urbackup-server-git

maintainer severach · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The cryptopp700.zip is downloaded from cryptopp.com, which is the official upstream source for the Crypto++ library. The checksum is SKIP'd (as are the git sources, which is normal for VCS sources), but this is a well-known, legitimate vendor site. The package also declares 'crypto++' as a runtime dependency, suggesting the zip is used during the build process rather than as a prebuilt binary replacement. The cheaper model flagged this as medium due to the SKIP'd checksum and 'non-whitelisted host', but cryptopp.com is the canonical upstream for Crypto++. The real concern is the missing checksum verification, which is sloppy but not indicative of malicious intent — it's a common pattern in git-based AUR packages where upstream versions change frequently. No obfuscation, no encoded payloads, no exfiltration, no unofficial personal hosting of binaries. This is low severity: sloppy checksum hygiene but not a genuine supply-chain attack vector beyond what any unverified download entails.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The cryptopp700.zip is downloaded from cryptopp.com, which is the official upstream source for the Crypto++ library. The checksum is SKIP'd (as are the git sources, which is normal for VCS sources), but this is a well-known, legitimate vendor site. The package also declares 'crypto++' as a runtime dependency, suggesting the zip is used during the build process rather than as a prebuilt binary replacement. The cheaper model flagged this as medium due to the SKIP'd checksum and 'non-whitelisted host', but cryptopp.com is the canonical upstream for Crypto++. The real concern is the missing checksum verification, which is sloppy but not indicative of malicious intent — it's a common pattern in git-based AUR packages where upstream versions change frequently. No obfuscation, no encoded payloads, no exfiltration, no unofficial personal hosting of binaries. This is low severity: sloppy checksum hygiene but not a genuine supply-chain attack vector beyond what any unverified download entails.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:122 done < <(curl -s "http://buildserver.urbackup.org/urbackup_build_version_${_branchb}.json")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Chris Severance aur.severach AatT spamgourmet.com
    
      2# Contributor: Artem Alabin <kirpicheff@yandex.ru>
    
      3# Contributor: K0n24d <konrad AT knauber DOT net>
    
      4
    
      5# TODO: New version of SQLite. Can we use the distro provided sqlite?
    
      6# TODO: New version of deprecated pbs.py
    
      7# TODO: Implement enclosed sbin patches upstream
    
      8# TODO: Graceful reload like Apache httpd for upgrades to running systems
    
      9# TODO: Version numbers in git tags instead of scanning configuration files
    
      10# TODO: Need to rebuild on upgrade: /var/urbackup/'{UrBackupUpdate.exe,UrBackupUpdate.sig}
    
      11# TODO: New feature: [x] Follow symbolic links on Windows clients
    
      12# TODO: Why don't the libs have versions?
    
      13
    
      14# Build-n-install: makepkg -scCf
    
      15# For running systems, watch htop and upgrade when your urbackup server processes are idle
    
      16# sudo systemctl stop urbackup-server.service
    
      17# sudo pacman -U ...  (makepkg -i doesn't work with git packages)
    
      18# sudo systemctl start urbackup-server.service
    
      19
    
      20# For major version changes clean or rename /urbackup and /var/urbackup
    
      21
    
      22# See the btrfs section in the UrBackup Administration Manual for special instructions.
    
      23# The best configuration is where whole drive btrfs is mounted on /urbackup. The data
    
      24# and the db in /var are on separate spinners.
    
      25
    
      26# To preserve your server identify for clients place these 3 files in with the PKGBUILD
    
      27# and they will be built into the package.
    
      28# server_ident.key
    
      29# server_ident.priv
    
      30# server_ident.pub
    
      31
    
      32if [ ! -s 'PKGBUILD.local' ]; then
    
      33  cat > 'PKGBUILD.local' << EOF
    
      34_opt_BuildClient=0 # Default 0, 0=server, 1=client. You must use makepkg -sCf after changing this.
    
