questdb

maintainer CGittner · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt JAR from the project's official GitHub releases, which is normal for Java applications; the source is verifiable and matches the project's release process, posing minimal risk despite the untrusted host heuristic flag.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt JAR from the project's official GitHub releases, which is normal for Java applications; the source is verifiable and matches the project's release process, posing minimal risk despite the untrusted host heuristic flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Ning Sun <n@sunng.info>
    
      2
    
      3pkgname=questdb
    
      4pkgver=9.1.0
    
      5pkgrel=1
    
      6pkgdesc='Fast timeseries database'
    
      7arch=('any')
    
      8url='https://questdb.io'
    
      9license=('APACHE')
    
      10depends=('java-runtime' 'bash')
    
      11install='questdb.install'
    
      12source=(https://github.com/questdb/questdb/releases/download/${pkgver}/questdb-${pkgver}-no-jre-bin.tar.gz
    
      13    'questdb.sh'
    
      14    'questdb.sysusers'
    
      15    'questdb-tmpfile.conf'
    
      16    'questdb.service')
    
      17sha1sums=('53c85e15ec4204944f8f03eb33c03f6f4367de2a'
    
      18          'cf89748006a65bd09ad8f57ca76b58f1ec3a053e'
    
      19          '79459d2e7ab4a78364359cb40368bbc0778fd9cf'
    
      20          'bcd990f6257a0501c82a03384a9d4c5703b03abb'
    
      21          'ec5400e458e7511abb8e455710041352f15b87ab')
    
      22
    
      23package() {
    
      24    mkdir -p ${pkgdir}/{usr/bin,usr/share/java/questdb,etc/questdb,var/lib/questdb}
    
      25
    
      26    tar xf questdb-${pkgver}-no-jre-bin.tar.gz
    
      27    cp questdb-${pkgver}-no-jre-bin/questdb.jar ${pkgdir}/usr/share/java/questdb/questdb.jar
    
      28
    
      29    install -Dm755 questdb.sh ${pkgdir}/usr/bin/questdb
    
      30    install -Dm644 ${srcdir}/questdb.service ${pkgdir}/usr/lib/systemd/system/questdb.service
    
      31    install -Dm644 ${srcdir}/questdb.sysusers ${pkgdir}/usr/lib/sysusers.d/questdb.conf
    
      32    install -Dm644 ${srcdir}/questdb-tmpfile.conf ${pkgdir}/usr/lib/tmpfiles.d/questdb.conf
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 19:25:44	MEDIUM	1
2026-07-23 17:25:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0