sonarr-develop-bin

maintainer txtsd · 10 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads prebuilt binaries from the project's official update service (services.sonarr.tv), which is a legitimate source for Sonarr; despite the non-whitelisted host, the download is verifiable via provided and matching checksums, and the installed content is the expected application files without any obfuscated or malicious behavior.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official update service (services.sonarr.tv), which is a legitimate source for Sonarr; despite the non-whitelisted host, the download is verifiable via provided and matching checksums, and the installed content is the expected application files without any obfuscated or malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:50 source_x86_64=("Sonarr.develop.${pkgver}.linux-x64.tar.gz::https://services.sonarr.tv/v1/update/develop/download?version=${pkgver}&os=linux&runtime=netcore&arch=x64")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: txtsd <aur.archlinux@ihavea.quest>
    
      2# Maintainer: Donald Webster <fryfrog@gmail.com>
    
      3# Contributor: Daniel Egeberg <daniel.egeberg@gmail.com>
    
      4# Contributor: Justin Dray <justin@dray.be>
    
      5# Helpful URL: https://services.sonarr.tv/v1/releases
    
      6
    
      7pkgname=sonarr-develop-bin
    
      8pkgver=4.0.19.3001
    
      9pkgrel=1
    
      10pkgdesc='Smart PVR for newsgroup and torrent users (develop branch)'
    
      11arch=(x86_64 aarch64 armv7h)
    
      12url='https://sonarr.tv'
    
      13license=('GPL-3.0-or-later')
    
      14groups=(servarr-develop-bin)
    
      15depends=(
    
      16  gcc-libs
    
      17  glibc
    
      18  sqlite
    
      19  zlib
    
      20)
    
      21optdepends=(
    
      22  'postgresql: postgresql database'
    
      23  'sabnzbd: usenet downloader'
    
      24  'nzbget: usenet downloader'
    
      25  'qbittorrent: torrent downloader'
    
      26  'deluge: torrent downloader'
    
      27  'rtorrent: torrent downloader'
    
      28  'nodejs-flood: torrent downloader'
    
      29  'vuze: torrent downloader'
    
      30  'aria2: torrent downloader'
    
      31  'transmission-cli: torrent downloader (CLI and daemon)'
    
      32  'transmission-gtk: torrent downloader (GTK+)'
    
      33  'transmission-qt: torrent downloader (Qt)'
    
      34  'jackett: torrent indexer proxy'
    
      35  'nzbhydra2: torznab and usenet indexer proxy'
    
      36  'prowlarr: torrent and usenet indexer proxy'
    
      37  'autobrr: irc, torrent and usenet indexer proxy'
    
      38)
    
      39provides=(sonarr)
    
      40conflicts=(sonarr)
    
      41options=(!debug)
    
      42install=sonarr.install
    
      43source=(
    
      44  package_info
    
      45  sonarr.service
    
      46  sonarr.sysusers
    
      47  sonarr.tmpfiles
    
      48  sonarr.install
    
      49)
    
      50source_x86_64=("Sonarr.develop.${pkgver}.linux-x64.tar.gz::https://services.sonarr.tv/v1/update/develop/download?version=${pkgver}&os=linux&runtime=netcore&arch=x64")
    
      51source_aarch64=("Sonarr.develop.${pkgver}.linux-arm64.tar.gz::https://services.sonarr.tv/v1/update/develop/download?version=${pkgver}&os=linux&runtime=netcore&arch=arm64")
    
      52source_armv7h=("Sonarr.develop.${pkgver}.linux-arm.tar.gz::https://services.sonarr.tv/v1/update/develop/download?version=${pkgver}&os=linux&runtime=netcore&arch=arm")
    
      53sha256sums=('1a609451c6de4fe0f03c8019e2232b04a552bea98e5863f7e49bba9f00ed05ba'
    
      54            'a5fc162aeafb2c6322176db736a503047a39f2740eea4dead05438ed47187fbd'
    
      55            '00141d4cbf34daa6d91b26179d4847ec970e2767382e18fdf9af2ec84a0ff43e'
    