      35_opt_Headless=1    # Default 1, 0=GUI, 1=headless (only applies to client, ignored for server)
    
      36EOF
    
      37fi
    
      38source 'PKGBUILD.local'
    
      39
    
      40set -u
    
      41if [ "${_opt_BuildClient}" -ne 0 ]; then
    
      42  _pkgname='urbackup-client'
    
      43else
    
      44  _pkgname='urbackup-server'
    
      45fi
    
      46pkgname="${_pkgname}-git"
    
      47pkgver=2.4.8client.r48.g487a3c77
    
      48pkgrel=1
    
      49pkgdesc='Client/Server network backup for Windows Workgroups and Linux, builds server or client'
    
      50arch=('i686' 'x86_64' 'armv5' 'armv6h' 'armv6' 'armv7h' 'armv7' 'aarch64')
    
      51url='https://www.urbackup.org/'
    
      52license=('GPL')
    
      53depends=('crypto++' 'fuse')
    
      54makedepends=('python3' 'autoconf' 'git' 'unzip' 'wget')
    
      55provides=("${_pkgname}=${pkgver%.r*}")
    
      56conflicts=("${_pkgname}")
    
      57install="${_pkgname}.install"
    
      58_verwatch=("${url}/download.html" '//hndl\.urbackup\.org/Server/[0-9\.]\+/urbackup-server-\([0-9\.]\+\)\.tar\.gz' 'l')
    
      59_scripts=(
    
      60  'btrfs_create_filesystem_snapshot'
    
      61  'btrfs_remove_filesystem_snapshot'
    
      62  'dattobd_create_filesystem_snapshot'
    
      63  'dattobd_remove_filesystem_snapshot'
    
      64  'lvm_create_filesystem_snapshot'
    
      65  'lvm_remove_filesystem_snapshot'
    
      66)
    
      67_srcdir='urbackup_backend'
    
      68_branchb='2.4.x'
    
      69_branchf='2.4.x'
    
      70source=("git+https://github.com/uroni/urbackup_backend.git#branch=${_branchb}" "git+https://github.com/uroni/urbackup_frontend_wx.git#branch=${_branchf}")
    
      71#source=("git+https://github.com/uroni/urbackup_backend.git#commit=9df2ba394f29ee86ad56fdd93179768aca3691fa" "git+https://github.com/uroni/urbackup_frontend_wx.git#commit=70378bf100c5d88e3342a4448c11a0cce83edc30")
    
      72source+=("${_scripts[@]}" 'defaults_client')
    
      73_cryptopp='cryptopp700.zip'
    
      74source+=("https://www.cryptopp.com/${_cryptopp}")
    
      75noextract=("${_cryptopp}")
    
      76sha256sums=('SKIP'
    
      77            'SKIP'
    
      78            '18b5eceb73086b86d904f80e9270df121d06d7c683f93c5449a82e7deb38e0ee'
    
      79            '334d9eb67a642d96e04874fd27c1b57d578c35b4cdc768d50db7ac2436f0927c'
    
      80            '869e6244efbf6e370938e2e5c94a16c0130f583815ddbd34802578656989048b'
    
      81            '23d6bdad352d33fe41acd50e0114f986cd4324c2c65ca16cea365cb99d90addd'
    
      82            'd5b462879e7c80139688c9d20ce1b1fe553386df9459def5e1d093d3a13d71fb'
    
      83            '0ffb3bbbf5faf939564681d24786767a4706132f2f081b7a870ecc718a8e9413'
    
      84            'd77fa6ad67141ae5cb4c3c6953783ce54aaaa3c1f2fe5bb28cd20948ddda12c4'
    
      85            'a4bc939910edd3d29fb819a6fc0dfdc293f686fa62326f61c56d72d0a366ceb0')
    
      86if [ "${_opt_BuildClient}" -ne 0 ]; then
    
      87  unset install
    
      88  if [ "${_opt_Headless}" -eq 0 ]; then
    
      89    depends+=('wxgtk')
    
      90  fi
    
      91else
    
      92  optdepends=('btrfs-progs: compressed and subvolume assisted backups')
    
      93fi
    
      94
    
      95_fn_getversion() {
    
      96  export _urverdone='x'
    
      97  declare -gA _urversion
    
      98  #local _branch="$(git branch)"
    
      99  #_branch="${_branch##\* }"
    
      100
    
      101  local _line
    
      102  local _build
    
      103  while read -r _line; do
    
      104    local _tab=$'\t'
    
      105    _line="${_line//\"/}"
    
      106    _line="${_line//,/}"
    
      107    _line="${_line//\{/}"
    
      108    _line="${_line//\}/}"
    
      109    _line="${_line//${_tab}/}"
    
      110    _line="${_line## *}"
    
      111    printf '%q\n' "${_line}" 1>&2
    
      112    if [ ! -z "${_line}" ]; then
    
      113      case "${_line}" in
    
      114      [a-z]*':') _build="${_line%%:}";;
    
      115      [a-z]*': '[0-9\.]*)
    
      116        local _val="${_line##[a-z]*: }"
    
      117        local _key="${_line%%: [0-9\.]*}"
    
      118        _urversion["${_build}.${_key}"]="${_val}"
    
      119        ;;
    
      120      esac
    
      121    fi
    
      122  done < <(curl -s "http://buildserver.urbackup.org/urbackup_build_version_${_branchb}.json")
    
      123  _urversion['server.full_rev']="${_urversion[server.full]} Rev. $(git rev-parse HEAD)"
    
      124  echo "server.full_rev=${_urversion['server.full_rev']}"
    
      125  local _clar
    
      126  # _urversion['client.full']='03.000.02' # for testing zero trim
    
      127  IFS='.' _clar=(${_urversion['client.full']}) # split
    
      128  printf ' %s' "${_clar[@]}"; echo ''
    
      129  local _clarkey
    
      130  for _clarkey in "${!_clar[@]}"; do
    
      131    echo "${_clarkey}:${_clar[${_clarkey}]}"
    
      132    if [[ ! "${_clar[${_clarkey}]}" =~ ^[0-9]+$ ]]; then
    
      133      _clar["${_clarkey}"]="${_clar[${_clarkey}]%%[^0-9]*}" # it's a git package, we don't need beta
    
      134    fi
    
      135    _clar["${_clarkey}"]=$((_clar[${_clarkey}]+0)) # trim leading zeros
    
      136  done
    
      137  _urversion['client.ver_major']="${_clar[0]}"
    
      138  _urversion['client.ver_minor']=$(( ${_clar[1]}*1000 + ${_clar[2]}))
    
      139  local _clarx="${_clar[@]}"
    
      140  _urversion['client.num_short']="${_clarx// /.}" # join
    
      141}
    
      142
    
      143pkgver() {
    
      144  set -u
    
      145  cd "${_srcdir}"
    
      146  cd 'client' || :
    
      147  local _gitver="$(git describe --long --tags | sed -e 's/\([^-]*-g\)/r\1/' -e 's/-/./g')"
    
      148  # The BUILDID is not supplied so is always zero
    
      149  local _filever="$(sed -n -e 's:^.*\[\([0-9\.]\+\)BUILDID.*$:\1:p' 'configure.ac_server')"
    
      150  #^#define VERSION "\([^"]*\)"$:\1:p' 'configure.ac_server')" #'
    
      151  if [ ! -z "${_filever}" ]; then
    
      152    _gitver="$(git describe --long --tags)"
    
      153    _gitver="r${_gitver#*-}"
    
      154    _gitver="${_gitver//-/.}"
    
      155    _gitver="${_filever}${_gitver}"
    
      156  fi
    
      157  echo "${_gitver}"
    
      158  set +u
    
      159}
    
      160
    
      161prepare() {
    
      162  set -u
    
      163  cd "${_srcdir}"
    
      164  git reset --hard
    
      165
    
      166  # Some patches
    
      167  local _files
    
      168  readarray -t _files <<<"$(grep --exclude-dir='.git' -lrF '/sbin/')"
    
      169  sed -e 's:/usr/sbin/:/usr/bin/:g' \
    
      170      -e 's:/sbin/:/usr/bin/:g' \
    
      171    -i "${_files[@]}"
    
      172  unset _files
    
      173
    
      174  sed -e 's,"C:\\\\urbackup",\n#ifdef _WIN32\n&\n#else\n"/urbackup"\n#endif\n,g' -i 'urbackupserver/server_settings.cpp' # Irksome bug!
    
