hadoop

maintainer AutoUpdateBot · 84 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the official Apache Hadoop source on GitHub, which is a legitimate and expected source; the recent maintainer change is noted but does not introduce executable remote code or supply-chain risks.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official Apache Hadoop source on GitHub, which is a legitimate and expected source; the recent maintainer change is noted but does not introduce executable remote code or supply-chain risks.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Matt Quintanilla <matt @ matt quintanilla . xyz>
    
      2# Contributor: William Tang <galaxyking0419@gmail.com>
    
      3# Contributor: Chris Severance <aur.severach@spamgourmet.com>
    
      4# Contributor: David Roheim <david.roheim@gmail.com>
    
      5# Contributor: AutoUpdateBot <auto_update_bot@arch4edu.org>
    
      6
    
      7pkgname=hadoop
    
      8pkgver=3.5.0
    
      9pkgrel=1
    
      10pkgdesc='An open-source software for reliable, scalable, distributed computing'
    
      11arch=('x86_64')
    
      12url='https://hadoop.apache.org/'
    
      13license=('APACHE')
    
      14conflicts=('yarn')
    
      15makedepends=('java-environment=17' 'maven')
    
      16depends=('inetutils' 'java-runtime-headless=17' 'openssh')
    
      17
    
      18source=("https://github.com/apache/hadoop/archive/refs/tags/rel/release-$pkgver.tar.gz"
    
      19        "${pkgname}" "${pkgname}.sh"
    
      20        hadoop-{datanode,historyserver,namenode,resourcemanager,secondarynamenode}.service)
    
      21sha256sums=('04e517572356a531050e7e3d4363f27d9f1827416c1394e3e83d3c917346f76c'
    
      22            '1ec173297234b0d587255c1fac978b3929e967146ac542e2e1b44323f80e0bc5'
    
      23            '3d20dd2ad1b773e7d4cb855c7556613e36ff56081749fe7b01c6e4fd0c743cc5'
    
      24            '876d40b0a2ec9b9cec9b667d7909591ee0ef1acbd5417a0357c33539d8a54e1a'
    
      25            'f8f3b3a93a9e455da198ee93a873012399878459e78a3a7de0e396d69e81b61f'
    
      26            '3d4aa2a660bd509e658c8109d9e91c00b0f0eee3a2ecab71a4785a76529ea242'
    
      27            '2f6b8893a4b4e2ef120193ecfc2d929a8558d2a1c5b0af12e9224342ca90a158'
    
      28            'ed1e7f13d2023d49a51dc04c4459d12a53bff258a05b852a3e10a9fd2d18bbb8')
    
      29
    
      30install=$pkgname.install
    
      31
    
      32build() {
    
      33    export JAVA_HOME=/usr/lib/jvm/java-17-openjdk
    
      34
    
      35    cd hadoop-rel-release-${pkgver}
    
      36    mvn package -Pdist \
    
      37        -Dmaven.javadoc.skip=true -DskipTests
    
      38}
    
      39
    
      40package() {
    
      41    # Copy files to /usr
    
      42    mkdir "$pkgdir"/usr
    
      43    mv hadoop-rel-release-$pkgver/hadoop-dist/target/hadoop-$pkgver/* "$pkgdir"/usr/
    
      44
    
      45    # Move sbin files to bin
    
      46    cd "$pkgdir"/usr
    
      47    mv sbin/* bin/
    
      48    rmdir sbin
    
      49
    
      50    # Move license and notice files
    
      51    mkdir -p "$pkgdir"/usr/share/licenses/$pkgname/
    
      52    mv licenses-binary/* LICENSE* NOTICE* README.txt "$pkgdir"/usr/share/licenses/$pkgname/
    
      53    rmdir licenses-binary
    
      54
    
      55    # Remove windows batch files
    
      56    rm {etc/hadoop,bin,libexec,share/hadoop/tools/resourceestimator/bin}/*.cmd
    
      57
    
      58    # Move etc directory
    
      59    mv "$pkgdir"/usr/etc "$pkgdir"/
    
      60
    
      61    # Install profile script
    
      62    cd "$srcdir"
    
      63    mkdir "$pkgdir"/etc/profile.d
    
      64    cp $pkgname.sh "$pkgdir"/etc/profile.d/
    
      65
    
      66    # Install eviroment file
    
      67    mkdir "$pkgdir"/etc/conf.d
    
      68    cp $pkgname "$pkgdir"/etc/conf.d/
    
      69
    
      70    # Install systemd service files
    
      71    mkdir -p "$pkgdir"/usr/lib/systemd/system
    
      72    cp $pkgname-{datanode,historyserver,namenode,resourcemanager,secondarynamenode}.service "$pkgdir"/usr/lib/systemd/system/
    
      73
    
      74    # Create required directories
    
      75    mkdir -p "$pkgdir"/var/{lib,log}/hadoop
    
      76}
    
      77

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,22 +2,23 @@
 # Contributor: William Tang <galaxyking0419@gmail.com>
 # Contributor: Chris Severance <aur.severach@spamgourmet.com>
 # Contributor: David Roheim <david.roheim@gmail.com>
+# Contributor: AutoUpdateBot <auto_update_bot@arch4edu.org>
 
 pkgname=hadoop
-pkgver=3.4.2
+pkgver=3.5.0
 pkgrel=1
 pkgdesc='An open-source software for reliable, scalable, distributed computing'
 arch=('x86_64')
 url='https://hadoop.apache.org/'
 license=('APACHE')
 conflicts=('yarn')
-makedepends=('cmake' 'gcc12' 'java-environment=11' 'make' 'maven' 'pkgconfig')
-depends=('inetutils' 'java-runtime-headless=11' 'openssh' 'protobuf')
+makedepends=('java-environment=17' 'maven')
+depends=('inetutils' 'java-runtime-headless=17' 'openssh')
 
 source=("https://github.com/apache/hadoop/archive/refs/tags/rel/release-$pkgver.tar.gz"
         "${pkgname}" "${pkgname}.sh"
         hadoop-{datanode,historyserver,namenode,resourcemanager,secondarynamenode}.service)
-sha256sums=('7877b9879c9a4e279da6cb52dc9641863a72273a11174e1b82ada78c792f31d8'
+sha256sums=('04e517572356a531050e7e3d4363f27d9f1827416c1394e3e83d3c917346f76c'
             '1ec173297234b0d587255c1fac978b3929e967146ac542e2e1b44323f80e0bc5'
             '3d20dd2ad1b773e7d4cb855c7556613e36ff56081749fe7b01c6e4fd0c743cc5'
             '876d40b0a2ec9b9cec9b667d7909591ee0ef1acbd5417a0357c33539d8a54e1a'
@@ -29,13 +30,10 @@
 install=$pkgname.install
 
 build() {
-    export CC=/usr/bin/gcc-12
-    export CXX=/usr/bin/g++-12
-    export JAVA_HOME=/usr/lib/jvm/java-11-openjdk
+    export JAVA_HOME=/usr/lib/jvm/java-17-openjdk
 
     cd hadoop-rel-release-${pkgver}
-    mvn package -Pdist,native \
-        -Drequire.openssl -Drequire.zstd \
+    mvn package -Pdist \
         -Dmaven.javadoc.skip=true -DskipTests
 }
 
@@ -48,10 +46,6 @@
     cd "$pkgdir"/usr
     mv sbin/* bin/
     rmdir sbin
-
-    # Move native libraries to /usr/lib
-    mv lib/native/* lib/
-    rmdir lib/native
 
     # Move license and notice files
     mkdir -p "$pkgdir"/usr/share/licenses/$pkgname/

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 17:12:22	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0