rstudio-server-git

maintainer bryanpires · 9 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads build dependencies (GWT, Gin, Node.js) from Google's storage and Node.js official site, which are legitimate sources; these are standard build tools, not malicious payloads, and the package builds from the official RStudio GitHub repository.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads build dependencies (GWT, Gin, Node.js) from Google's storage and Node.js official site, which are legitimate sources; these are standard build tools, not malicious payloads, and the package builds from the official RStudio GitHub repository.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/google-gin/gin-${_ginver}.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yann Büchau <nobodyinperson at posteo de>
    
      2# Previous Maintainer: Stephen Martin <stephenSRMMartin at gmail dot com>
    
      3#
    
      4# Note: Apache ant and java must be on the path for make to succeed.
    
      5#       If either was installed as a dependency during the build, you
    
      6#       will need to log out and then log back in for the changes to
    
      7#       your path and JAVA_HOME environment variable to take effect.
    
      8#
    
      9pkgname=rstudio-server-git
    
      10_gitname="rstudio"
    
      11pkgver=v2022.02.3+492.r1692.g7faaa81408
    
      12_gwtver=2.8.2
    
      13_ginver=2.1.2
    
      14_nodever=16.14.0
    
      15pkgrel=1
    
      16pkgdesc="A new integrated development environment (IDE) for R programming language"
    
      17arch=('i686' 'x86_64')
    
      18url="http://www.rstudio.org/"
    
      19license=('AGPL3')
    
      20depends=('r>=3.0.1' 'boost-libs>=1.69' 'openssl' 'mathjax2' 'pandoc' 'clang' 'postgresql-libs' 'sqlite3' 'soci' 'yaml-cpp' 'hunspell-en_US')
    
      21makedepends=('git' 'quarto-cli-bin' 'cmake>=3.4.3' 'boost>=1.69' 'jdk8-openjdk' 'apache-ant' 'unzip' 'bzip2' 'pango' 'pam' 'zlib' 'wget' 'yarn')
    
      22install="${pkgname}.install"
    
      23conflicts=('rstudio-server')
    
      24source=('git+https://github.com/rstudio/rstudio.git'
    
      25	'rstudio-server.service'
    
      26	"https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/google-gin/gin-${_ginver}.zip"
    
      27        "https://storage.googleapis.com/gwt-releases/gwt-${_gwtver}.zip"
    
      28	"https://nodejs.org/dist/v${_nodever}/node-v${_nodever}-linux-x64.tar.gz"
    
      29)
    
      30md5sums=('SKIP'
    
      31         'eea28f7865720f6c8d5de12f3f631880'
    
      32         'e2617189fe5c138945b8cc95f26bd476'
    
      33         'c295406d68c5ef364e445068599aa6d4'
    
      34         'a46e501a201be6c3c05c0f770c375372')
    
      35         
    
      36
    
      37pkgver() {
    
      38  cd "$srcdir/$_gitname"
    
      39  git describe --long --tags | sed -r 's/([^-]*-g)/r\1/;s/-/./g'
    
      40}
    
      41
    
      42prepare () {
    
      43    if test "`archlinux-java get`" != "java-8-openjdk";then
    
      44        cat<<EOT
    
      45    Your default Java version is set to `archlinux-java get`, not java-8-openjdk!
    
      46
    
      47    Fix it with:
    
      48
    
      49        archlinux-java set java-8-openjdk
    
      50
    
      51EOT
    
      52        exit 1
    
      53    fi
    
      54
    
      55    _rstudio_node_version=$(perl -ne 'print "$1" if(m/RSTUDIO_NODE_VERSION\s*"([^"]+)/)' "$srcdir"/rstudio/src/node/CMakeNodeTools.txt)
    
      56    if test "$_nodever" != "$_rstudio_node_version";then
    
      57        cat<<EOT
    
      58    node version in PKGBUILD ($_nodever) does not match what RStudio server expects ($_rstudio_node_version).
    
      59
    
      60    Fix it by updating the \$_nodever variable in the PKGBUILD:
    
      61
    
      62    ...
    
      63    \$_nodever="$_rstudio_node_version"
    
      64    ...
    
      65
    
      66    Then clean the PKGBUILD repo (git clean -ffdx), update the pkgsums (updpkgsums) and rebuild (makepkg -sf)
    
      67
    
      68EOT
    
      69        exit 1
    
      70    fi
    
      71
    
      72	cd ${srcdir}/$_gitname
    
      73	# Patching SOCI
    
      74	# patch -p1 < ${srcdir}/soci.patch
    
      75	# patch -p1 < ${srcdir}/rstudio_boost.patch
    
      76
    
      77	msg "Extracting dependencies..."
    
