jdk25-graalvm-bin

LOW

maintainer gudzpoz 3 votes scanned 2026-10-03 00:23:04.761738

View on AUR

Why flagged

The package downloads a prebuilt GraalVM JDK binary from Oracle's official gds.oracle.com domain, which is plausibly Oracle's own infrastructure; despite the non-standard hostname, the source is verifiable and the checksums are provided, making this a legitimate build with low risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt GraalVM JDK binary from Oracle's official gds.oracle.com domain, which is plausibly Oracle's own infrastructure; despite the non-standard hostname, the source is verifiable and the checksums are provided, making this a legitimate build with low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:44 source_x86_64=("https://gds.oracle.com/download/graal/${_release}/archive/graalvm-jdk-${_release}-${_jdkver}_linux-x64_bin.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: gudzpoz <gudzpoz at live dot com>
    
      2
    
      3# This PKGBUILD heavily borrows from jdk17-temurin on AUR maintained by:
    
      4# Michael Lass <bevan at bi-co dot net>
    
      5
    
      6_major=25
    
      7_minor=2.4
    
      8
    
      9# In the versioning scheme of GraalVM since JDK 25, three version numbers are
    
      10# relevant:
    
      11# - GraalVM release version: "GraalVM 25 Innovation 2" or 25i2
    
      12# - Graal compiler version: "graal 25.2.4"
    
      13# - Base JDK version: "jdk 25.0.4"
    
      14# We track the first (Graal compiler version) with this package since it is what
    
      15# they use in their release notes <https://www.graalvm.org/release-notes/25.1/>.
    
      16
    
      17_release=25i2
    
      18_jdkver=25.0.4
    
      19_build=+7.1
    
      20
    
      21pkgname="jdk${_major}-graalvm-bin"
    
      22pkgver="${_major}.${_minor}"
    
      23pkgrel=1
    
      24pkgdesc="Advanced JDK with ahead-of-time Native Image compilation"
    
      25arch=('x86_64' 'aarch64')
    
      26url='https://www.graalvm.org/'
    
      27license=('custom')
    
      28
    
      29depends=(
    
      30    'ca-certificates-java' 'java-runtime-common' 'java-environment-common'
    
      31    'freetype2' 'glibc' 'libgcc' 'libstdc++' 'libz.so'
    
      32)
    
      33optdepends=(
    
      34    'alsa-lib: for basic sound support'
    
      35    'libx11: for AWT support'
    
      36    'libxext: for AWT support'
    
      37    'libxi: for AWT support'
    
      38    'libxrender: for AWT support'
    
      39    'libxtst: for AWT support'
    
      40)
    
      41provides=("java-runtime=${_major}" "java-runtime-headless=${_major}" "java-environment=${_major}")
    
      42options=('staticlibs' !debug !strip)
    
      43install=install_jdk25-graalvm.sh
    
      44source_x86_64=("https://gds.oracle.com/download/graal/${_release}/archive/graalvm-jdk-${_release}-${_jdkver}_linux-x64_bin.tar.gz")
    
      45source_aarch64=("https://gds.oracle.com/download/graal/${_release}/archive/graalvm-jdk-${_release}-${_jdkver}_linux-aarch64_bin.tar.gz")
    
      46sha256sums_x86_64=('7100d99cbfec68b03b669cc60c7e8592bbcda1732e8eaebc460fe0b75849a894')
    
      47sha256sums_aarch64=('0bc65f9c36ae77bd83aad46a2b4de4b0ec97da1b4ac83fedb59e19f868873dee')
    
      48
    
      49_jvmdir=/usr/lib/jvm/java-${_major}-graalvm
    
      50_jdkdir="graalvm-${pkgver}${_build}"
    
      51
    
      52package() {
    
      53
    
      54    install -dm 755 "${pkgdir}${_jvmdir}"
    
      55    cp -a "${srcdir}/${_jdkdir}"/* "${pkgdir}${_jvmdir}"
    
      56
    
      57    cd "${pkgdir}${_jvmdir}"
    
      58
    
      59    # Conf
    
      60    install -dm 755 "${pkgdir}/etc"
    
      61    mv conf "${pkgdir}/etc/java-${_major}-graalvm"
    
      62    ln -sf "/etc/java-${_major}-graalvm" conf
    
      63
    
      64    # Legal
    
      65    install -dm 755 "${pkgdir}/usr/share/licenses"
    
      66    mv legal "${pkgdir}/usr/share/licenses/${pkgname}"
    
      67    ln -sf "/usr/share/licenses/${pkgname}" legal
    
      68    # Other licenses
    
      69    mv LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      70    mv license-information-user-manual.zip "${pkgdir}/usr/share/licenses/${pkgname}/license-information-user-manual.zip"
    
      71
    
      72    # Man pages
    
      73    for f in man/man1/*; do
    
      74        install -Dm 644 "${f}" "${pkgdir}/usr/share/${f/\.1/-graalvm${_major}.1}"
    
      75    done
    
      76    rm -rf man
    
      77    ln -sf /usr/share/man man
    
      78
    
      79    # Link JKS keystore from ca-certificates-utils
    
      80    rm -f lib/security/cacerts
    
      81    ln -sf /etc/ssl/certs/java/cacerts lib/security/cacerts
    
      82
    
      83}
    
      84

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2