urbackup2-server

maintainer funilrys · 15 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the project's official domain (urbackup.org) used for building the software, which is a normal and safe practice despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official domain (urbackup.org) used for building the software, which is a normal and safe practice despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://hndl.urbackup.org/Server/${pkgver}/urbackup-server-${pkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nissar Chababy <funilrys at outlook dot com>
    
      2# Ex-Maintainer: K0n24d <konrad AT knauber DOT net>
    
      3pkgname=urbackup2-server
    
      4pkgver=2.5.38
    
      5pkgrel=1
    
      6pkgdesc="Client Server backup system"
    
      7arch=('i686' 'x86_64' 'armv5' 'armv6h' 'armv6' 'armv7h' 'armv7' 'aarch64')
    
      8url="http://www.urbackup.org/"
    
      9license=('GPL')
    
      10makedepends=('gcc-libs' 'gcc' 'make')
    
      11depends=('sqlite' 'crypto++' 'curl' 'fuse' 'zlib')
    
      12conflicts=('urbackup-server')
    
      13backup=("etc/default/urbackupsrv")
    
      14source=(
    
      15    "https://hndl.urbackup.org/Server/${pkgver}/urbackup-server-${pkgver}.tar.gz"
    
      16    "md5-bytes.patch"
    
      17)
    
      18install='urbackup.install'
    
      19sha512sums=('871f5569b3d621f22af01e122a1fb78620d6413c38184fbf0f0bfe4652063a55530ded58404e1fb01ff90c2c8bf425616b68db288927ad9689158844113cc6d0'
    
      20            '34e25c868cf4572414fbc6c693877127152f9a97edf8865b4263a55cf16f71a5045ba96b1a9af8244ed49c35cab56e3fdb44348d191e9f85e2efb66392907132')
    
      21
    
      22CFLAGS="-march=native -O2 -pipe -fstack-protector-strong"
    
      23CXXFLAGS="${CFLAGS}"
    
      24CPPFLAGS="${CPPFLAGS} -DNDEBUG"
    
      25MAKEFLAGS="-j$(nproc)"
    
      26
    
      27build() {
    
      28    sed  -i '/\#include \"cryptopp_inc.h\"/a #include "assert.h"' "${srcdir}/urbackup-server-${pkgver}/cryptoplugin/AESGCMDecryption.h"
    
      29
    
      30    patch -d"${srcdir}/urbackup-server-${pkgver}" -p0 < "${srcdir}/md5-bytes.patch"
    
      31
    
      32    cd "${srcdir}/urbackup-server-${pkgver}"
    
      33    ./configure --prefix=/usr --sbindir=/usr/bin --sysconfdir=/etc \
    
      34    --localstatedir=/var --enable-packaging \
    
      35    --with-mountvhd --with-zlib --with-libcurl \
    
      36    --enable-embedded-cryptopp
    
      37
    
      38    make
    
      39}
    
      40
    
      41package() {
    
      42    cd "${srcdir}/urbackup-server-${pkgver}"
    
      43
    
      44    make DESTDIR=$pkgdir install
    
      45
    
      46    # Correct some file mode bits, thanks cfstras
    
      47    chmod a+x "${pkgdir}/usr/share/urbackup/www/"{css,fonts,js,images,}
    
      48
    
      49    install -Dm644 "${srcdir}/urbackup-server-${pkgver}"/urbackup-server.service \
    
      50    "${pkgdir}"/usr/lib/systemd/system/urbackup-server.service
    
      51    install -Dm644 "${srcdir}/urbackup-server-${pkgver}"/urbackup-server-firewalld.xml \
    
      52    "${pkgdir}"/usr/lib/firewalld/services/urbackup-server-firewalld.xml
    
      53    install -Dm644 "${srcdir}/urbackup-server-${pkgver}"/logrotate_urbackupsrv \
    
      54    "${pkgdir}"/etc/logrotate.d/urbackupsrv
    
      55    install -Dm644 "${srcdir}/urbackup-server-${pkgver}"/docs/urbackupsrv.1 \
    
      56    "${pkgdir}"/usr/share/man/man1/urbackupsrv.1
    
      57    install -Dm644 "${srcdir}/urbackup-server-${pkgver}"/defaults_server \
    
      58    "${pkgdir}"/etc/default/urbackupsrv
    
      59}
    
      60# vim: ts=2
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2