java-openjfx-bin
LOW
maintainer lapsus
13 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads official OpenJFX SDK, JMods, and Javadoc from Gluon's domain, which is the legitimate maintainer; despite the non-whitelisted host, these are verifiable source and binary artifacts for a known project, with no code execution or redirection to untrusted sources.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official OpenJFX SDK, JMods, and Javadoc from Gluon's domain, which is the legitimate maintainer; despite the non-whitelisted host, these are verifiable source and binary artifacts for a known project, with no code execution or redirection to untrusted sources.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:43
curl -fsSL https://repo1.maven.org/maven2/org/openjfx/javafx/maven-metadata.xml |
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
source=("https://download2.gluonhq.com/openjfx/${pkgver}/openjfx-${pkgver}_linux-x64_bin-sdk.zip"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
# Contributor: L B <leobaldin dot 2000 at gmail dot com>
3
4
pkgname=java-openjfx-bin
5
pkgver=27
6
pkgrel=1
7
pkgdesc="Java OpenJFX ${pkgver} client application platform (Gluon build)."
8
arch=('x86_64')
9
url='https://openjfx.io/'
10
license=('GPL-2.0-only WITH Classpath-exception-2.0')
11
depends=('java-environment>=24'
12
'alsa-lib'
13
'at-spi2-core'
14
'cairo'
15
'ffmpeg'
16
'ffmpeg4.4'
17
'fontconfig'
18
'freetype2'
19
'gdk-pixbuf2'
20
'glib2'
21
'gstreamer'
22
'gtk3'
23
'libglvnd'
24
'libx11'
25
'libxtst'
26
'libxxf86vm'
27
'pango'
28
'qt5-base'
29
'webkit2gtk-4.1')
30
provides=("java-openjfx=${pkgver}")
31
conflicts=('java-openjfx')
32
options=('!strip' '!debug')
33
source=("https://download2.gluonhq.com/openjfx/${pkgver}/openjfx-${pkgver}_linux-x64_bin-sdk.zip"
34
"https://download2.gluonhq.com/openjfx/${pkgver}/openjfx-${pkgver}_linux-x64_bin-jmods.zip"
35
"https://download2.gluonhq.com/openjfx/${pkgver}/openjfx-${pkgver}-javadoc.zip")
36
sha256sums=('36857953977bf43f4b2c287f9431de884536431b502ac0edc0c6fcca0274e234'
37
'ea169b02460a38a2b44acf595e28c7abd3d1ab23075e4b03f324ebaf33920c5b'
38
'7d21ad30abb8d1d169d7789e99d698d5d0049386d0e8d1646560e9e058ac23f9')
39
40
_jvmdir=usr/lib/jvm/java-${pkgver}-openjfx
41
42
latestver() {
43
curl -fsSL https://repo1.maven.org/maven2/org/openjfx/javafx/maven-metadata.xml |
44
sed -nE 's:.*<version>([0-9]+(\.[0-9]+)*)</version>.*:\1:p' |
45
sort -V |
46
tail -1
47
}
48
49
package() {
50
# Install
51
install -d "${pkgdir}/${_jvmdir}"
52
cp -a "javafx-sdk-${pkgver}/lib" "${pkgdir}/${_jvmdir}/"
53
# Copy source archive
54
cp -a "javafx-sdk-${pkgver}/src.zip" "${pkgdir}/${_jvmdir}/"
55
mv "${pkgdir}/${_jvmdir}/src.zip" "${pkgdir}/${_jvmdir}/lib/javafx-src.zip"
56
# Legal
57
install -d "${pkgdir}/usr/share/licenses/${pkgname}"
58
cp -a "javafx-sdk-${pkgver}/legal" "${pkgdir}/usr/share/licenses/${pkgname}/"
59
# Jmods
60
install -d "${pkgdir}/${_jvmdir}/jmods"
61
cp -a "javafx-jmods-${pkgver}/"* "${pkgdir}/${_jvmdir}/jmods/"
62
# Docs
63
install -d "${pkgdir}/usr/share/doc/${pkgname}"
64
cp -a "javafx-${pkgver}-javadoc/"* "${pkgdir}/usr/share/doc/${pkgname}/"
65
}
66
Changes since previous scan
--- PKGBUILD @ 2026-10-21 00:12+++ PKGBUILD @ 2026-11-01 00:21@@ -2,7 +2,7 @@ # Contributor: L B <leobaldin dot 2000 at gmail dot com> pkgname=java-openjfx-bin-pkgver=26.0.2+pkgver=27 pkgrel=1 pkgdesc="Java OpenJFX ${pkgver} client application platform (Gluon build)." arch=('x86_64')@@ -33,9 +33,9 @@ source=("https://download2.gluonhq.com/openjfx/${pkgver}/openjfx-${pkgver}_linux-x64_bin-sdk.zip" "https://download2.gluonhq.com/openjfx/${pkgver}/openjfx-${pkgver}_linux-x64_bin-jmods.zip" "https://download2.gluonhq.com/openjfx/${pkgver}/openjfx-${pkgver}-javadoc.zip")-sha256sums=('8ea7652becace5bf09dab4b855e30381f21fcd3a65a3dac74b69f63c6d175b66'- '7c32eee96c4f992cea43cecee77420a660478ee2776f0b7475e03fb40cbfae84'- 'c2d3a32303b6b248fe1a2531f33f4edb2d583be9f1e4ac59ff88e1d875d2cb51')+sha256sums=('36857953977bf43f4b2c287f9431de884536431b502ac0edc0c6fcca0274e234'+ 'ea169b02460a38a2b44acf595e28c7abd3d1ab23075e4b03f324ebaf33920c5b'+ '7d21ad30abb8d1d169d7789e99d698d5d0049386d0e8d1646560e9e058ac23f9') _jvmdir=usr/lib/jvm/java-${pkgver}-openjfx Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 3 |
| 2026-10-31 00:07:41 | Low | 3 |
| 2026-10-30 00:29:30 | Low | 3 |
| 2026-10-29 00:13:55 | Low | 3 |
| 2026-10-28 00:06:54 | Low | 3 |
| 2026-10-27 00:23:28 | Low | 3 |
| 2026-10-26 00:12:40 | Low | 3 |
| 2026-10-25 00:20:48 | Low | 3 |
| 2026-10-24 00:14:55 | Low | 3 |
| 2026-10-23 00:02:19 | Low | 3 |
| 2026-10-22 00:13:10 | Low | 3 |
| 2026-10-21 03:30:06 | Medium | 2 |
| 2026-10-21 00:12:50 | Low | 3 |
| 2026-10-20 00:10:31 | Low | 3 |
| 2026-10-19 00:03:55 | Low | 3 |
| 2026-10-18 00:06:55 | Low | 3 |
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |