java8-openjfx-src

LOW
maintainer danwood76 14 votes base java8-openjfx scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The source is a legitimate mirror of the official OpenJFX 8 codebase due to the original host's instability; building from this source is a normal AUR packaging practice and poses no inherent risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a legitimate mirror of the official OpenJFX 8 codebase due to the original host's instability; building from this source is a normal AUR packaging practice and poses no inherent risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:58 https://services.gradle.org/distributions/gradle-4.8-bin.zip

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Levente Polyak <anthraxx[at]archlinux[dot]org>
2# Maintainer: Frederik Schwan <freswa at archlinux dot org>
3# Contributor: Guillaume Alaux <guillaume@archlinux.org>
4# Contributor: Maxime Gauduin <alucryd@archlinux.org>
5# Contributor: William Gathoye <william + archlinux at gathoye dot be>
6# Contributor: Emanuel Couto <emanuel dot amaral dot couto at gmail dot com>
7# Contributor: Richard Jackson <rdjack21 at gmail dot com>
8# Contributor: Tinx <arch at tinx dot eu>
9# Contributor: Jens Kapitza <j dot kapitza at schwarze-allianz dot de>
10# Contributor: Olli <olli at coderkun dot de>
11
12pkgbase=java8-openjfx
13pkgname=(
14 java8-openjfx
15 java8-openjfx-doc
16 java8-openjfx-src
17)
18pkgver=8.u202
19pkgrel=11
20pkgdesc='Java OpenJFX 8 client application platform (open-source implementation of JavaFX)'
21arch=(x86_64)
22url=https://wiki.openjdk.java.net/display/OpenJFX/Main
23license=(GPL)
24makedepends=(
25 alsa-lib
26 cairo
27 cmake
28 ffmpeg4.4
29 freetype2
30 gdk-pixbuf2
31 glib2
32 gperf
33 gtk2
34 gtk3
35 jdk8-openjdk
36 libgl
37 libx11
38 libxtst
39 pango
40 python2
41 qt5-base
42 ruby
43 ruby-erb
44 ruby-getoptlong
45 unzip
46 webkit2gtk
47)
48
49# Original source archive was hosted on openJDK mercurial server here:
50# https://hg.openjdk.java.net/openjfx/8u-dev/rt/archive/${pkgver//./}-ga.tar.bz2
51# Unfortunately this server seems to be having lots of issues so this repo and source
52# archive has been mirrored on @danwood76's github account temporarily
53
54DLAGENTS=("https::/usr/bin/curl --user-agent 'Mozilla' -fLC - -o %o %u")
55source=(
56 https://github.com/danwood76/openjfx8-mirror/releases/download/${pkgver//./}-ga/${pkgver//./}-ga.tar.bz2
57 gradle.properties
58 https://services.gradle.org/distributions/gradle-4.8-bin.zip
59 java8-openjfx-flags.patch
60 java8-openjfx-no-xlocale.patch
61 java8-openjfx-no-sys-sysctl.patch
62 java8-openjfx-CVE-2021-3517-fix.patch::https://gitlab.gnome.org/GNOME/libxml2/-/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2.patch
63 java8-openjfx-CVE-2021-3522-fix.patch::https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/-/commit/8a88e5c1db05ebadfd4569955f6f47c23cdca3c4.patch
64 java8-openjfx-include-iterator.patch
65 java8-openjfx-no-check-jfxrt-jar.patch
66 java8-openjfx-fix-java-version-check.patch
67 java8-openjfx-offlineasm-warnings-ruby27.patch
68 java8-openjfx-wno-error.patch
69)
70sha256sums=('813ed6bbe7669b5acae7908720b9e353771e854be75c57a323310d0b9271daff'
71 'd1c2255893e5ec6268d7c92bb6539cde629d325872f26cffb5f1f616c9d5f30d'
72 'f3e29692a8faa94eb0b02ebf36fa263a642b3ae8694ef806c45c345b8683f1ba'
73 'a2e0d5ac5cdb83958d2886aef7f5a419f460e103959f65aaadd69cb26cc6adec'
