sonarr-develop-bin
LOW
maintainer txtsd
10 votes
scanned 2026-10-02 00:00:32.890515
Why flagged
The package downloads prebuilt binaries from the official Sonarr update service, which is a legitimate source for the software; while the host is not a standard code forge, it is the project's own distribution endpoint, and the downloads are verified with sha256sums, reducing supply-chain risk to low.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the official Sonarr update service, which is a legitimate source for the software; while the host is not a standard code forge, it is the project's own distribution endpoint, and the downloads are verified with sha256sums, reducing supply-chain risk to low.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:50
source_x86_64=("Sonarr.develop.${pkgver}.linux-x64.tar.gz::https://services.sonarr.tv/v1/update/develop/download?version=${pkgver}&os=linux&runtime=netcore&arch=x64")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: txtsd <aur.archlinux@ihavea.quest>
2
# Maintainer: Donald Webster <fryfrog@gmail.com>
3
# Contributor: Daniel Egeberg <daniel.egeberg@gmail.com>
4
# Contributor: Justin Dray <justin@dray.be>
5
# Helpful URL: https://services.sonarr.tv/v1/releases
6
7
pkgname=sonarr-develop-bin
8
pkgver=4.0.20.3012
9
pkgrel=1
10
pkgdesc='Smart PVR for newsgroup and torrent users (develop branch)'
11
arch=(x86_64 aarch64 armv7h)
12
url='https://sonarr.tv'
13
license=('GPL-3.0-or-later')
14
groups=(servarr-develop-bin)
15
depends=(
16
gcc-libs
17
glibc
18
sqlite
19
zlib
20
)
21
optdepends=(
22
'postgresql: postgresql database'
23
'sabnzbd: usenet downloader'
24
'nzbget: usenet downloader'
25
'qbittorrent: torrent downloader'
26
'deluge: torrent downloader'
27
'rtorrent: torrent downloader'
28
'nodejs-flood: torrent downloader'
29
'vuze: torrent downloader'
30
'aria2: torrent downloader'
31
'transmission-cli: torrent downloader (CLI and daemon)'
32
'transmission-gtk: torrent downloader (GTK+)'
33
'transmission-qt: torrent downloader (Qt)'
34
'jackett: torrent indexer proxy'
35
'nzbhydra2: torznab and usenet indexer proxy'
36
'prowlarr: torrent and usenet indexer proxy'
37
'autobrr: irc, torrent and usenet indexer proxy'
38
)
39
provides=(sonarr)
40
conflicts=(sonarr)
41
options=(!debug)
42
install=sonarr.install
43
source=(
44
package_info
45
sonarr.service
46
sonarr.sysusers
47
sonarr.tmpfiles
48
sonarr.install
49
)
50
source_x86_64=("Sonarr.develop.${pkgver}.linux-x64.tar.gz::https://services.sonarr.tv/v1/update/develop/download?version=${pkgver}&os=linux&runtime=netcore&arch=x64")
51
source_aarch64=("Sonarr.develop.${pkgver}.linux-arm64.tar.gz::https://services.sonarr.tv/v1/update/develop/download?version=${pkgver}&os=linux&runtime=netcore&arch=arm64")
52
source_armv7h=("Sonarr.develop.${pkgver}.linux-arm.tar.gz::https://services.sonarr.tv/v1/update/develop/download?version=${pkgver}&os=linux&runtime=netcore&arch=arm")
53
sha256sums=('1a609451c6de4fe0f03c8019e2232b04a552bea98e5863f7e49bba9f00ed05ba'
54
'a5fc162aeafb2c6322176db736a503047a39f2740eea4dead05438ed47187fbd'
55
'00141d4cbf34daa6d91b26179d4847ec970e2767382e18fdf9af2ec84a0ff43e'
56
'd6b18a83dd9c213470d984f71ddcefcd64d12bb87f68225cc4ebf5fa4a831703'
57
'3d912d367eeb89ead06dc9dc45de093f48ddc601188731d54775c33e04e369aa')
58
sha256sums_x86_64=('177467795cc04312e1059b0f0c14a809142d21cc2976277182a465d01b333587')
59
sha256sums_aarch64=('62e74a416af706f75c1d2c15fbdb821a9e5a208980b2d1779d81f25c3594d9b5')
60
sha256sums_armv7h=('ef5bb88cfe06092e117050b40aec78a3f3d804b59d2bc59eadc7d1398ebeb05e')
61
62
package() {
63
install -dm755 "${pkgdir}/usr/lib/sonarr/bin"
64
65
# License
66
install -Dm644 Sonarr/LICENSE.md "${pkgdir}/usr/share/licenses/${pkgname}"
67
rm Sonarr/LICENSE.md
68
69
# Remove Service Helpers, and Update files
70
rm Sonarr/ServiceInstall*
71
rm Sonarr/ServiceUninstall*
72
rm -rf Sonarr/Sonarr.Update
73
74
# Disable built in updater.
75
install -Dm644 package_info "${pkgdir}/usr/lib/sonarr"
76
echo "PackageVersion=${pkgver}-${pkgrel}" >> "${pkgdir}/usr/lib/sonarr/package_info"
77
78
# Copy Sonarr
79
cp -dr Sonarr/* "${pkgdir}/usr/lib/sonarr/bin"
80
81
# Systemd
82
install -Dm644 sonarr.service "${pkgdir}/usr/lib/systemd/system/sonarr.service"
83
install -Dm644 sonarr.sysusers "${pkgdir}/usr/lib/sysusers.d/sonarr.conf"
84
install -Dm644 sonarr.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/sonarr.conf"
85
}
86
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |