craftbukkit-plugin-worldguard

maintainer orphaned · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

broken

Why flagged The source is a prebuilt JAR downloaded from dev.bukkit.org, which is the official CurseForge/Bukkit project hosting platform — a well-known, legitimate distribution channel for Minecraft plugins. This is not an unofficial or personal host; it is the canonical distribution point for WorldGuard. The file is installed with mode 644 (data, not executed directly by the package manager), and an md5sum is provided for integrity checking. The main concern is that the PKGBUILD is broken: the source filename in noextract and the install command reference different filenames ('worldguard-bukkit-$pkgver.jar' vs 'worldguard-legacy-$pkgver-SNAPSHOT-dist.jar'), and the downloaded URL has no filename component so pacman would save it as 'download', not matching either name. The package cannot build successfully as written. There is no supply-chain attack here — dev.bukkit.org is the official upstream host, the checksum is pinned, and the artifact is a plugin JAR (data/bytecode loaded by an already-running JVM server, not executed at install time by the package manager).

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The source is a prebuilt JAR downloaded from dev.bukkit.org, which is the official CurseForge/Bukkit project hosting platform — a well-known, legitimate distribution channel for Minecraft plugins. This is not an unofficial or personal host; it is the canonical distribution point for WorldGuard. The file is installed with mode 644 (data, not executed directly by the package manager), and an md5sum is provided for integrity checking. The main concern is that the PKGBUILD is broken: the source filename in noextract and the install command reference different filenames ('worldguard-bukkit-$pkgver.jar' vs 'worldguard-legacy-$pkgver-SNAPSHOT-dist.jar'), and the downloaded URL has no filename component so pacman would save it as 'download', not matching either name. The package cannot build successfully as written. There is no supply-chain attack here — dev.bukkit.org is the official upstream host, the checksum is pinned, and the artifact is a plugin JAR (data/bytecode loaded by an already-running JVM server, not executed at install time by the package manager).

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://dev.bukkit.org/projects/worldguard/files/3066271/download")

PKGBUILD

1 offending line(s) highlighted

      1pkgname=craftbukkit-plugin-worldguard
    
      2pkgver=7.0.4
    
      3pkgrel=1
    
      4pkgdesc="plugin providing all the little things (and some big ones), and it protects your servers from various problems."
    
      5arch=(any)
    
      6url="http://enginehub.org/worldguard"
    
      7license=("GPLv3")
    
      8makedepends=(dos2unix)
    
      9depends=("craftbukkit>=1.8.1")
    
      10optdepends=(mariadb)
    
      11source=("https://dev.bukkit.org/projects/worldguard/files/3066271/download")
    
      12noextract=("worldguard-bukkit-$pkgver.jar")
    
      13md5sums=('392e060e34072f3d1c2cc12f619bb9ef')
    
      14
    
      15package() {
    
      16  install -Dm644 worldguard-legacy-$pkgver-SNAPSHOT-dist.jar "$pkgdir/srv/craftbukkit/plugins/worldguard-bukkit-$pkgver.jar"
    
      17  chown craftbukkit:craftbukkit "$pkgdir/srv/craftbukkit/plugins/worldguard-bukkit-$pkgver.jar"
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2