java17-openjfx-doc

maintainer stickynotememo · 3 votes · base java17-openjfx · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a Ruby gem (getoptlong) during build for a legitimate build dependency of OpenJFX, which is a common and expected practice when building the project from source; this does not involve untrusted remote code execution or supply-chain risks.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a Ruby gem (getoptlong) during build for a legitimate build dependency of OpenJFX, which is a common and expected practice when building the project from source; this does not involve untrusted remote code execution or supply-chain risks.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:136 gem install getoptlong

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Giovanni Santini <giovannisantini93@yahoo.it>
    
      2# Contributor: Levente Polyak <anthraxx[at]archlinux[dot]org>
    
      3# Contributor: Frederik Schwan <freswa at archlinux dot org>
    
      4# Contributor: Maxime Gauduin <alucryd@archlinux.org>
    
      5# Contributor: Guillaume Alaux <guillaume@archlinux.org>
    
      6# Contributor: William Gathoye <william + archlinux at gathoye dot be>
    
      7# Contributor: Emanuel Couto <emanuel dot amaral dot couto at gmail dot com>
    
      8# Contributor: Richard Jackson <rdjack21 at gmail dot com>
    
      9# Contributor: Tinx <arch at tinx dot eu>
    
      10# Contributor: Jens Kapitza <j dot kapitza at schwarze-allianz dot de>
    
      11# Contributor: Olli <olli at coderkun dot de>
    
      12
    
      13pkgbase=java17-openjfx
    
      14pkgname=(
    
      15  java17-openjfx
    
      16  java17-openjfx-doc
    
      17  java17-openjfx-src
    
      18)
    
      19pkgver=17.0.18.u1
    
      20pkgrel=1
    
      21pkgdesc="Java OpenJFX 17 client application platform (open-source implementation of JavaFX)"
    
      22arch=(x86_64)
    
      23url=https://wiki.openjdk.java.net/display/OpenJFX/Main
    
      24license=(custom)
    
      25makedepends=(
    
      26  alsa-lib
    
      27  ant
    
      28  cairo
    
      29  cmake
    
      30  ffmpeg4.4
    
      31  freetype2
    
      32  gdk-pixbuf2
    
      33  glib2
    
      34  gperf
    
      35  gtk2
    
      36  gtk3
    
      37  java-environment-openjdk=17
    
      38  libgl
    
      39  libx11
    
      40  libxtst
    
      41  pango
    
      42  python
    
      43  qt5-base
    
      44  ruby
    
      45  ruby-erb
    
      46  unzip
    
      47  webkit2gtk
    
      48  zip
    
      49  gcc13
    
      50)
    
      51source=(
    
      52  # https://github.com/openjdk/jfx/archive/refs/tags/jfx-${pkgver//.u/+}.tar.gz
    
      53  ${pkgname}-${pkgver}.tar.gz::https://github.com/openjdk/jfx17u/archive/refs/tags/${pkgver//.u/+}.tar.gz
    
      54  gradle.properties
    
      55  java-openjfx-flags.patch
    
      56  java-openjfx-no-xlocale.patch
    
      57  java-openjfx-gstreamer-lite-gcc10-compat.patch
    
      58  java-openjfx-env_compiler.patch
    
      59  webcore_mapfile-vers.patch
    
      60)
    
      61b2sums=('f4b0708b5eba8a1bb1b9bbf50ffe278d81c003c112511b7ee274684283d6a5b9620a16d044bb60be0d540712ca349bd92882402d510da1dd15c3b2b9daac3f6e'
    
      62        'a77fd8814a5978827de01a652f7b945f3439df04606434ced8998c8d77a82985292490e6965299aeb52f9da3d8069b4091d75519bd4ec8a15f70bc6d28b13498'
    
      63        'a56a5cfebb44cdbe3ada9c6da88fda6427a5bd1bf9fcc491df289c4f5c0e96ac3614c619aaf9428340f11e9dabf0a85fc7db4f49754c2700587cc66fc15372fd'
    
      64        '13216615c01b8d48d17889ffa22668c38568870d83ab30c542eb5b5620db305f02efb1acb99d9b5e89eb0a73a134bb336cb301f4de4e8855cae50efb099e384e'
    
      65        '119fa1cc5da2cdefa22bbe9b6f76581faa74e05fa7b6e5576470fc0251c6e257f122fbba03754cc01f7c7251145cfa1cab4ffc2f9d59ff0c175a121e943a0f64'
    
      66        '189f689fb43447b0aeb3cfac561be94f76b243bcf31736c528b9a1b9a528d71b7cb6d3a801b42d8cd10a235a6a8b1bdd31de39d2e09523c3b6a34e5e03d67770'
    
      67        'f1ccc2e64632e83de9309ade3c3e24186b6ef77f91078d24ab483b05981b5bf01441da191bbbb046542fa2cf2f54b2c0fbe6ae1d313c1c54a82cb6c4751eff82')
    
      68
    
      69prepare() {
    
      70  # Patch files properly
    
      71  cd jfx17u-${pkgver//.u/-}
    
      72
    
      73  ln -sf ../gradle.properties .
    
      74  patch -Np1 -i ../java-openjfx-flags.patch
    
      75  #patch -Np1 -i ../java-openjfx-no-xlocale.patch
    
      76  patch -Np1 -i ../java-openjfx-gstreamer-lite-gcc10-compat.patch
    
      77  patch -Np1 -i ../java-openjfx-env_compiler.patch
    
      78  sed 's|, "-Werror"||g' -i buildSrc/linux.gradle
    
      79
    
      80  pushd modules/javafx.web/src/main/native/Source/WebCore >/dev/null
    
      81  patch -N -i $srcdir/webcore_mapfile-vers.patch
    
      82  popd >/dev/null
    
      83
    
      84  # Make Gradle wrapper executable
    
      85  chmod +x gradlew
    
      86
    
      87  # Run Gradle stuff inside srcdir so that it can be easily cleaned
    
      88  export GRADLE_USER_HOME="$srcdir/gradle"
    
      89
    
      90  # Ensure safety for CFLAGS and LDFLAGS
    
      91  OLD_CFLAGS="$CFLAGS"
    
      92  OLD_LDFLAGS="$LDFLAGS"
    
      93  export CFLAGS="" LDFLAGS=""
    
      94
    
      95  # Use correct Java version
    
      96  export PATH="/usr/lib/jvm/java-17-openjdk/bin:$PATH"
    
      97
    
      98  # Download most of the dependencies via metadata verification
    
      99  ./gradlew --no-daemon --write-verification-metadata sha256 help
    
      100
    
      101  # Restore the flags, if any
    
      102  export CFLAGS="$OLD_CFLAGS" LDFLAGS="$OLD_LDFLAGS"
    
      103}
    
      104
    
      105build() {
    
      106  # cd jfx-${pkgver//.u/-}
    
      107  cd jfx17u-${pkgver//.u/-}
    
      108
    
      109  # Run Gradle stuff inside srcdir so that it can be easily cleaned
    
      110  export GRADLE_USER_HOME="$srcdir/gradle"
    
      111
    
      112  # build against ffmpeg4.4
    
      113  export PKG_CONFIG_PATH='/usr/lib/ffmpeg4.4/pkgconfig'
    
      114
    
      115  # Workaround for situation where the linker treats whitespace as arguments
    
      116  # From `java-openjfx` and comments
    
      117  export LDFLAGS="${LDFLAGS//+([[:space:]]|[[:blank:]])/ }"
    
      118
    
      119  # Use Gradle wrapper rather than the repositories one for compatibility
    
      120  # If needed, export JOBS to limit the jobs used for building Webkit
    
      121  if [ -n "$JOBS" ]
    
      122  then
    
      123    export NUM_COMPILE_THREADS="$JOBS"
    
      124    export NUMBER_OF_PROCESSORS="$JOBS"
    
      125  fi
    
      126
    
      127  # Set correct Java version
    
      128  export PATH="/usr/lib/jvm/java-17-openjdk/bin:$PATH"
    
      129
    
      130  # Use desired compiler (upstream CI use gcc-13)
    
      131  export CC=gcc-13 CXX=g++-13
    
      132
    
      133  # Install required Ruby gems in a non-disruptive way
    
      134  export GEM_HOME="$srcdir/rubygems"
    
      135  export PATH="$PATH:$GEM_HOME/bin"
    
      136  gem install getoptlong
    
      137
    
      138  # Do the thing
    
      139  ./gradlew --no-daemon --offline zips
    
      140
    
      141  # Clean up
    
      142  gem uninstall getoptlong
    
      143}
    
      144
    
      145package_java17-openjfx() {
    
      146  depends=(
    
      147    java-runtime-openjdk=17
    
      148    libgl
    
      149    libx11
    
      150    libxtst
    
      151  )
    
      152  optdepends=(
    
      153    'ffmpeg4.4: Media support',
    
      154    'gtk2: GTK2 support',
    
      155    'gtk3: GTK3 support',
    
      156    'webkit2gtk: Web support'
    
      157  )
    
      158  provides=(java-openjfx=17)
    
      159
    
      160  # cd jfx-${pkgver//.u/-}
    
      161  cd jfx17u-${pkgver//.u/-}
    
      162
    
      163  install -dm 755  "${pkgdir}"/usr/{lib/jvm/java-17-openjdk,share/licenses}
    
      164  cp -dr --no-preserve=ownership build/sdk/lib "${pkgdir}"/usr/lib/jvm/java-17-openjdk/
    
      165  cp -dr --no-preserve=ownership build/jmods "${pkgdir}"/usr/lib/jvm/java-17-openjdk/
    
      166  cp -dr --no-preserve=ownership build/sdk/legal "${pkgdir}"/usr/share/licenses/java17-openjfx
    
      167}
    
      168
    
      169package_java17-openjfx-doc() {
    
      170  # cd jfx-${pkgver//.u/-}
    
      171  cd jfx17u-${pkgver//.u/-}
    
      172
    
      173  install -dm 755 "${pkgdir}"/usr/share/{doc,licenses}
    
      174  cp -dr --no-preserve=ownership build/javadoc "${pkgdir}"/usr/share/doc/java17-openjfx
    
      175  ln -s java17-openjfx "${pkgdir}"/usr/share/licenses/java17-openjfx-doc
    
      176}
    
      177
    
      178package_java17-openjfx-src() {
    
      179  # cd jfx-${pkgver//.u/-}
    
      180  cd jfx17u-${pkgver//.u/-}
    
      181
    
      182  install -dm 755  "${pkgdir}"/usr/{lib/jvm/java-17-openjdk,share/licenses}
    
      183  install -m 644 build/sdk/src.zip "${pkgdir}"/usr/lib/jvm/java-17-openjdk/javafx-src.zip
    
      184  ln -s java17-openjfx "${pkgdir}"/usr/share/licenses/java17-openjfx-src
    
      185}
    
      186
    
      187# vim: ts=2 sw=2 et:
    
      188

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3