      175
    
      176  cp -p 'build_server.sh' 'build_server.Arch.sh'
    
      177  cp -p 'build_client.sh' 'build_client.Arch.sh'
    
      178
    
      179  sed -e '# Block make so makepkg -e so works properly' \
    
      180      -e 's:^make:# &:g' \
    
      181      -e '# git reset does not apply to us. It would undo all my patches' \
    
      182      -e 's:^git reset:#&:g' \
    
      183      -e "# Version updates are now done here in PKGBUILD" \
    
      184      -e '/replace_versions.py/ s:^:#&:g' \
    
      185    -i 'build_server.Arch.sh' 'build_client.Arch.sh'
    
      186
    
      187  _fn_getversion
    
      188  # We don't need this. This is to make it readable to ensure we're doing the same thing.
    
      189  expand -i -t8 'build/replace_versions.py' | \
    
      190  sed -e 's:\r$::g' > 'build/replace_versions.Arch.py'
    
      191
    
      192  # Branding
    
      193  sed -e 's:\$version_short\$'":${_urversion[server.short]} Arch Linux:g" -i 'urbackupserver/www/index.htm'
    
      194
    
      195  local _files
    
      196  readarray -t _files <<<"$(grep --exclude-dir='.git' --include '*client*' -lrF '$version_short$')"
    
      197  sed -e 's:\$version_short\$'":${_urversion[client.short]}:g" -i "${_files[@]}"  # must be done first
    
      198  unset _files
    
      199
    
      200  local _files
    
      201  readarray -t _files <<<"$(grep --exclude-dir='.git' -lrF $'$version_short$\n$version_full_numeric$\n$version_full$\n$version_num_short$\n$version_maj$\n$version_min$')"
    
      202  sed -e 's:\$version_short\$'":${_urversion[server.short]}:g" \
    
      203      -e 's:\$version_full_numeric\$'":${_urversion[server.full_numeric]}:g" \
    
      204      -e 's:\$version_full\$'":${_urversion[server.full_rev]}:g" \
    
      205      -e 's:\$version_num_short\$'":${_urversion[client.num_short]}:g" \
    
      206      -e 's:\$version_maj\$'":${_urversion[client.ver_major]}:g" \
    
      207      -e 's:\$version_min\$'":${_urversion[client.ver_minor]}:g" \
    
      208    -i "${_files[@]}"
    
      209  unset _files
    
      210  test -z "$(grep --exclude-dir='.git' -lrF '$version_')" || echo "${}" # more $versions were added
    
      211  # replace_in_file("client/urbackup.wxi", "$product_id$", str(uuid.uuid1())) # Don't need this!
    
      212
    
      213  # Correct some CRLF. cryptopp will be converted by unzip -a
    
      214  local _files
    
      215  readarray -t _files <<<"$(grep --exclude-dir='.git' -lrF $'\r')"
    
      216  sed -e 's:\r$::g' -i "${_files[@]}"
    
      217  unset _files
    
      218
    
      219  # Doing the hashes is easier in sed too. We catch a few that the py misses.
    
      220  pushd 'urbackupserver/www' > /dev/null
    
      221  local _hashfile _newhashfile _hashmd5
    
      222  local _sedcmds=()
    
      223  for _hashfile in css/* js/*; do
    
      224    if [ -f "${_hashfile}" ] && grep -qFe "${_hashfile}" 'help.htm' 'index.htm' 'license.htm'; then
    
      225      _hashmd5="$(md5sum < "${_hashfile}" | cut -d' ' -f1)"
    
      226      _newhashfile="${_hashfile/\./.chash-${_hashmd5}.}"
    
      227      _sedcmds+=('-e' "s:${_hashfile}:${_newhashfile}:g")
    
      228      cp -p "${_hashfile}" "${_newhashfile}"
    
      229    fi
    
      230  done
    
      231  sed "${_sedcmds[@]}" -i 'help.htm' 'index.htm' 'license.htm'
    
      232  unset _sedcmds
    
      233  popd > /dev/null
    
      234
    
      235  # Change wget to symlink
    
      236  sed -e 's:^\s*wget :ln -s "'"${startdir}"'/\${CRYPTOPP_NAME}" # &:g' \
    
      237      -e '# Fix CRLF -> LF' \
    
      238      -e 's:unzip -:&a:g' \
    
      239    -i 'download_cryptopp.sh'
    
      240
    
      241  local CRYPTOPP_NAME=''
    
      242  source <(grep '^CRYPTOPP_NAME=' 'download_cryptopp.sh')
    
      243  test ! -z "${CRYPTOPP_NAME}" || echo "${}"
    
      244  if [ "${CRYPTOPP_NAME}" != "${_cryptopp}" ]; then
    
      245    set +u
    
      246    msg "Update PKGBUILD with _cryptopp='${CRYPTOPP_NAME}'"
    
      247    false
    
      248  fi
    
      249
    
      250  sed -e 's:byte digest:unsigned char digest:g' -i 'md5.h'
    
      251  cat >> 'cryptoplugin/cryptopp_inc.h' <<EOF
    
      252
    
      253#if (CRYPTOPP_VERSION >= 600) && (__cplusplus >= 201103L)
    
      254    using byte = CryptoPP::byte;
    
      255#else
    
      256    typedef unsigned char byte;
    
      257#endif
    
      258EOF
    
      259
    
      260  if [ "${_opt_BuildClient}" -ne 0 ]; then
    
      261    ln -sf '../urbackup_frontend_wx' 'client'
    
      262
    
      263    # replace_in_file("urbackupserver_installer_win/urbackup_server.wxi", "$product_id$", str(uuid.uuid1())) Don't need this!
    
      264    pushd 'client' > /dev/null
    
      265    local _files
    
      266    readarray -t _files <<<"$(grep --exclude-dir='.git' -lrF $'$version_short$\n$version_full_numeric$\n$version_full$\n$version_num_short$\n$version_maj$\n$version_min$')"
    
      267    sed -e 's:\$version_short\$'":${_urversion[client.short]}:g" \
    
      268        -e 's:\$version_full_numeric\$'":${_urversion[client.full_numeric]}:g" \
    
      269      -i "${_files[@]}"
    
      270    unset _files
    
      271    test -z "$(grep --exclude-dir='.git' -lrF '$version_')" || echo "${}" # more $versions were added
    
      272    popd > /dev/null
    
      273
    
      274    if [ "${_opt_Headless}" -eq 0 ]; then
    
      275      sed -e '# Fix configure line' \
    
      276          -e 's:^\(\s*\)./configure.*$:  ./configure --prefix="/usr" --sbindir="/usr/bin" --localstatedir="/var":g' \
    
      277        -i 'build_client.Arch.sh'
    
      278    else
    
      279      sed -e '# Fix configure line' \
    
      280          -e 's:^\(\s*\)./configure.*$:  ./configure --prefix="/usr" --sbindir="/usr/bin" --localstatedir="/var" --enable-headless:g' \
    
      281        -i 'build_client.Arch.sh'
    
      282    fi
    
      283    set +u; msg2 'Build Client'; set -u
    
      284    set -x
    
      285    sh -u -e 'build_client.Arch.sh'
    
      286    set +x
    
      287  else
    
      288    rm -f 'client' # in case we switch from client to server
    
      289    sed -e '# Fix configure line' \
    
      290        -e 's:^\(\s*\)./configure.*$:& --prefix="/usr" --sbindir="/usr/bin" --sysconfdir="/etc" --localstatedir="/var" --enable-packaging --with-mountvhd:g' \
    