      56            'd6b18a83dd9c213470d984f71ddcefcd64d12bb87f68225cc4ebf5fa4a831703'
    
      57            '3d912d367eeb89ead06dc9dc45de093f48ddc601188731d54775c33e04e369aa')
    
      58sha256sums_x86_64=('e26bea857fb40af7f6ba3e8dda216dc5f0a7c0f74ec0703ac1e2c48a04dd1661')
    
      59sha256sums_aarch64=('981ac56c8f88d1d8f77eac50ca2a6c4a261ad8480fc4efa480fcde160ba4c26c')
    
      60sha256sums_armv7h=('64ac2cd991e901a8c21a917ebfcb7618d48daa414ffc82ad7f2e4bc0a94a5324')
    
      61
    
      62package() {
    
      63  install -dm755 "${pkgdir}/usr/lib/sonarr/bin"
    
      64
    
      65  # License
    
      66  install -Dm644 Sonarr/LICENSE.md "${pkgdir}/usr/share/licenses/${pkgname}"
    
      67  rm Sonarr/LICENSE.md
    
      68
    
      69  # Remove Service Helpers, and Update files
    
      70  rm Sonarr/ServiceInstall*
    
      71  rm Sonarr/ServiceUninstall*
    
      72  rm -rf Sonarr/Sonarr.Update
    
      73
    
      74  # Disable built in updater.
    
      75  install -Dm644 package_info "${pkgdir}/usr/lib/sonarr"
    
      76  echo "PackageVersion=${pkgver}-${pkgrel}" >> "${pkgdir}/usr/lib/sonarr/package_info"
    
      77
    
      78  # Copy Sonarr
    
      79  cp -dr Sonarr/* "${pkgdir}/usr/lib/sonarr/bin"
    
      80
    
      81  # Systemd
    
      82  install -Dm644 sonarr.service "${pkgdir}/usr/lib/systemd/system/sonarr.service"
    
      83  install -Dm644 sonarr.sysusers "${pkgdir}/usr/lib/sysusers.d/sonarr.conf"
    
      84  install -Dm644 sonarr.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/sonarr.conf"
    
      85}
    
      86

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-18 00:03
@@ -5,7 +5,7 @@
 # Helpful URL: https://services.sonarr.tv/v1/releases
 
 pkgname=sonarr-develop-bin
-pkgver=4.0.19.2995
+pkgver=4.0.19.3001
 pkgrel=1
 pkgdesc='Smart PVR for newsgroup and torrent users (develop branch)'
 arch=(x86_64 aarch64 armv7h)
@@ -55,9 +55,9 @@
             '00141d4cbf34daa6d91b26179d4847ec970e2767382e18fdf9af2ec84a0ff43e'
             'd6b18a83dd9c213470d984f71ddcefcd64d12bb87f68225cc4ebf5fa4a831703'
             '3d912d367eeb89ead06dc9dc45de093f48ddc601188731d54775c33e04e369aa')
-sha256sums_x86_64=('f1855fdeb390c3d312cd20160337d7caf59a69c101991d83517b63a274dd1532')
-sha256sums_aarch64=('1d6fc413c8393afd4ff73f4a48e388fd34f6be2842db99887182fc279d320cb6')
-sha256sums_armv7h=('b4f9bcc0e07c9bfb9299ee06942aa3459757783553dd4070ed2d602af1d9adb4')
+sha256sums_x86_64=('e26bea857fb40af7f6ba3e8dda216dc5f0a7c0f74ec0703ac1e2c48a04dd1661')
+sha256sums_aarch64=('981ac56c8f88d1d8f77eac50ca2a6c4a261ad8480fc4efa480fcde160ba4c26c')
+sha256sums_armv7h=('64ac2cd991e901a8c21a917ebfcb7618d48daa414ffc82ad7f2e4bc0a94a5324')
 
 package() {
   install -dm755 "${pkgdir}/usr/lib/sonarr/bin"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 13:21:13	MEDIUM	1
2026-07-28 00:07:28	CLEAN	2
2026-07-27 09:34:56	MEDIUM	1
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 23:31:22	MEDIUM	1
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2