fabric-server

LOW

maintainer jSQrD 11 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a fabric installer JAR from a project-owned maven repository and a tarball from GitHub; both are standard sources for the project, and the build process runs a legitimate installer to set up the server, which is normal for AUR packages.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a fabric installer JAR from a project-owned maven repository and a tarball from GitHub; both are standard sources for the project, and the build process runs a legitimate installer to set up the server, which is normal for AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 "fabric-installer-${_fabric_ver}.jar::https://maven.fabricmc.net/net/fabricmc/fabric-installer/${_fabric_ver}/fabric-installer-${_fabric_ver}.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jSQrD <n1irdwd5 at aur dot addy dot io>
    
      2
    
      3# Previous 'fabric-server' maintainers
    
      4## Contributor: lgm <lgm dot aur at outlook dot com>
    
      5## Contributor: Ndoskrnl <lollipop.studio.cn@gmail.com>
    
      6## Contributor: flying <flyinghat42@gmail.com>
    
      7
    
      8# Based on the 'forge-server' AUR package by:
    
      9## Maintainer: Nitroretro <nitroretro@protonmail.com>
    
      10
    
      11# Based on the `minecraft-server` AUR package by:
    
      12## Maintainer: Gordian Edenhofer <gordian.edenhofer@gmail.com>
    
      13## Contributor: Philip Abernethy <chais.z3r0@gmail.com>
    
      14## Contributor: sowieso <sowieso@dukun.de>
    
      15
    
      16_minecraft_ver="26.2"
    
      17_fabric_ver="1.1.2"
    
      18_fabric_loader_ver="0.19.5"
    
      19_mng_ver=1.0.4
    
      20
    
      21pkgname="fabric-server"
    
      22_fabric_name="fabric"
    
      23pkgver=${_minecraft_ver}_${_fabric_loader_ver}_${_fabric_ver}
    
      24pkgrel=1
    
      25pkgdesc="A Fabric (a modular, lightweight mod loader) enabled Minecraft server"
    
      26arch=("any")
    
      27url="https://fabricmc.net"
    
      28license=("Apache-2.0")
    
      29depends=("java-runtime-headless>=21" "tmux" "sudo" "bash" "awk" "sed")
    
      30optdepends=("tar: required in order to create world backups"
    
      31	"netcat: required in order to suspend an idle server")
    
      32provides=("fabric-server=${pkgver}")
    
      33backup=("etc/conf.d/${_fabric_name}")
    
      34install="fabric-server.install"
    
      35
    
      36source=(
    
      37	"minecraft-server-${_mng_ver}.tar.gz::https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz"
    
      38	"fabric-installer-${_fabric_ver}.jar::https://maven.fabricmc.net/net/fabricmc/fabric-installer/${_fabric_ver}/fabric-installer-${_fabric_ver}.jar"
    
      39)
    
      40noextract=("fabric-${pkgver}.jar")
    
      41sha512sums=(
    
      42	'dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556'
    
      43	'3cbe7b69498c44d814fc95e71cd9ce9c12c45a9e1dcf01085cb3e9aaf6fe63134b701065167be1fa6e4c2df19dfa5400bc5b6b1b7fb5e99e334d24dcdca55c20'
    
      44)
    
      45
    
      46_game="fabric"
    
      47_server_root="/srv/${_fabric_name}"
    
      48
    
      49prepare() {
    
      50	java -Duser.home="${srcdir}" -jar "fabric-installer-${_fabric_ver}.jar" server -mcversion "${_minecraft_ver}" -downloadMinecraft -loader "${_fabric_loader_ver}"
    
      51}
    
      52
    
      53build() {
    
      54	make -C "${srcdir}/minecraft-server-${_mng_ver}" clean
    
      55	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      56		GAME=${_game} \
    
      57		INAME=${_game}d \
    
      58		SERVER_ROOT="${_server_root}" \
    
      59		BACKUP_PATHS="world banned-ips.json banned-players.json config ops.json server.properties usercache.json user_jvm_args.txt whitelist.json" \
    
      60		GAME_USER=${_game} \
    
      61		MAIN_EXECUTABLE=fabric-server-launch.jar \
    
      62		SERVER_START_CMD="java -Dlog4j2.formatMsgNoLookups=true -Xms512M -Xmx1024M -jar './\$\${MAIN_EXECUTABLE}' nogui" \
    
      63		all
    
      64}
    
      65
    
      66package() {
    
      67	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      68		DESTDIR="${pkgdir}" \
    
      69		GAME=${_game} \
    
      70		INAME=${_game}d \
    
      71		install
    
      72
    
      73	# Install Fabric & Minecraft server jars
    
      74	install -Dm644 "fabric-server-launch.jar" "${pkgdir}${_server_root}/fabric-server-launch.jar"
    
      75	install -Dm644 "server.jar" "${pkgdir}${_server_root}/server.jar"
    
      76
    
      77	# Install libraries
    
      78	install -dm755 "libraries" "${pkgdir}${_server_root}/libraries"
    
      79	cp -r libraries/* "${pkgdir}${_server_root}/libraries/"
    
      80	find "${pkgdir}${_server_root}/libraries" -type d -exec chmod 755 {} +
    
      81	find "${pkgdir}${_server_root}/libraries" -type f -exec chmod 644 {} +
    
      82
    
      83	# Link log files
    
      84	install -dm755 "${pkgdir}/var/log"
    
      85	install -dm2755 "${pkgdir}${_server_root}/logs"
    
      86	ln -s "/srv/${_fabric_name}/logs" "${pkgdir}/var/log/${_fabric_name}"
    
      87
    
      88	# Give the group write permissions and set user or group ID on execution
    
      89	chmod g+ws "${pkgdir}${_server_root}"
    
      90}
    
      91

Changes since previous scan

--- PKGBUILD @ 2026-09-02 00:02
+++ PKGBUILD @ 2026-09-17 00:27
@@ -14,8 +14,8 @@
 ## Contributor: sowieso <sowieso@dukun.de>
 
 _minecraft_ver="26.2"
-_fabric_ver="1.1.1"
-_fabric_loader_ver="0.19.3"
+_fabric_ver="1.1.2"
+_fabric_loader_ver="0.19.5"
 _mng_ver=1.0.4
 
 pkgname="fabric-server"
@@ -40,7 +40,7 @@
 noextract=("fabric-${pkgver}.jar")
 sha512sums=(
 	'dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556'
-	'f95731a5f7b950f309f5b7d367c377727ceca6484fbde3c513e16b508d840ec4dfeb8471a9122a07a029d62cacd8b5d0726c60e27edc0d9a93ad928e34f5e24e'
+	'3cbe7b69498c44d814fc95e71cd9ce9c12c45a9e1dcf01085cb3e9aaf6fe63134b701065167be1fa6e4c2df19dfa5400bc5b6b1b7fb5e99e334d24dcdca55c20'
 )
 
 _game="fabric"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 17:51:12	Medium	1
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2