sonarr-bin

maintainer txtsd · 107 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from the official Sonarr update service (services.sonarr.tv), which is the project's own release infrastructure; despite the non-whitelisted host, this is a legitimate source for the software, and the downloads are verified via sha256sums.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from the official Sonarr update service (services.sonarr.tv), which is the project's own release infrastructure; despite the non-whitelisted host, this is a legitimate source for the software, and the downloads are verified via sha256sums.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:50 source_x86_64=("Sonarr.main.${pkgver}.linux-x64.tar.gz::https://services.sonarr.tv/v1/update/main/download?version=${pkgver}&os=linux&runtime=netcore&arch=x64")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: txtsd <aur.archlinux@ihavea.quest>
    
      2# Maintainer: Donald Webster <fryfrog@gmail.com>
    
      3# Contributor: Daniel Egeberg <daniel.egeberg@gmail.com>
    
      4# Contributor: Justin Dray <justin@dray.be>
    
      5# Helpful URL: https://services.sonarr.tv/v1/releases
    
      6
    
      7pkgname=sonarr-bin
    
      8pkgver=4.0.19.2979
    
      9pkgrel=1
    
      10pkgdesc='Smart PVR for newsgroup and torrent users'
    
      11arch=(x86_64 aarch64 armv7h)
    
      12url='https://sonarr.tv'
    
      13license=('GPL-3.0-or-later')
    
      14groups=(servarr-bin)
    
      15depends=(
    
      16  gcc-libs
    
      17  glibc
    
      18  sqlite
    
      19  zlib
    
      20)
    
      21optdepends=(
    
      22  'postgresql: postgresql database'
    
      23  'sabnzbd: usenet downloader'
    
      24  'nzbget: usenet downloader'
    
      25  'qbittorrent: torrent downloader'
    
      26  'deluge: torrent downloader'
    
      27  'rtorrent: torrent downloader'
    
      28  'nodejs-flood: torrent downloader'
    
      29  'vuze: torrent downloader'
    
      30  'aria2: torrent downloader'
    
      31  'transmission-cli: torrent downloader (CLI and daemon)'
    
      32  'transmission-gtk: torrent downloader (GTK+)'
    
      33  'transmission-qt: torrent downloader (Qt)'
    
      34  'jackett: torrent indexer proxy'
    
      35  'nzbhydra2: torznab and usenet indexer proxy'
    
      36  'prowlarr: torrent and usenet indexer proxy'
    
      37  'autobrr: irc, torrent and usenet indexer proxy'
    
      38)
    
      39provides=(sonarr)
    
      40conflicts=(sonarr)
    
      41options=(!debug)
    
      42install=sonarr.install
    
      43source=(
    
      44  package_info
    
      45  sonarr.service
    
      46  sonarr.sysusers
    
      47  sonarr.tmpfiles
    
      48  sonarr.install
    
      49)
    
      50source_x86_64=("Sonarr.main.${pkgver}.linux-x64.tar.gz::https://services.sonarr.tv/v1/update/main/download?version=${pkgver}&os=linux&runtime=netcore&arch=x64")
    
      51source_aarch64=("Sonarr.main.${pkgver}.linux-arm64.tar.gz::https://services.sonarr.tv/v1/update/main/download?version=${pkgver}&os=linux&runtime=netcore&arch=arm64")
    
      52source_armv7h=("Sonarr.main.${pkgver}.linux-arm.tar.gz::https://services.sonarr.tv/v1/update/main/download?version=${pkgver}&os=linux&runtime=netcore&arch=arm")
    
      53sha256sums=('ea2073b568f98dc9d7a91ce11f279d2d8b5a5bb8bad01136a05cb7907e00bd47'
    
      54            'a5fc162aeafb2c6322176db736a503047a39f2740eea4dead05438ed47187fbd'
    
      55            '00141d4cbf34daa6d91b26179d4847ec970e2767382e18fdf9af2ec84a0ff43e'
    
      56            'd6b18a83dd9c213470d984f71ddcefcd64d12bb87f68225cc4ebf5fa4a831703'
    
      57            '3d912d367eeb89ead06dc9dc45de093f48ddc601188731d54775c33e04e369aa')
    
      58sha256sums_x86_64=('b691b3584c31c0b5514058dee81071c923f63d59a37d19e32f92fa13eaa153db')
    
      59sha256sums_aarch64=('8d97be4a554b12293c26dbc2a4606f424d7226b522a975048824ecf941a21aa5')
    
      60sha256sums_armv7h=('98cfa55e7bd9d4ef197ce0e1cc1789509caf033f970d5529ae1f053056ba92d3')
    
      61
    
      62package() {
    
      63  install -dm755 "${pkgdir}/usr/lib/sonarr/bin"
    
      64
    
      65  # License
    
      66  install -Dm644 Sonarr/LICENSE.md "${pkgdir}/usr/share/licenses/${pkgname}"
    
      67  rm Sonarr/LICENSE.md
    
      68
    
      69  # Remove Service Helpers, and Update files
    
      70  rm Sonarr/ServiceInstall*
    
      71  rm Sonarr/ServiceUninstall*
    
      72  rm -rf Sonarr/Sonarr.Update
    
      73
    
      74  # Disable built in updater.
    
      75  install -Dm644 package_info "${pkgdir}/usr/lib/sonarr"
    
      76  echo "PackageVersion=${pkgver}-${pkgrel}" >> "${pkgdir}/usr/lib/sonarr/package_info"
    
      77
    
      78  # Copy Sonarr
    
      79  cp -dr Sonarr/* "${pkgdir}/usr/lib/sonarr/bin"
    
      80
    
      81  # Systemd
    
      82  install -Dm644 sonarr.service "${pkgdir}/usr/lib/systemd/system/sonarr.service"
    
      83  install -Dm644 sonarr.sysusers "${pkgdir}/usr/lib/sysusers.d/sonarr.conf"
    
      84  install -Dm644 sonarr.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/sonarr.conf"
    
      85}
    
      86

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2