rstudio-server-git

LOW
maintainer bryanpires 9 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads build dependencies (GWT, Gin, Node.js) from Google's storage and Node.js official site, which are legitimate sources; these are standard build tools, not malicious payloads, and the package builds from the official RStudio GitHub repository.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads build dependencies (GWT, Gin, Node.js) from Google's storage and Node.js official site, which are legitimate sources; these are standard build tools, not malicious payloads, and the package builds from the official RStudio GitHub repository.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:26 "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/google-gin/gin-${_ginver}.zip"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Yann Büchau <nobodyinperson at posteo de>
2# Previous Maintainer: Stephen Martin <stephenSRMMartin at gmail dot com>
3#
4# Note: Apache ant and java must be on the path for make to succeed.
5# If either was installed as a dependency during the build, you
6# will need to log out and then log back in for the changes to
7# your path and JAVA_HOME environment variable to take effect.
8#
9pkgname=rstudio-server-git
10_gitname="rstudio"
11pkgver=v2022.02.3+492.r1692.g7faaa81408
12_gwtver=2.8.2
13_ginver=2.1.2
14_nodever=16.14.0
15pkgrel=1
16pkgdesc="A new integrated development environment (IDE) for R programming language"
17arch=('i686' 'x86_64')
18url="http://www.rstudio.org/"
19license=('AGPL3')
20depends=('r>=3.0.1' 'boost-libs>=1.69' 'openssl' 'mathjax2' 'pandoc' 'clang' 'postgresql-libs' 'sqlite3' 'soci' 'yaml-cpp' 'hunspell-en_US')
21makedepends=('git' 'quarto-cli-bin' 'cmake>=3.4.3' 'boost>=1.69' 'jdk8-openjdk' 'apache-ant' 'unzip' 'bzip2' 'pango' 'pam' 'zlib' 'wget' 'yarn')
22install="${pkgname}.install"
23conflicts=('rstudio-server')
24source=('git+https://github.com/rstudio/rstudio.git'
25 'rstudio-server.service'
26 "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/google-gin/gin-${_ginver}.zip"
27 "https://storage.googleapis.com/gwt-releases/gwt-${_gwtver}.zip"
28 "https://nodejs.org/dist/v${_nodever}/node-v${_nodever}-linux-x64.tar.gz"
29)
30md5sums=('SKIP'
31 'eea28f7865720f6c8d5de12f3f631880'
32 'e2617189fe5c138945b8cc95f26bd476'
33 'c295406d68c5ef364e445068599aa6d4'
34 'a46e501a201be6c3c05c0f770c375372')
35
36
37pkgver() {
38 cd "$srcdir/$_gitname"
39 git describe --long --tags | sed -r 's/([^-]*-g)/r\1/;s/-/./g'
40}
41
42prepare () {
43 if test "`archlinux-java get`" != "java-8-openjdk";then
44 cat<<EOT
45 Your default Java version is set to `archlinux-java get`, not java-8-openjdk!
46
47 Fix it with:
48
49 archlinux-java set java-8-openjdk
50
51EOT
52 exit 1
53 fi
54
55 _rstudio_node_version=$(perl -ne 'print "$1" if(m/RSTUDIO_NODE_VERSION\s*"([^"]+)/)' "$srcdir"/rstudio/src/node/CMakeNodeTools.txt)
56 if test "$_nodever" != "$_rstudio_node_version";then
57 cat<<EOT
58 node version in PKGBUILD ($_nodever) does not match what RStudio server expects ($_rstudio_node_version).
59
60 Fix it by updating the \$_nodever variable in the PKGBUILD:
61
62 ...
63 \$_nodever="$_rstudio_node_version"
64 ...
65
66 Then clean the PKGBUILD repo (git clean -ffdx), update the pkgsums (updpkgsums) and rebuild (makepkg -sf)
67
68EOT
69 exit 1
70 fi
71
72 cd ${srcdir}/$_gitname
73 # Patching SOCI
74 # patch -p1 < ${srcdir}/soci.patch
75 # patch -p1 < ${srcdir}/rstudio_boost.patch
76
77 msg "Extracting dependencies..."
