cuberite-bin

maintainer edh · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt Cuberite server binaries from the project's official build server (builds.cuberite.org) and a management script from GitHub; while the host is not a standard CDN, it is project-specific and checksums are provided, reducing risk—worst case is supply-chain compromise of official build infrastructure, but no obfuscated or untrusted remote code execution is involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Cuberite server binaries from the project's official build server (builds.cuberite.org) and a management script from GitHub; while the host is not a standard CDN, it is project-specific and checksums are provided, reducing risk—worst case is supply-chain compromise of official build infrastructure, but no obfuscated or untrusted remote code execution is involved.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source_i686=("Cuberite.b${_build_i686}_i686.tar.gz"::"https://builds.cuberite.org/view/all/job/linux-i386/${_build_i686}/artifact/Cuberite.tar.gz")

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:77 chmod g+s "${pkgdir}${_server_root}"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Gordian Edenhofer <gordian.edenhofer@gmail.com>
    
      2
    
      3_pkgname=cuberite
    
      4pkgname=cuberite-bin
    
      5_pkgver=1.12.2
    
      6_build_i686=394
    
      7_build_x86_64=385
    
      8_build_armv7h=391
    
      9pkgver="${_pkgver}b${_build_x86_64}"
    
      10pkgrel=2
    
      11_mng_ver=1.0.4
    
      12pkgdesc="A Minecraft-compatible multiplayer game server that is written in C++ and designed to be efficient with memory and CPU, as well as having a flexible Lua Plugin API. It is compatible with the vanilla Minecraft client."
    
      13arch=('i686' 'x86_64' 'armv7h')
    
      14url="https://cuberite.org/"
    
      15license=('Apache')
    
      16depends=('lua' 'tmux' 'sudo' 'bash' 'awk' 'sed')
    
      17optdepends=("tar: needed in order to create world backups"
    
      18	"netcat: required in order to suspend an idle server")
    
      19provides=("minecraft-server=${_pkgver%_*}" "spigot=${_pkgver%_*}" "cuberite=${_pkgver}")
    
      20conflicts=("cuberite")
    
      21backup=('etc/conf.d/cuberite')
    
      22install="${_pkgname}.install"
    
      23source=("minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz")
    
      24source_i686=("Cuberite.b${_build_i686}_i686.tar.gz"::"https://builds.cuberite.org/view/all/job/linux-i386/${_build_i686}/artifact/Cuberite.tar.gz")
    
      25source_x86_64=("Cuberite.b${_build_x86_64}_x86_64.tar.gz"::"https://builds.cuberite.org/view/all/job/linux-x86_64/${_build_x86_64}/artifact/Cuberite.tar.gz")
    
      26source_armv7h=("Cuberite.b${_build_armv7h}_armv7h.tar.gz"::"https://builds.cuberite.org/view/all/job/linux-armhf/${_build_armv7h}/artifact/Cuberite.tar.gz")
    
      27sha512sums=('dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556')
    
      28sha512sums_i686=('c39411905c3c7187c096a6d3eeb0fddc884da0c99f7bb65097ff1aa79efa5e3abde8c47572ecb829103db225d01ab715d751ea3b97e0c004e5cf32f0be99ceb5')
    
      29sha512sums_x86_64=('5495874b70a3bee5302116573dd0637996001a1625b38091c98b76cd1b45d51bd8257a59222a74a9a14bd07a2af6e06b10f53bbfefff0255ea6afe70d546bdf7')
    
      30sha512sums_armv7h=('9f2262d78aff05394cab31bfb242e17de0dfa2d72c827fcf9c33c223d8c131861b474b512d2189783d868697eddb16a4cd20bdbfa68612c5f87576daeb596d0a')
    
      31noextract=("Cuberite.b${_build_i686}_i686.tar.gz"
    
      32	"Cuberite.b${_build_x86_64}_x86_64.tar.gz"
    
      33	"Cuberite.b${_build_armv7h}_armv7h.tar.gz")
    
      34
    
      35_game="cuberite"
    
      36_server_root="/srv/cuberite"
    
      37
    
      38prepare() {
    
      39	rm -rf Server
    
      40	mkdir -p Server
    
      41	_build="_build_${CARCH}"
    
      42	bsdtar -xf "Cuberite.b${!_build}_${CARCH}.tar.gz" -C Server
    
      43}
    
      44
    
      45build() {
    
      46	make -C "${srcdir}/minecraft-server-${_mng_ver}" clean
    
      47
    
      48	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      49		GAME=${_game} \
    
      50		INAME=${_game} \
    
      51		SERVER_ROOT=${_server_root} \
    
      52		BACKUP_PATHS="world world_nether world_the_end" \
    
      53		GAME_USER=${_game} \
    
      54		MAIN_EXECUTABLE=Cuberite \
    
      55		SERVER_START_CMD="./Cuberite" \
    
      56		SERVER_START_SUCCESS="complete" \
    
      57		all
    
      58}
    
      59
    
      60package() {
    
      61	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      62		DESTDIR="${pkgdir}" \
    
      63		GAME=${_game} \
    
      64		INAME=${_game} \
    
      65		install
    
      66
    
      67	# Copy files from the archive to the server destination and create some dirs
    
      68	mkdir -p "${pkgdir}/${_server_root}/backup"
    
      69	install -dm2755 "${pkgdir}/${_server_root}/logs"
    
      70	cp -dpr --no-preserve=ownership Server/. "${pkgdir}/${_server_root}"
    
      71
    
      72	# Link the log files
    
      73	mkdir -p "${pkgdir}/var/log/"
    
      74	ln -s "${_server_root}/logs" "${pkgdir}/var/log/${_game}"
    
      75
    
      76	# Give the group write permissions and set user or group ID on execution
    
      77	chmod g+s "${pkgdir}${_server_root}"
    
      78}
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3