rundeck-community

MEDIUM

maintainer automne 2 votes scanned 2026-10-22 15:35:25.555348

View on AUR

Why flagged

The package downloads a prebuilt RPM from a non-standard host (packagecloud.io) which is not the project's official release infrastructure, posing a supply-chain risk if the source were tampered with.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "rundeck-community-${pkgver}-${pkgrel}.noarch.rpm::https://packagecloud.io/pagerduty/rundeck/packages/rpm_any/rpm_any/rundeck-${pkgver}-1.noarch.rpm/download.rpm?distro_version_id=227"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt RPM from a non-standard host (packagecloud.io) which is not the project's official release infrastructure, posing a supply-chain risk if the source were tampered with.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Automne von Einzbern <archlinux@automne.me>
    
      2pkgname=rundeck-community
    
      3pkgver=6.2.1.20260909
    
      4pkgrel=1
    
      5pkgdesc="Rundeck is an open source automation service with a web console, command line tools and a WebAPI"
    
      6arch=('any')
    
      7url="https://www.rundeck.com/open-source"
    
      8license=('Apache')
    
      9depends=('java-runtime>=17' 'postgresql-jdbc')
    
      10makedepends=()
    
      11backup=(
    
      12    'etc/rundeck/admin.aclpolicy'
    
      13    'etc/rundeck/framework.properties'
    
      14    'etc/rundeck/jaas-loginmodule.conf'
    
      15    'etc/rundeck/log4j2.properties'
    
      16    'etc/rundeck/profile'
    
      17    'etc/rundeck/project.properties'
    
      18    'etc/rundeck/realm.properties'
    
      19    'etc/rundeck/rundeck-config.properties'
    
      20    'etc/rundeck/ssl/ssl.properties'
    
      21)
    
      22options=('!strip')
    
      23install=rundeck.install
    
      24source=(
    
      25        "rundeck-community-${pkgver}-${pkgrel}.noarch.rpm::https://packagecloud.io/pagerduty/rundeck/packages/rpm_any/rpm_any/rundeck-${pkgver}-1.noarch.rpm/download.rpm?distro_version_id=227"
    
      26        "rundeckd.service"
    
      27)
    
      28sha256sums=(
    
      29        'd10f0b19a4afffc664c591adaa0badf27aa7a5d140d549a2f6617ae79fd9ab00'
    
      30        'd0fd0c817aa86e1fe43c1d1a5a71465624916ca54fb7405cb09e6b01ac31cca1'
    
      31)
    
      32
    
      33package() {
    
      34    # Create necessary directories
    
      35    install -dm755 "${pkgdir}/etc/rundeck"
    
      36    install -dm755 "${pkgdir}/var/lib/rundeck"
    
      37    install -dm755 "${pkgdir}/var/log/rundeck"
    
      38    install -dm755 "${pkgdir}/var/lib/rundeck/bootstrap"
    
      39    install -dm755 "${pkgdir}/var/lib/rundeck/libext"
    
      40    install -dm755 "${pkgdir}/usr/lib/systemd/system"
    
      41
    
      42    cd "${srcdir}"
    
      43    cp -r etc/rundeck/* "${pkgdir}/etc/rundeck/"
    
      44    cp -r var/lib/rundeck/* "${pkgdir}/var/lib/rundeck/"
    
      45
    
      46    # Install systemd service
    
      47    install -Dm644 "${srcdir}/rundeckd.service" "${pkgdir}/usr/lib/systemd/system/rundeckd.service"
    
      48
    
      49    # Replace war path in systemd service file
    
      50    local war_file
    
      51    war_file=$(find "${srcdir}/var/lib/rundeck/bootstrap" -name "*.war")
    
      52    sed -i "s|_RUNDECK_ENTRYPOINT_|${war_file##*/}|" "${pkgdir}/usr/lib/systemd/system/rundeckd.service"
    
      53
    
      54    find "${pkgdir}/var/lib/rundeck" -type d -exec chmod 755 {} +
    
      55    find "${pkgdir}/var/log/rundeck" -type d -exec chmod 755 {} +
    
      56    find "${pkgdir}/etc/rundeck" -type d -exec chmod 755 {} +
    
      57
    
      58    # Set file permissions
    
      59    find "${pkgdir}/var/lib/rundeck" -type f -exec chmod 644 {} +
    
      60    find "${pkgdir}/var/log/rundeck" -type f -exec chmod 644 {} +
    
      61    find "${pkgdir}/etc/rundeck" -type f -exec chmod 644 {} +
    
      62
    
      63}
    
      64

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:03
+++ PKGBUILD @ 2026-10-22 15:35
@@ -1,12 +1,12 @@
 # Maintainer: Automne von Einzbern <archlinux@automne.me>
 pkgname=rundeck-community
-pkgver=5.17.0.20251103
+pkgver=6.2.1.20260909
 pkgrel=1
 pkgdesc="Rundeck is an open source automation service with a web console, command line tools and a WebAPI"
 arch=('any')
 url="https://www.rundeck.com/open-source"
 license=('Apache')
-depends=('java-runtime>=11' 'postgresql-jdbc')
+depends=('java-runtime>=17' 'postgresql-jdbc')
 makedepends=()
 backup=(
     'etc/rundeck/admin.aclpolicy'
@@ -26,7 +26,7 @@
         "rundeckd.service"
 )
 sha256sums=(
-        'c7852805c7e95cf2cc33f2e4a43da8ea9a2d0bd9d0f811973d71ce70b5114409'
+        'd10f0b19a4afffc664c591adaa0badf27aa7a5d140d549a2f6617ae79fd9ab00'
         'd0fd0c817aa86e1fe43c1d1a5a71465624916ca54fb7405cb09e6b01ac31cca1'
 )
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-22 15:35:25	Medium	2
2026-06-20 16:03:41	Clean	2
2026-06-20 00:50:07	Medium	2
2026-06-20 00:18:46	Medium	2
2026-06-19 23:51:18	Medium	2
2026-06-19 19:07:35	Low	2
2026-06-18 16:11:54	Medium	1