      78	    cd "${srcdir}/${_gitname}/src/gwt"
    
      79	    install -d lib/{gin,gwt}
    
      80	    install -d lib/gin/${_ginver}
    
      81	    install -d lib/gwt/${_gwtver}
    
      82	    unzip -qo "${srcdir}/gin-${_ginver}.zip" -d lib/gin/${_ginver}
    
      83	    cp -r "${srcdir}/gwt-${_gwtver}/"* lib/gwt/${_gwtver}
    
      84
    
      85	    cd "${srcdir}/${_gitname}/dependencies/common"
    
      86	    _pandocver=$(grep -oP "(?<=PANDOC_VERSION=\").*(?=\"$)" install-pandoc)
    
      87	    install -d pandoc/${_pandocver}
    
      88
    
      89	    ln -sfT "/usr/share/myspell/dicts" dictionaries
    
      90	    ln -sfT "/usr/share/mathjax2" mathjax-27
    
      91   	    ln -sfT /opt/quarto quarto
    
      92	    ln -sfT "/usr/bin/pandoc" pandoc/${_pandocver}/pandoc
    
      93	    ln -sfT "/usr/bin/pandoc-citeproc" pandoc/${_pandocvec}/pandoc-citeproc
    
      94
    
      95	    # Nodejs
    
      96	    install -d node/${_nodever}
    
      97	    cp -r ${srcdir}/node-v${_nodever}-linux-x64/* node/${_nodever}
    
      98	    cd ${srcdir}/${_gitname}/src/gwt/panmirror/src/editor
    
      99	    yarn config set ignore-engines true
    
      100	    yarn install
    
      101
    
      102	    # Fix links for src/cpp/session/CMakeLists.txt
    
      103	    cd "${srcdir}/${_gitname}/dependencies"
    
      104	    ln -sfT common/dictionaries dictionaries
    
      105   	    ln -sfT common/quarto quarto
    
      106	    ln -sfT common/mathjax-27 mathjax-27
    
      107	    ln -sfT common/pandoc pandoc
    
      108
    
      109	    cd ${srcdir}/${_gitname}/dependencies/common
    
      110	    # ./install-dictionaries
    
      111	    msg "Downloading and installing R packages..."
    
      112	    ./install-packages
    
      113}
    
      114
    
      115
    
      116build() {
    
      117  # Small hack
    
      118  # unset user Rprofile.r variable for building
    
      119  if [ -n $R_PROFILE_USER ]; then
    
      120	  unset R_PROFILE_USER
    
      121  fi
    
      122
    
      123  # Configure with cmake in a new build directory as recommended in the rstudio INSTALL file
    
      124  rm -rf ${srcdir}/$_gitname/build
    
      125  mkdir "${srcdir}/$_gitname/build"
    
      126  cd "${srcdir}/$_gitname/build"
    
      127
    
      128  # Configure cmake 
    
      129  cmake -DRSTUDIO_TARGET=Server \
    
      130	-DCMAKE_BUILD_TYPE=Release \
    
      131	-DCMAKE_INSTALL_PREFIX=/usr/lib/rstudio-server \
    
      132	-DRSTUDIO_USE_SYSTEM_BOOST=yes \
    
      133	-DRSTUDIO_USE_SYSTEM_YAML_CPP=yes \
    
      134	-DBoost_NO_BOOST_CMAKE=ON \
    
      135	-DRSTUDIO_USE_SYSTEM_SOCI=yes ..
    
      136
    
      137}
    
      138
    
      139
    
      140package() {
    
      141# Install
    
      142  msg "Installing to pkgdir"
    
      143  cd "${srcdir}/$_gitname/build"
    
      144  make DESTDIR="$pkgdir" install
    
      145# Extras (pam, var)
    
      146  msg "Install additional files..."
    
      147  install -d "${pkgdir}/etc/pam.d"
    
      148  install -Dm 644 "${pkgdir}/usr/lib/rstudio-server/extras/pam/rstudio" "${pkgdir}/etc/pam.d/rstudio"
    
      149  # rstudio home directory
    
      150  install -d "${pkgdir}/srv/rstudio-server"
    
      151  install -d "${pkgdir}/usr/lib//systemd/system"
    
      152  install -Dm 644 "${srcdir}/rstudio-server.service" "${pkgdir}/usr/lib//systemd/system/rstudio-server.service"
    
      153  install -d "${pkgdir}/etc/rstudio"
    
      154
    
      155  # vars
    
      156  mkdir -p ${pkgdir}/run/rstudio-server ${pkgdir}/lock/rstudio-server ${pkgdir}/var/log/rstudio-server ${pkgdir}/var/lib/rstudio-server
    
      157
    
      158  # lns
    
      159  mkdir -p $pkgdir/usr/bin
    
      160  ln -s /usr/lib/rstudio-server/bin/rserver $pkgdir/usr/bin/rserver
    
      161  ln -s /usr/lib/rstudio-server/bin/rstudio-server $pkgdir/usr/bin/rstudio-server
    
      162}
    
      163

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2