radarr-nightly-bin
LOW
maintainer txtsd
4 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads prebuilt binaries from the project's official update server (radarr.servarr.com), which is plausibly owned by the project; despite the non-whitelisted host, the binaries are verified via sha256sums and the worst case of a malicious swap is limited by the project's own release infrastructure.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official update server (radarr.servarr.com), which is plausibly owned by the project; despite the non-whitelisted host, the binaries are verified via sha256sums and the worst case of a malicious swap is limited by the project's own release infrastructure.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:47
source_x86_64=("Radarr.nightly.${pkgver}.linux-core-x64.tar.gz::https://radarr.servarr.com/v1/update/nightly/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=x64")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: txtsd <aur.archlinux@ihavea.quest>
2
# Maintainer: Donald Webster <fryfrog@gmail.com>
3
# Helpful URL: https://radarr.servarr.com/v1/update/nightly?version=0.0.0.0&os=linux&runtime=netcore&arch=x64&includeMajorVersion=true
4
5
pkgname=radarr-nightly-bin
6
pkgver=7.0.1.10849
7
pkgrel=1
8
pkgdesc='Movie organizer/manager for usenet and torrent users (nightly builds)'
9
arch=(x86_64 aarch64 armv7h)
10
url='https://radarr.video'
11
license=('GPL-3.0-or-later')
12
groups=(servarr-nightly-bin)
13
depends=(
14
gcc-libs
15
glibc
16
sqlite
17
zlib
18
)
19
optdepends=(
20
'postgresql: postgresql database'
21
'sabnzbd: usenet downloader'
22
'nzbget: usenet downloader'
23
'qbittorrent: torrent downloader'
24
'deluge: torrent downloader'
25
'rtorrent: torrent downloader'
26
'nodejs-flood: torrent downloader'
27
'vuze: torrent downloader'
28
'aria2: torrent downloader'
29
'transmission-cli: torrent downloader (CLI and daemon)'
30
'transmission-gtk: torrent downloader (GTK+)'
31
'transmission-qt: torrent downloader (Qt)'
32
'jackett: torrent indexer proxy'
33
'nzbhydra2: torznab and usenet indexer proxy'
34
'prowlarr: torrent and usenet indexer proxy'
35
'autobrr: irc, torrent and usenet indexer proxy'
36
)
37
provides=(radarr)
38
conflicts=(radarr)
39
options=(!debug)
40
install=radarr.install
41
source=(
42
package_info
43
radarr.service
44
radarr.sysusers
45
radarr.tmpfiles
46
)
47
source_x86_64=("Radarr.nightly.${pkgver}.linux-core-x64.tar.gz::https://radarr.servarr.com/v1/update/nightly/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=x64")
48
source_aarch64=("Radarr.nightly.${pkgver}.linux-core-arm64.tar.gz::https://radarr.servarr.com/v1/update/nightly/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=arm64")
49
source_armv7h=("Radarr.nightly.${pkgver}.linux-core-arm.tar.gz::https://radarr.servarr.com/v1/update/nightly/updatefile?version=${pkgver}&os=linux&runtime=netcore&arch=arm")
50
sha256sums=('e7d22110337234a9d5ce1ea0f65d0dcd7c76e339c61da77c33b80218638d5c3a'
51
'25637c6496aa59673aada6acc6cf41025a5f12a844025ee41d8a6cc66b84b5c0'
52
'bb73e0c55711d7ddbf74140b3beb39cb8674ae92be8387c3dd8109bcd53faca8'
53
'c68efcb3778cb497d7c256dc97df7413ce09f07ea341e4d2683e7fee321cbcbb')
54
sha256sums_x86_64=('8585fddf634e9bdab7c65da5eb2cee8051abb1e3fd5f7881069d1d0370b6a1d1')
55
sha256sums_aarch64=('57d6720facfe3ba848b0c24572fecdd3eaa915bacc9ee94dc40ecad90c962811')
56
sha256sums_armv7h=('5f0924437d797435e0a77793d17639f18ecbd76993c1802e25ec7e701ef6bbfb')
57
58
package() {
59
install -dm755 "${pkgdir}/usr/lib/radarr/bin"
60
61
# License
62
install -Dm644 Radarr/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}"
63
rm Radarr/LICENSE
64
65
# Remove Service Helpers, and Update files
66
rm Radarr/ServiceInstall*
67
rm Radarr/ServiceUninstall*
68
rm -rf Radarr/Radarr.Update
69
70
# Disable built in updater.
71
install -Dm644 package_info "${pkgdir}/usr/lib/radarr"
72
echo "PackageVersion=${pkgver}-${pkgrel}" >> "${pkgdir}/usr/lib/radarr/package_info"
73
74
# Copy Radarr
75
cp -dr Radarr/* "${pkgdir}/usr/lib/radarr/bin"
76
77
# Systemd
78
install -Dm644 radarr.service "${pkgdir}/usr/lib/systemd/system/radarr.service"
79
install -Dm644 radarr.sysusers "${pkgdir}/usr/lib/sysusers.d/radarr.conf"
80
install -Dm644 radarr.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/radarr.conf"
81
}
82
Changes since previous scan
--- PKGBUILD @ 2026-10-31 00:07+++ PKGBUILD @ 2026-11-01 00:21@@ -3,7 +3,7 @@ # Helpful URL: https://radarr.servarr.com/v1/update/nightly?version=0.0.0.0&os=linux&runtime=netcore&arch=x64&includeMajorVersion=true pkgname=radarr-nightly-bin-pkgver=7.0.1.10844+pkgver=7.0.1.10849 pkgrel=1 pkgdesc='Movie organizer/manager for usenet and torrent users (nightly builds)' arch=(x86_64 aarch64 armv7h)@@ -51,9 +51,9 @@ '25637c6496aa59673aada6acc6cf41025a5f12a844025ee41d8a6cc66b84b5c0' 'bb73e0c55711d7ddbf74140b3beb39cb8674ae92be8387c3dd8109bcd53faca8' 'c68efcb3778cb497d7c256dc97df7413ce09f07ea341e4d2683e7fee321cbcbb')-sha256sums_x86_64=('0d8000c66f4fd6d60fff76f7337a826290d4007a9fbf4def5f01e348a1e5c64e')-sha256sums_aarch64=('a6f2ce3bc8c3f1ab3833f9b6de5a0d7b895090266880c55991970eb687220036')-sha256sums_armv7h=('972631ea38cf78dc08afb5c4c8fd675d1507640d65d5293f9b8a2ca018adfe48')+sha256sums_x86_64=('8585fddf634e9bdab7c65da5eb2cee8051abb1e3fd5f7881069d1d0370b6a1d1')+sha256sums_aarch64=('57d6720facfe3ba848b0c24572fecdd3eaa915bacc9ee94dc40ecad90c962811')+sha256sums_armv7h=('5f0924437d797435e0a77793d17639f18ecbd76993c1802e25ec7e701ef6bbfb') package() { install -dm755 "${pkgdir}/usr/lib/radarr/bin"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 23:59:16 | Medium | 1 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 21:57:10 | Medium | 1 |
| 2026-10-28 00:06:54 | Clean | 2 |
| 2026-10-27 19:48:35 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 03:41:34 | Medium | 1 |
| 2026-10-25 01:41:32 | Medium | 1 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 21:41:28 | Medium | 1 |
| 2026-10-24 17:41:05 | Medium | 1 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 01:27:05 | Medium | 1 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |