forge-server-architectury

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt JAR file from a non-whitelisted but plausibly official host (forgecdn.net, used by CurseForge); however, the file is a standard Minecraft mod artifact intended for direct installation, not an executable script or obfuscated payload, and the checksum is verified.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt JAR file from a non-whitelisted but plausibly official host (forgecdn.net, used by CurseForge); however, the file is a standard Minecraft mod artifact intended for direct installation, not an executable script or obfuscated payload, and the checksum is verified.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=(https://mediafiles.forgecdn.net/files/3893/635/architectury-5.10.33-forge.jar)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dominik Opyd <d.opyd@oad.earth>
    
      2
    
      3pkgname=forge-server-architectury
    
      4modname=architectury
    
      5srvname=forge
    
      6pkgver=5.10.33
    
      7minver=1.19
    
      8pkgrel=1
    
      9
    
      10url='https://www.curseforge.com/minecraft/mc-mods/architectury-api'
    
      11arch=('any')
    
      12license=('GPL')
    
      13pkgdesc="Architectury API is an api to abstract calls to fabric api and forge api as both loader has different implementations of what can be perceived as the same thing."
    
      14
    
      15source=(https://mediafiles.forgecdn.net/files/3893/635/architectury-5.10.33-forge.jar)
    
      16depends=("forge-hooks>=1.0.0"
    
      17         "forge-server>=41.0.94")
    
      18noextract=($modname-$pkgver-$srvname.jar)
    
      19sha256sums=('49d324ec91b016358450efb6215878d738d8320835652168f68c63145a4a3af6')
    
      20
    
      21package() {
    
      22  install -Dm 2755 $srcdir/$modname-$pkgver-$srvname.jar $pkgdir/srv/$srvname/mods/$modname.jar
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2