      291      -i 'build_server.Arch.sh'
    
      292    set +u; msg2 'Build Server'; set -u
    
      293    set -x
    
      294    sh -u -e 'build_server.Arch.sh'
    
      295    set +x
    
      296  fi
    
      297  rm 'build_server.Arch.sh' 'build_client.Arch.sh'
    
      298  set +u
    
      299}
    
      300
    
      301build() {
    
      302  set -u
    
      303  cd "${_srcdir}"
    
      304  local _makeopts=()
    
      305  if [ -z "${MAKEFLAGS:-}" ] || [ "${MAKEFLAGS//-j/}" = "${MAKEFLAGS}" ]; then
    
      306    local _nproc="$(nproc)"; _nproc=$((_nproc>8?8:_nproc))
    
      307    _makeopts=(-j "${_nproc}")
    
      308  fi
    
      309  nice make -s "${_makeopts[@]}"
    
      310  set +u; msg2 'make dist'; set -u
    
      311  nice make -s "${_makeopts[@]}" dist
    
      312  set +u
    
      313}
    
      314
    
      315package() {
    
      316  set -u
    
      317  cd "${_srcdir}"
    
      318
    
      319  make -s -j1 DESTDIR="${pkgdir}" install
    
      320
    
      321  if [ "${_opt_BuildClient}" -ne 0 ]; then
    
      322    # urbackup2 client uses a different service name. Changing the server name is not cool.
    
      323    install -Dpm644 'urbackupclientbackend-debian.service' "${pkgdir}/usr/lib/systemd/system/urbackup-client.service"
    
      324    # urbackup2 client changed the service name.
    
      325    ln -s 'urbackup-client.service' "${pkgdir}/usr/lib/systemd/system/urbackupclientbackend.service"
    
      326    sed -i -e 's:/usr/local/sbin/:/usr/bin/:g' "${pkgdir}/usr/lib/systemd/system/urbackup-client.service"
    
      327    install -Dpm644 "docs/urbackupclientbackend.1" -t "${pkgdir}/usr/share/man/man1/"
    
      328    cd "${srcdir}"
    
      329    install -Dpm644 'defaults_client' "${pkgdir}/etc/default/urbackupclient"
    
      330    install -Dpm700 "${_scripts[@]}" -t "${pkgdir}/usr/share/urbackup/"
    
      331  else
    
      332    # Correct some file mode bits, thanks cfstras (from urbackup2)
    
      333    chmod a+x "${pkgdir}/usr/share/urbackup/www/"{css,fonts,js,images,}
    
      334
    
      335    local _serverkey
    
      336    for _serverkey in 'server_ident.key' 'server_ident.priv' 'server_ident.pub'; do
    
      337      install -Dpm644 "${startdir}/${_serverkey}" "${pkgdir}/var/urbackup/${_serverkey}" || :
    
      338    done
    
      339
    
      340    # special btrfs support
    
      341    install -Dpm644 <(echo '/urbackup') "${pkgdir}/etc/urbackup/backupfolder"
    
      342
    
      343    install -Dpm644 'urbackup-server.service' -t "${pkgdir}/usr/lib/systemd/system/"
    
      344    install -Dpm644 'urbackup-server-firewalld.xml' -t "${pkgdir}/usr/lib/firewalld/services/"
    
      345    install -Dpm644 'logrotate_urbackupsrv' "${pkgdir}/etc/logrotate.d/urbackupsrv"
    
      346    install -Dpm644 'docs/urbackupsrv.1' -t "${pkgdir}/usr/share/man/man1/"
    
      347    install -Dpm644 'defaults_server' -t "${pkgdir}/etc/default/urbackupsrv/"
    
      348  fi
    
      349
    
      350  set +u
    
      351}
    
      352set +u
    
      353# vim: ts=2
    
      354

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2