proxmox-backup-client
LOW
maintainer flumm
30 votes
scanned 2026-10-24 00:14:55.209548
Why flagged
The source URLs point to the official Proxmox Git repositories, which are legitimate and expected for building the software, despite not being on a standard web host; the package builds from source and does not execute untrusted prebuilt binaries.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URLs point to the official Proxmox Git repositories, which are legitimate and expected for building the software, despite not being on a standard web host; the package builds from source and does not execute untrusted prebuilt binaries.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
"$pkgname-$pkgver::git://git.proxmox.com/git/proxmox-backup.git#tag=v$pkgver"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Dominik Csapak <dominik.csapak@gmail.com>
2
# Maintainer: Thomas Lamprecht <thomas@lamprecht.org>
3
pkgname=proxmox-backup-client
4
pkgver=4.2.8
5
pkgrel=1
6
pkgdesc="Client for Proxmox Backup Server"
7
arch=('x86_64' 'aarch64')
8
url="https://pbs.proxmox.com"
9
license=('AGPL3')
10
depends=(
11
'acl'
12
'fuse3'
13
'gcc-libs'
14
'openssl'
15
)
16
makedepends=('cargo' 'clang' 'git' 'llvm' 'patchelf' 'python-docutils' 'python-sphinx')
17
options=(!lto)
18
source=(
19
"$pkgname-$pkgver::git://git.proxmox.com/git/proxmox-backup.git#tag=v$pkgver"
20
"proxmox::git://git.proxmox.com/git/proxmox.git#commit=07f4269cc682157ffac2ee76610a2ccd656e7d30"
21
"proxmox-fuse::git://git.proxmox.com/git/proxmox-fuse.git"
22
"pxar::git://git.proxmox.com/git/pxar.git"
23
"pathpatterns::git://git.proxmox.com/git/pathpatterns.git"
24
"0001-re-route-dependencies-not-available-on-crates.io-to-.patch"
25
"0002-docs-drop-all-but-client-man-pages.patch"
26
"elf-strip-unused-dependencies.sh"
27
)
28
# either a git repo or tracked by this git repo, so not much gained by encoding
29
# checksums here in this git repo
30
sha512sums=(
31
'SKIP'
32
'SKIP'
33
'SKIP'
34
'SKIP'
35
'SKIP'
36
'SKIP'
37
'SKIP'
38
'SKIP'
39
)
40
41
_apply() {
42
echo "applying patch '$1'"
43
patch --forward --strip=1 --input="${srcdir}/$1"
44
}
45
46
prepare() {
47
cd "$pkgname-$pkgver"
48
rm .cargo/config.toml # drop Debian-style redirect of crates.io to local registry
49
50
_apply 0001-re-route-dependencies-not-available-on-crates.io-to-.patch
51
_apply 0002-docs-drop-all-but-client-man-pages.patch
52
53
# fetch all in prepare to allow build() to be run offline
54
cargo fetch --target "$CARCH-unknown-linux-gnu"
55
}
56
57
build() {
58
cd "$pkgname-$pkgver"
59
60
cargo build --release \
61
--package proxmox-backup-client \
62
--bin proxmox-backup-client \
63
--bin dump-catalog-shell-cli \
64
--package pxar-bin \
65
--bin pxar \
66
;
67
68
# fixup rust linking "feature" which links in all dependencies somewhere used
69
# in the crate, even if not referenced at all in this binary...
70
"${srcdir}/elf-strip-unused-dependencies.sh" "target/release/proxmox-backup-client"
71
"${srcdir}/elf-strip-unused-dependencies.sh" "target/release/pxar"
72
73
cd docs
74
75
DEB_VERSION_UPSTREAM="$pkgver" DEB_VERSION="${pkgver%.*}" BUILD_MODE=release make proxmox-backup-client.1 pxar.1
76
}
77
78
check() {
79
cd "$pkgname-$pkgver"
80
81
mkdir -p target/testout/
82
cargo test --release \
83
--package proxmox-backup-client \
84
--bin proxmox-backup-client \
85
--package pxar-bin \
86
--bin pxar \
87
;
88
}
89
90
package() {
91
cd "$pkgname-$pkgver"
92
93
install -Dm755 "target/release/proxmox-backup-client" "$pkgdir/usr/bin/proxmox-backup-client"
94
install -Dm755 "target/release/pxar" "$pkgdir/usr/bin/pxar"
95
96
install -Dm644 "docs/output/man/proxmox-backup-client.1" "$pkgdir/usr/share/man/man1/proxmox-backup-client.1"
97
install -Dm644 "docs/output/man/pxar.1" "$pkgdir/usr/share/man/man1/pxar.1"
98
99
install -Dm644 "debian/proxmox-backup-client.bc" "$pkgdir/usr/share/bash-completion/completions/proxmox-backup-client"
100
install -Dm644 "debian/pxar.bc" "$pkgdir/usr/share/bash-completion/completions/pxar"
101
102
install -Dm644 "zsh-completions/_proxmox-backup-client" "$pkgdir/usr/share/zsh/site-functions/_proxmox-backup-client"
103
install -Dm644 "zsh-completions/_pxar" "$pkgdir/usr/share/zsh/site-functions/_pxar"
104
}
105
Changes since previous scan
--- PKGBUILD @ 2026-06-20 00:18+++ PKGBUILD @ 2026-10-24 00:14@@ -1,7 +1,7 @@ # Maintainer: Dominik Csapak <dominik.csapak@gmail.com> # Maintainer: Thomas Lamprecht <thomas@lamprecht.org> pkgname=proxmox-backup-client-pkgver=4.2.0+pkgver=4.2.8 pkgrel=1 pkgdesc="Client for Proxmox Backup Server" arch=('x86_64' 'aarch64')@@ -17,7 +17,7 @@ options=(!lto) source=( "$pkgname-$pkgver::git://git.proxmox.com/git/proxmox-backup.git#tag=v$pkgver"- "proxmox::git://git.proxmox.com/git/proxmox.git#commit=22c4d5ecbfce6eb2fd566181e0b7d23ac2df4f0c"+ "proxmox::git://git.proxmox.com/git/proxmox.git#commit=07f4269cc682157ffac2ee76610a2ccd656e7d30" "proxmox-fuse::git://git.proxmox.com/git/proxmox-fuse.git" "pxar::git://git.proxmox.com/git/pxar.git" "pathpatterns::git://git.proxmox.com/git/pathpatterns.git"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 21:38:30 | Medium | 1 |
| 2026-06-20 00:18:46 | Clean | 2 |
| 2026-06-19 23:51:18 | Clean | 2 |
| 2026-06-19 19:07:35 | Low | 2 |
| 2026-06-18 16:11:54 | Medium | 1 |