sonarqube-bin
LOW
maintainer lapsus
24 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt binary from SonarSource's official binaries domain, which is the project's legitimate release infrastructure; despite the static analyzer flag for non-whitelisted host, this is a standard and trusted source for the software, and no malicious or unverifiable code execution occurs.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from SonarSource's official binaries domain, which is the project's legitimate release infrastructure; despite the static analyzer flag for non-whitelisted host, this is a standard and trusted source for the software, and no malicious or unverifiable code execution occurs.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:30
curl -fsSL 'https://binaries.sonarsource.com/s3api?delimiter=/&prefix=Distribution/sonarqube/' |
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
source=("https://binaries.sonarsource.com/Distribution/${_pkgname}/${_pkgname}-${pkgver}.zip"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
# Contributor: ksj podhorsky.ksj@gmail.com
3
# Contributor: ParaSait <parasait at proton dot me>
4
5
_pkgname=sonarqube
6
pkgname=sonarqube-bin
7
pkgver=26.10.0.133078
8
pkgrel=1
9
pkgdesc="An open source platform for continuous inspection of code quality (Community Build)"
10
arch=('x86_64')
11
url="https://www.sonarsource.com/products/sonarqube/"
12
license=('LGPL-3.0-only')
13
depends=('java-runtime>=17')
14
optdepends=('postgresql: A sophisticated object-relational DBMS')
15
backup=("etc/webapps/${_pkgname}/sonar.properties")
16
conflicts=("${_pkgname}" "${_pkgname}-lts")
17
provides=("${_pkgname}")
18
options=('!strip' '!debug')
19
source=("https://binaries.sonarsource.com/Distribution/${_pkgname}/${_pkgname}-${pkgver}.zip"
20
"${_pkgname}.service"
21
"${_pkgname}.tmpfiles"
22
"${_pkgname}.sysusers")
23
install="sonarqube-bin.install"
24
sha256sums=('a23716457a73e44fff57c51d8999d97e59f4deee24cefb333918fe6c1ddb62c1'
25
'58c0b2b9ae96a5901b8face8e35481e4c9a7feebdab6b21023805f6814a2fa98'
26
'b0204a7b86289929765c651627e9b55d02ae1f0da34184d2c05c7929d1222932'
27
'198fab7e6a5e9aeab55d080e5b7133be0e315706b159ebfbfb3126ddaf355aa4')
28
29
latestver() {
30
curl -fsSL 'https://binaries.sonarsource.com/s3api?delimiter=/&prefix=Distribution/sonarqube/' |
31
grep -oP 'Distribution/sonarqube/sonarqube-\K[0-9.]+(?=\.zip</Key>)' | sort -Vu | tail -1
32
}
33
34
package() {
35
cd "${srcdir}/${_pkgname}-${pkgver}"
36
37
# Copy everything except conf and logs to /usr/share/webapps/sonarqube.
38
install -dm755 "${pkgdir}/usr/share/webapps/${_pkgname}"
39
cp -dr --no-preserve=ownership {bin,data,elasticsearch,extensions,lib,temp,web} "${pkgdir}/usr/share/webapps/${_pkgname}/"
40
41
# Remove non-Linux platform files.
42
rm -rf "${pkgdir}/usr/share/webapps/${_pkgname}/bin/macosx-universal-64"
43
rm -rf "${pkgdir}/usr/share/webapps/${_pkgname}/bin/windows-x86-64"
44
rm -f "${pkgdir}/usr/share/webapps/${_pkgname}"/elasticsearch/bin/*.bat
45
rm -f "${pkgdir}/usr/share/webapps/${_pkgname}"/elasticsearch/bin/*.exe
46
rm -rf "${pkgdir}/usr/share/webapps/${_pkgname}/elasticsearch/lib/platform/windows-x64"
47
rm -rf "${pkgdir}/usr/share/webapps/${_pkgname}/elasticsearch/lib/platform/darwin-aarch64"
48
rm -rf "${pkgdir}/usr/share/webapps/${_pkgname}/elasticsearch/lib/platform/darwin-x64"
49
rm -rf "${pkgdir}/usr/share/webapps/${_pkgname}/elasticsearch/lib/platform/linux-aarch64"
50
rm -rf "${pkgdir}/usr/share/webapps/${_pkgname}/elasticsearch/lib/tools/windows-service-cli"
51
rm -rf "${pkgdir}/usr/share/webapps/${_pkgname}/bin/winsw-license"
52
53
# ES config files ship as 640; fix so the sonarqube user can read them at runtime.
54
chmod 644 "${pkgdir}/usr/share/webapps/${_pkgname}"/elasticsearch/config/*
55
56
# Install the license.
57
install -Dm644 "COPYING" "${pkgdir}/usr/share/doc/${_pkgname}/COPYING"
58
59
# Install the configuration files to /etc/webapps/sonarqube.
60
install -Dm644 "conf/sonar.properties" "${pkgdir}/etc/webapps/${_pkgname}/sonar.properties"
61
62
# Install the systemd configuration and service files.
63
cd "${srcdir}"
64
install -Dm644 "${_pkgname}.service" "${pkgdir}/usr/lib/systemd/system/${_pkgname}.service"
65
install -Dm644 "${_pkgname}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${_pkgname}.conf"
66
install -Dm644 "${_pkgname}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${_pkgname}.conf"
67
68
# Create symbolic links because SonarQube expects a specific directory layout.
69
ln -s "/var/log/${_pkgname}" "${pkgdir}/usr/share/webapps/${_pkgname}/logs"
70
ln -s "/run/${_pkgname}" "${pkgdir}/usr/share/webapps/${_pkgname}/run"
71
ln -s "/etc/webapps/${_pkgname}" "${pkgdir}/usr/share/webapps/${_pkgname}/conf"
72
rm -rf "${pkgdir}/usr/share/webapps/${_pkgname}/temp"
73
ln -s "/var/lib/${_pkgname}/temp" "${pkgdir}/usr/share/webapps/${_pkgname}/temp"
74
rm -rf "${pkgdir}/usr/share/webapps/${_pkgname}/data"
75
ln -s "/var/lib/${_pkgname}/data" "${pkgdir}/usr/share/webapps/${_pkgname}/data"
76
ln -s "/var/lib/${_pkgname}/downloads" "${pkgdir}/usr/share/webapps/${_pkgname}/extensions/downloads"
77
}
78
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 3 |
| 2026-10-31 00:07:41 | Low | 3 |
| 2026-10-30 00:29:30 | Low | 3 |
| 2026-10-29 00:13:55 | Low | 3 |
| 2026-10-28 00:06:54 | Low | 3 |
| 2026-10-27 00:23:28 | Low | 3 |
| 2026-10-26 00:12:40 | Low | 3 |
| 2026-10-25 00:20:48 | Low | 3 |
| 2026-10-24 00:14:55 | Low | 3 |
| 2026-10-23 00:02:19 | Low | 3 |
| 2026-10-22 00:13:10 | Low | 3 |
| 2026-10-21 00:12:50 | Low | 3 |
| 2026-10-20 00:10:31 | Low | 3 |
| 2026-10-19 00:03:55 | Low | 3 |
| 2026-10-18 00:06:55 | Low | 3 |
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |
| 2026-10-13 00:23:45 | Low | 3 |