78 cd "${srcdir}/${_gitname}/src/gwt"
79 install -d lib/{gin,gwt}
80 install -d lib/gin/${_ginver}
81 install -d lib/gwt/${_gwtver}
82 unzip -qo "${srcdir}/gin-${_ginver}.zip" -d lib/gin/${_ginver}
83 cp -r "${srcdir}/gwt-${_gwtver}/"* lib/gwt/${_gwtver}
84
85 cd "${srcdir}/${_gitname}/dependencies/common"
86 _pandocver=$(grep -oP "(?<=PANDOC_VERSION=\").*(?=\"$)" install-pandoc)
87 install -d pandoc/${_pandocver}
88
89 ln -sfT "/usr/share/myspell/dicts" dictionaries
90 ln -sfT "/usr/share/mathjax2" mathjax-27
91 ln -sfT /opt/quarto quarto
92 ln -sfT "/usr/bin/pandoc" pandoc/${_pandocver}/pandoc
93 ln -sfT "/usr/bin/pandoc-citeproc" pandoc/${_pandocvec}/pandoc-citeproc
94
95 # Nodejs
96 install -d node/${_nodever}
97 cp -r ${srcdir}/node-v${_nodever}-linux-x64/* node/${_nodever}
98 cd ${srcdir}/${_gitname}/src/gwt/panmirror/src/editor
99 yarn config set ignore-engines true
100 yarn install
101
102 # Fix links for src/cpp/session/CMakeLists.txt
103 cd "${srcdir}/${_gitname}/dependencies"
104 ln -sfT common/dictionaries dictionaries
105 ln -sfT common/quarto quarto
106 ln -sfT common/mathjax-27 mathjax-27
107 ln -sfT common/pandoc pandoc
108
109 cd ${srcdir}/${_gitname}/dependencies/common
110 # ./install-dictionaries
111 msg "Downloading and installing R packages..."
112 ./install-packages
113}
114
115
116build() {
117 # Small hack
118 # unset user Rprofile.r variable for building
119 if [ -n $R_PROFILE_USER ]; then
120 unset R_PROFILE_USER
121 fi
122
123 # Configure with cmake in a new build directory as recommended in the rstudio INSTALL file
124 rm -rf ${srcdir}/$_gitname/build
125 mkdir "${srcdir}/$_gitname/build"
126 cd "${srcdir}/$_gitname/build"
127
128 # Configure cmake
129 cmake -DRSTUDIO_TARGET=Server \
130 -DCMAKE_BUILD_TYPE=Release \
131 -DCMAKE_INSTALL_PREFIX=/usr/lib/rstudio-server \
132 -DRSTUDIO_USE_SYSTEM_BOOST=yes \
133 -DRSTUDIO_USE_SYSTEM_YAML_CPP=yes \
134 -DBoost_NO_BOOST_CMAKE=ON \
135 -DRSTUDIO_USE_SYSTEM_SOCI=yes ..
136
137}
138
139
140package() {
141# Install
142 msg "Installing to pkgdir"
143 cd "${srcdir}/$_gitname/build"
144 make DESTDIR="$pkgdir" install
145# Extras (pam, var)
146 msg "Install additional files..."
147 install -d "${pkgdir}/etc/pam.d"
148 install -Dm 644 "${pkgdir}/usr/lib/rstudio-server/extras/pam/rstudio" "${pkgdir}/etc/pam.d/rstudio"
149 # rstudio home directory
150 install -d "${pkgdir}/srv/rstudio-server"
151 install -d "${pkgdir}/usr/lib//systemd/system"
152 install -Dm 644 "${srcdir}/rstudio-server.service" "${pkgdir}/usr/lib//systemd/system/rstudio-server.service"
153 install -d "${pkgdir}/etc/rstudio"
154
155 # vars
156 mkdir -p ${pkgdir}/run/rstudio-server ${pkgdir}/lock/rstudio-server ${pkgdir}/var/log/rstudio-server ${pkgdir}/var/lib/rstudio-server
157
158 # lns
159 mkdir -p $pkgdir/usr/bin
160 ln -s /usr/lib/rstudio-server/bin/rserver $pkgdir/usr/bin/rserver
161 ln -s /usr/lib/rstudio-server/bin/rstudio-server $pkgdir/usr/bin/rstudio-server
162}
163

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion