jdk25-graalvm-bin

maintainer gudzpoz · 3 votes · scanned 2026-08-18 15:40:04.149666

MEDIUM

Why flagged One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:44 source_x86_64=("https://gds.oracle.com/download/graal/${_release}/archive/graalvm-jdk-${_release}-${_jdkver}_linux-x64_bin.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: gudzpoz <gudzpoz at live dot com>
    
      2
    
      3# This PKGBUILD heavily borrows from jdk17-temurin on AUR maintained by:
    
      4# Michael Lass <bevan at bi-co dot net>
    
      5
    
      6_major=25
    
      7_minor=2.4
    
      8
    
      9# In the versioning scheme of GraalVM since JDK 25, three version numbers are
    
      10# relevant:
    
      11# - GraalVM release version: "GraalVM 25 Innovation 2" or 25i2
    
      12# - Graal compiler version: "graal 25.2.4"
    
      13# - Base JDK version: "jdk 25.0.4"
    
      14# We track the first (Graal compiler version) with this package since it is what
    
      15# they use in their release notes <https://www.graalvm.org/release-notes/25.1/>.
    
      16
    
      17_release=25i2
    
      18_jdkver=25.0.4
    
      19_build=+7.1
    
      20
    
      21pkgname="jdk${_major}-graalvm-bin"
    
      22pkgver="${_major}.${_minor}"
    
      23pkgrel=1
    
      24pkgdesc="Advanced JDK with ahead-of-time Native Image compilation"
    
      25arch=('x86_64' 'aarch64')
    
      26url='https://www.graalvm.org/'
    
      27license=('custom')
    
      28
    
      29depends=(
    
      30    'ca-certificates-java' 'java-runtime-common' 'java-environment-common'
    
      31    'freetype2' 'glibc' 'libgcc' 'libstdc++' 'libz.so'
    
      32)
    
      33optdepends=(
    
      34    'alsa-lib: for basic sound support'
    
      35    'libx11: for AWT support'
    
      36    'libxext: for AWT support'
    
      37    'libxi: for AWT support'
    
      38    'libxrender: for AWT support'
    
      39    'libxtst: for AWT support'
    
      40)
    
      41provides=("java-runtime=${_major}" "java-runtime-headless=${_major}" "java-environment=${_major}")
    
      42options=('staticlibs' !debug !strip)
    
      43install=install_jdk25-graalvm.sh
    
      44source_x86_64=("https://gds.oracle.com/download/graal/${_release}/archive/graalvm-jdk-${_release}-${_jdkver}_linux-x64_bin.tar.gz")
    
      45source_aarch64=("https://gds.oracle.com/download/graal/${_release}/archive/graalvm-jdk-${_release}-${_jdkver}_linux-aarch64_bin.tar.gz")
    
      46sha256sums_x86_64=('7100d99cbfec68b03b669cc60c7e8592bbcda1732e8eaebc460fe0b75849a894')
    
      47sha256sums_aarch64=('0bc65f9c36ae77bd83aad46a2b4de4b0ec97da1b4ac83fedb59e19f868873dee')
    
      48
    
      49_jvmdir=/usr/lib/jvm/java-${_major}-graalvm
    
      50_jdkdir="graalvm-${pkgver}${_build}"
    
      51
    
      52package() {
    
      53
    
      54    install -dm 755 "${pkgdir}${_jvmdir}"
    
      55    cp -a "${srcdir}/${_jdkdir}"/* "${pkgdir}${_jvmdir}"
    
      56
    
      57    cd "${pkgdir}${_jvmdir}"
    
      58
    
      59    # Conf
    
      60    install -dm 755 "${pkgdir}/etc"
    
      61    mv conf "${pkgdir}/etc/java-${_major}-graalvm"
    
      62    ln -sf "/etc/java-${_major}-graalvm" conf
    
      63
    
      64    # Legal
    
      65    install -dm 755 "${pkgdir}/usr/share/licenses"
    
      66    mv legal "${pkgdir}/usr/share/licenses/${pkgname}"
    
      67    ln -sf "/usr/share/licenses/${pkgname}" legal
    
      68    # Other licenses
    
      69    mv LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      70    mv license-information-user-manual.zip "${pkgdir}/usr/share/licenses/${pkgname}/license-information-user-manual.zip"
    
