'lazylibrarian: automatically integrates with and syncs indexers'
42
)
43
provides=(prowlarr)
44
conflicts=(prowlarr)
45
options=(!debug)
46
install=prowlarr.install
47
source=(
48
package_info
49
prowlarr.service
50
prowlarr.sysusers
51
prowlarr.tmpfiles
52
)
53
source_x86_64=("Prowlarr.develop.${pkgver}.linux-core-x64.tar.gz::https://prowlarr.servarr.com/v1/update/develop/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=x64")
54
source_aarch64=("Prowlarr.develop.${pkgver}.linux-core-arm64.tar.gz::https://prowlarr.servarr.com/v1/update/develop/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=arm64")
55
source_armv7h=("Prowlarr.develop.${pkgver}.linux-core-arm.tar.gz::https://prowlarr.servarr.com/v1/update/develop/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=arm")
56
sha256sums=('c2c998c73ba78eac6ad7519d5d46bfa3354dd6d575a410aefb4b432a2f387f10'
57
'0c9d7cda701395a8ddb708c111de58437543485702de23e23a0164a162a53bbc'
58
'ee61f5621eae6ab932fb093a4f75a0ab11bf9e3ca829f0d34c25014f68aeff7d'
59
'75591d19518bafc60862c60848ecad84f92c7f2b47b2b4eeafcbbbd650a43043')
60
sha256sums_x86_64=('d65cb9fb442a8a3ded055d7027db9a08f519acb7908c7afe72175aa7c337783c')
61
sha256sums_aarch64=('bd2dcc1d42f3ea37a247224bb4293e00ebd31e76f12abfca389c4260f7e0a71e')
62
sha256sums_armv7h=('94d10e1a987e5fc3decef491fe450ce0b51f99b3844d2a757b7006bd4f5edca5')
63
64
package() {
65
install -dm755 "${pkgdir}/usr/lib/prowlarr/bin"
66
67
# License
68
install -Dm644 Prowlarr/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}"
69
rm Prowlarr/LICENSE
70
71
# Remove Service Helpers, and Update files
72
rm Prowlarr/ServiceInstall*
73
rm Prowlarr/ServiceUninstall*
74
rm -rf Prowlarr/Prowlarr.Update
75
76
# Disable built in updater.
77
install -Dm644 package_info "${pkgdir}/usr/lib/prowlarr"
78
echo "PackageVersion=${pkgver}-${pkgrel}" >> "${pkgdir}/usr/lib/prowlarr/package_info"
79
80
# Copy Prowlarr
81
cp -dr Prowlarr/* "${pkgdir}/usr/lib/prowlarr/bin"
82
83
# Systemd
84
install -Dm644 prowlarr.service "${pkgdir}/usr/lib/systemd/system/prowlarr.service"
85
install -Dm644 prowlarr.sysusers "${pkgdir}/usr/lib/sysusers.d/prowlarr.conf"
86
install -Dm644 prowlarr.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/prowlarr.conf"
87
}
88
Changes since previous scan
--- PKGBUILD @ 2026-10-27 00:23+++ PKGBUILD @ 2026-11-01 00:21@@ -3,7 +3,7 @@ # Helpful URL: https://prowlarr.servarr.com/v1/update/develop?version=0.0.0.0&os=linux&runtime=netcore&arch=x64&includeMajorVersion=true pkgname=prowlarr-develop-bin-pkgver=2.6.6.5717+pkgver=2.7.0.5723 pkgrel=1 pkgdesc='Indexer manager/proxy for usenet and torrent users (develop branch)' arch=(x86_64 aarch64 armv7h)@@ -57,9 +57,9 @@ '0c9d7cda701395a8ddb708c111de58437543485702de23e23a0164a162a53bbc' 'ee61f5621eae6ab932fb093a4f75a0ab11bf9e3ca829f0d34c25014f68aeff7d' '75591d19518bafc60862c60848ecad84f92c7f2b47b2b4eeafcbbbd650a43043')-sha256sums_x86_64=('046d0a3666e7780555e54bf044a774406df6b429a0f33863884d35c174698d03')-sha256sums_aarch64=('7240728f1d5edbba8abebf6faf811519eb8bf5b8686d7ac4cd86c668519e462a')-sha256sums_armv7h=('afd58f02b48e5f2bb64b287edafe386ed8f22cb23110b8a3b213a56751ecb118')+sha256sums_x86_64=('d65cb9fb442a8a3ded055d7027db9a08f519acb7908c7afe72175aa7c337783c')+sha256sums_aarch64=('bd2dcc1d42f3ea37a247224bb4293e00ebd31e76f12abfca389c4260f7e0a71e')+sha256sums_armv7h=('94d10e1a987e5fc3decef491fe450ce0b51f99b3844d2a757b7006bd4f5edca5') package() { install -dm755 "${pkgdir}/usr/lib/prowlarr/bin"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 19:48:35 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 21:45:59 | Medium | 1 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |