java-openjdk-ea-bin
LOW
maintainer stefan-zobel
8 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt OpenJDK early-access binary from Oracle's official download domain (download.java.net), which is a legitimate source for Java releases; despite the non-whitelisted host, this is a standard and expected source for the software, and the checksums are provided and match the architecture-specific builds.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt OpenJDK early-access binary from Oracle's official download domain (download.java.net), which is a legitimate source for Java releases; despite the non-whitelisted host, this is a standard and expected source for the software, and the checksums are provided and match the architecture-specific builds.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:36
source=("https://download.java.net/java/early_access/jdk${_majorver}/${_buildver}/GPL/openjdk-${_majorver}-ea+${_buildver}_linux-${_JARCH}_bin.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Stefan Zobel <stefan dot zobel at gmail dot com>
2
# Contributor: Jamie Magee <jamie dot magee at gmail dot com>
3
# Contributor: Mohammadreza Abdollahzadeh <morealaz at gmail dot com>
4
pkgname=java-openjdk-ea-bin
5
6
_majorver=28
7
_buildver=15
8
pkgver=${_majorver}b${_buildver}
9
pkgrel=1
10
11
12
_JARCH='x64'
13
case "${CARCH}" in
14
x86_64) _JARCH='x64';;
15
aarch64) _JARCH='aarch64';;
16
esac
17
18
19
pkgdesc="Java OpenJDK ${_majorver} Early-Access Build"
20
arch=('x86_64' 'aarch64')
21
url="https://jdk.java.net/${_majorver}"
22
license=('GPL2')
23
depends=(
24
'java-environment-common>=3' 'java-runtime-common>=3'
25
'ca-certificates-utils' 'nss' 'libxrender' 'libxtst'
26
'alsa-lib' 'freetype2'
27
)
28
provides=(
29
"java-environment=${_majorver}"
30
"java-environment-openjdk=${_majorver}"
31
"java-runtime=${_majorver}"
32
"java-runtime-openjdk=${_majorver}"
33
"java-runtime-headless=${_majorver}"
34
"java-runtime-headless-openjdk=${_majorver}"
35
)
36
source=("https://download.java.net/java/early_access/jdk${_majorver}/${_buildver}/GPL/openjdk-${_majorver}-ea+${_buildver}_linux-${_JARCH}_bin.tar.gz")
37
38
39
if [[ $_JARCH == "x64" ]]; then
40
sha256sums=('621528ea2be9bcfc995c350d7db6dc6270a212de980dc31e5c1626612bad469d')
41
else
42
sha256sums=('09d100ebcc0a205f809834f79b0bdf5637cc52d2c5ec3ab30a88edba093b2b5f')
43
fi
44
45
46
_eaname=java-${_majorver}-openjdk
47
_jvmdir=/usr/lib/jvm/${_eaname}
48
49
package() {
50
# Install
51
install -d "${pkgdir}${_jvmdir}"
52
cd jdk-${_majorver}
53
cp -a bin include jmods lib release "${pkgdir}${_jvmdir}/"
54
55
# Link JKS keystore from ca-certificates-utils
56
rm -f "${pkgdir}${_jvmdir}/lib/security/cacerts"
57
ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/lib/security/cacerts"
58
59
# Legal
60
install -d "${pkgdir}/usr/share/licenses/${_eaname}"
61
cp -a legal "${pkgdir}/usr/share/licenses/${_eaname}/"
62
ln -s /usr/share/licenses/${_eaname} "${pkgdir}${_jvmdir}/legal"
63
64
# Conf
65
install -d "${pkgdir}/etc"
66
cp -r conf "${pkgdir}/etc/${_eaname}"
67
ln -s /etc/${_eaname} "${pkgdir}${_jvmdir}/conf"
68
}
69
# vim:set ts=2 sw=2 et:
70
Changes since previous scan
--- PKGBUILD @ 2026-08-22 00:02+++ PKGBUILD @ 2026-09-17 00:27@@ -3,8 +3,8 @@ # Contributor: Mohammadreza Abdollahzadeh <morealaz at gmail dot com> pkgname=java-openjdk-ea-bin -_majorver=27-_buildver=35+_majorver=28+_buildver=15 pkgver=${_majorver}b${_buildver} pkgrel=1 @@ -33,14 +33,13 @@ "java-runtime-headless=${_majorver}" "java-runtime-headless-openjdk=${_majorver}" )-#source=("https://download.java.net/java/early_access/jdk${_majorver}/${_buildver}/GPL/openjdk-${_majorver}-ea+${_buildver}_linux-${_JARCH}_bin.tar.gz")-source=("https://download.java.net/java/GA/jdk27/55ce5470a6294008af0057ff4626d0e5/35/GPL/openjdk-27_linux-${_JARCH}_bin.tar.gz")+source=("https://download.java.net/java/early_access/jdk${_majorver}/${_buildver}/GPL/openjdk-${_majorver}-ea+${_buildver}_linux-${_JARCH}_bin.tar.gz") if [[ $_JARCH == "x64" ]]; then-sha256sums=('95fc37eb3a18a27a26d5904c2d89d52bace8dafa9a078ca27f4747fbc4bf070b')+sha256sums=('621528ea2be9bcfc995c350d7db6dc6270a212de980dc31e5c1626612bad469d') else-sha256sums=('da4e9dde1fff90204739e969187bab4751bd59a2a1c479672e1a1810f7dd23ea')+sha256sums=('09d100ebcc0a205f809834f79b0bdf5637cc52d2c5ec3ab30a88edba093b2b5f') fi Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 01:24:32 | Medium | 1 |
| 2026-08-22 00:02:17 | Clean | 2 |
| 2026-08-21 13:15:20 | Medium | 1 |
| 2026-08-21 00:01:35 | Low | 2 |
| 2026-08-20 00:05:13 | Low | 2 |
| 2026-08-19 00:15:45 | Low | 2 |
| 2026-08-18 15:40:04 | Medium | 1 |
| 2026-08-18 00:03:42 | Low | 2 |
| 2026-08-17 00:18:29 | Low | 2 |
| 2026-08-16 00:03:42 | Low | 2 |
| 2026-08-15 00:26:13 | Low | 2 |
| 2026-08-14 00:03:41 | Low | 2 |
| 2026-08-13 00:17:07 | Low | 2 |
| 2026-08-12 00:27:08 | Low | 2 |
| 2026-08-11 00:07:57 | Low | 2 |