      71
    
      72    # Man pages
    
      73    for f in man/man1/*; do
    
      74        install -Dm 644 "${f}" "${pkgdir}/usr/share/${f/\.1/-graalvm${_major}.1}"
    
      75    done
    
      76    rm -rf man
    
      77    ln -sf /usr/share/man man
    
      78
    
      79    # Link JKS keystore from ca-certificates-utils
    
      80    rm -f lib/security/cacerts
    
      81    ln -sf /etc/ssl/certs/java/cacerts lib/security/cacerts
    
      82
    
      83}
    
      84

Changes since previous scan

--- PKGBUILD @ 2026-07-02 06:44
+++ PKGBUILD @ 2026-08-18 15:40
@@ -4,8 +4,19 @@
 # Michael Lass <bevan at bi-co dot net>
 
 _major=25
-_minor=0.2
-_build=+10.1
+_minor=2.4
+
+# In the versioning scheme of GraalVM since JDK 25, three version numbers are
+# relevant:
+# - GraalVM release version: "GraalVM 25 Innovation 2" or 25i2
+# - Graal compiler version: "graal 25.2.4"
+# - Base JDK version: "jdk 25.0.4"
+# We track the first (Graal compiler version) with this package since it is what
+# they use in their release notes <https://www.graalvm.org/release-notes/25.1/>.
+
+_release=25i2
+_jdkver=25.0.4
+_build=+7.1
 
 pkgname="jdk${_major}-graalvm-bin"
 pkgver="${_major}.${_minor}"
@@ -15,18 +26,28 @@
 url='https://www.graalvm.org/'
 license=('custom')
 
-depends=('ca-certificates-java' 'java-runtime-common' 'java-environment-common')
-optdepends=('onnxruntime: machine learning-driven static profiling')
+depends=(
+    'ca-certificates-java' 'java-runtime-common' 'java-environment-common'
+    'freetype2' 'glibc' 'libgcc' 'libstdc++' 'libz.so'
+)
+optdepends=(
+    'alsa-lib: for basic sound support'
+    'libx11: for AWT support'
+    'libxext: for AWT support'
+    'libxi: for AWT support'
+    'libxrender: for AWT support'
+    'libxtst: for AWT support'
+)
 provides=("java-runtime=${_major}" "java-runtime-headless=${_major}" "java-environment=${_major}")
 options=('staticlibs' !debug !strip)
 install=install_jdk25-graalvm.sh
-source_x86_64=("https://download.oracle.com/graalvm/25/archive/graalvm-jdk-${pkgver}_linux-x64_bin.tar.gz")
-source_aarch64=("https://download.oracle.com/graalvm/25/archive/graalvm-jdk-${pkgver}_linux-aarch64_bin.tar.gz")
-sha256sums_x86_64=('af545b1bc12ecd24a5ba95e2370da2163e87c4cf13991a482d5b176bf4165c12')
-sha256sums_aarch64=('e0e18106fa1d8628d8ba21f548865211d7c8608a3423f7b25cb2aa4eef9abf10')
+source_x86_64=("https://gds.oracle.com/download/graal/${_release}/archive/graalvm-jdk-${_release}-${_jdkver}_linux-x64_bin.tar.gz")
+source_aarch64=("https://gds.oracle.com/download/graal/${_release}/archive/graalvm-jdk-${_release}-${_jdkver}_linux-aarch64_bin.tar.gz")
+sha256sums_x86_64=('7100d99cbfec68b03b669cc60c7e8592bbcda1732e8eaebc460fe0b75849a894')
+sha256sums_aarch64=('0bc65f9c36ae77bd83aad46a2b4de4b0ec97da1b4ac83fedb59e19f868873dee')
 
 _jvmdir=/usr/lib/jvm/java-${_major}-graalvm
-_jdkdir="graalvm-jdk-${pkgver}${_build}"
+_jdkdir="graalvm-${pkgver}${_build}"
 
 package() {
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 15:40:04	MEDIUM	1
2026-07-02 06:44:17	CLEAN	2
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1