jdk17-graalvm-ee-bin

MEDIUM

maintainer w568w 7 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt GraalVM binaries from archive.org, a non-standard and unverifiable host for official Oracle releases, creating a supply-chain risk if the source were swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 source_x86_64=("https://archive.org/download/oracle-graalvm-jdk-${_java}/graalvm-jdk-${pkgver}_linux-x64_bin.tar.gz")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads prebuilt GraalVM binaries from archive.org, a non-standard and unverifiable host for official Oracle releases, creating a supply-chain risk if the source were swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rasmus Moorats <xx+aur@nns.ee>
    
      2# Maintainer: w568w <w568w at outlook dot com>
    
      3_java=17
    
      4_java_minor=+1.1
    
      5pkgname="jdk${_java}-graalvm-ee-bin"
    
      6pkgver=17.0.20.1.1
    
      7pkgrel=1
    
      8pkgdesc="Universal virtual machine for running applications written in a variety of languages (JVM-based, LLVM-based, or other), Java ${_java} version"
    
      9arch=('x86_64'
    
      10	'aarch64')
    
      11url='https://www.graalvm.org/'
    
      12license=('LicenseRef-OTN')
    
      13depends=('java-runtime-common'
    
      14	'java-environment-common'
    
      15	'freetype2'
    
      16	'libx11'
    
      17	'libxext'
    
      18	'libxi'
    
      19	'libxrender'
    
      20	'libxtst'
    
      21	'alsa-lib'
    
      22	'python')
    
      23makedepends=()
    
      24provides=("java-runtime=${_java}"
    
      25	"java-environment=${_java}"
    
      26	"java-environment-openjdk=${_java}")
    
      27options=('staticlibs'
    
      28	'!debug')
    
      29install="$pkgname.install"
    
      30sha256sums_x86_64=('24fe1deba281f671a96a6fbcbaa63ed61754b28a8f06de637ecd21093d69f65e')
    
      31sha256sums_aarch64=('3291553f1e59abbeca8731ff51a0e59449ad20e4818e64ca4b929c01452f33e8')
    
      32source_x86_64=("https://archive.org/download/oracle-graalvm-jdk-${_java}/graalvm-jdk-${pkgver}_linux-x64_bin.tar.gz")
    
      33source_aarch64=("https://archive.org/download/oracle-graalvm-jdk-${_java}/graalvm-jdk-${pkgver}_linux-aarch64_bin.tar.gz")
    
      34package() {
    
      35	cd "graalvm-jdk-${pkgver}${_java_minor}"
    
      36	mkdir -p "$pkgdir/usr/lib/jvm/java-${_java}-graalvm-ee/"
    
      37	cp -a -t "$pkgdir/usr/lib/jvm/java-${_java}-graalvm-ee/" ./*
    
      38	install -DTm644 LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2