74 'b21f6b254acc7aa2124521b6521d3bdfdfcfd9b062624a84ef73608120957d0d'
75 'cd1a2bd60f636662e4f3334217b3e14f1d51cf30b77b9ca3eff8d030312fd26a'
76 '4db6e995d46f5ab29c4169dab5dbbe367ebd01dee66ef1750abe5cf0c8364d42'
77 '3487eb180fff9866c8b8b08be45f13fa9e8edd04e5719bc867e59b09b81954b4'
78 'bd69e8a3363f9b3ade50fb29d4c9e3d7e59b42472ae00d425d20ddcda720b919'
79 '47822da975832551bc3b20b3d75891135314f89cfcb75f7212eece148902aea3'
80 '88ecba988b6e05580cecc09c37add8e375097619d9fa106d65c09edd993c3bc7'
81 'fcc5d944055df246dd9282e6093b015a448d8a6207fa7425c85d2562b7f5a596'
82 '71a82aed1b6090c75dbc0e4ccb4e0cf2ce8a39f615a79909cabfbc2f89c971e6')
83
84prepare() {
85 cd rt-${pkgver//./}-ga
86
87 ln -sf ../gradle.properties .
88 patch -Np1 -i ../java8-openjfx-flags.patch
89 patch -Np1 -i ../java8-openjfx-no-xlocale.patch
90 patch -Np1 -i ../java8-openjfx-no-sys-sysctl.patch
91 # loose match the following patch due to whitespace differences
92 patch -Np1 -l -i "$srcdir"/java8-openjfx-CVE-2021-3517-fix.patch -d modules/web/src/main/native/Source/ThirdParty/libxml/src
93 patch -Np1 -i "$srcdir"/java8-openjfx-CVE-2021-3522-fix.patch -d modules/media/src/main/native/gstreamer/gstreamer-lite/gst-plugins-base
94 patch -Np1 -i ../java8-openjfx-include-iterator.patch
95 patch -Np1 -i ../java8-openjfx-no-check-jfxrt-jar.patch
96 patch -Np1 -i ../java8-openjfx-fix-java-version-check.patch
97 patch -Np1 -i ../java8-openjfx-offlineasm-warnings-ruby27.patch
98 patch -Np1 -i ../java8-openjfx-wno-error.patch
99}
100
101build() {
102 cd rt-${pkgver//./}-ga
103
104 # https://wiki.gentoo.org/wiki/Gcc_10_porting_notes/fno_common
105 CFLAGS+=' -fcommon'
106 # fix errors when compiling gstreamer-lite
107 CFLAGS+=' -Wno-incompatible-pointer-types -Wno-int-conversion'
108 # fix errors with new gcc
109 CFLAGS+=' -std=gnu17'
110 # Remove "-Wl,-z,pack-relative-relocs" from LDFLAGS
111 export LDFLAGS="${LDFLAGS//-Wl,-z,pack-relative-relocs}"
112 # Remove invalid symbols from LDFLAGS
113 export LDFLAGS="$(echo ${LDFLAGS} | sed -e 's|[[:space:]][[:space:]]|[[:space:]]|g' -e 's|\n||g')"
114 # build against ffmpeg4.4
115 export PKG_CONFIG_PATH='/usr/lib/ffmpeg4.4/pkgconfig'
116 # ensure jdk 8 is used when building
117 export JAVA_HOME=/usr/lib/jvm/java-8-openjdk
118 # Fix usage on newer CMAKE versions
119 export CMAKE_POLICY_VERSION_MINIMUM=3.5
120
121 ../gradle-4.8/bin/gradle
122}
123
124package_java8-openjfx() {
125 depends=(
126 jre8-openjdk
127 libgl
128 libx11
129 libxtst
130 )
131 optdepends=(
132 'ffmpeg4.4: Media support',
133 'gtk2: GTK2 support',
134 'gtk3: GTK3 support',
135 'webkit2gtk: Web support'
136 )
137 provides=('java-openjfx=8')
138
139 cd rt-${pkgver//./}-ga
140
141 install -dm 755 "${pkgdir}"/usr/lib/jvm/java-8-openjdk/jre
142 cp -dr --no-preserve=ownership build/sdk/{bin,lib} "${pkgdir}"/usr/lib/jvm/java-8-openjdk/
143 cp -dr --no-preserve=ownership build/sdk/rt/lib "${pkgdir}"/usr/lib/jvm/java-8-openjdk/jre/
144}
145
146package_java8-openjfx-doc() {
147 cd rt-${pkgver//./}-ga
148
149 install -dm 755 "${pkgdir}"/usr/share/doc
150 cp -dr --no-preserve=ownership build/javadoc "${pkgdir}"/usr/share/doc/java8-openjfx
151}
152
153package_java8-openjfx-src() {
154 cd rt-${pkgver//./}-ga
155
156 install -Dm 644 build/javafx-src.zip -t "${pkgdir}"/usr/lib/jvm/java-8-openjdk/
157}
158
159# vim: ts=2 sw=2 et:
160

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion