jdk8

MEDIUM
maintainer severach 103 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package downloads a prebuilt JDK binary from a non-standard, untrusted host (Adobe's CDN) instead of Oracle's official site, creating a supply-chain risk if the source is tampered with or silently swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:85 "https://cfdownload.adobe.com/pub/adobe/coldfusion/java/java8/java${pkgver}/jdk/jdk-${pkgver}-linux-x64.tar.gz"
Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt JDK binary from a non-standard, untrusted host (Adobe's CDN) instead of Oracle's official site, creating a supply-chain risk if the source is tampered with or silently swapped.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Chris Severance aur.severach AatT spamgourmet.com
2# Contributor: Det <nimetonmaili g-mail>
3
4set -u
5_pkgname='jdk'
6_major='8'
7pkgname="${_pkgname}${_major}"
8#_minor='212'; _build='b10'; _hash='59066701cf1a433da9770636fbc4c9aa'
9#_minor='221'; _build='b11'; _hash='230deb18db3e4014bb8e3e8324f81b43'
10#_minor='231'; _build='b11'; _hash='5b13a193868b4bf28bcb45c792fce896'
11#_minor='241'; _build='b07'; _hash='1f5b5a70bf22433b84d0e960903adac8'
12#_minor='251'; _build='b08'; _hash='3d5a2bb8f8d4428bbe94aed7ec7ae784'
13#_minor='261'; _build='b12'; _hash='a4634525489241b9a9e1aa73d9e118e6'
14#_minor='271'; _build='b09'; _hash='61ae65e088624f5aaa0b1d2d801acb16'
15#_minor='281'; _build='b09'; _hash='89d678f2be164786b292527658ca1605'
16#_minor='291'; _build='b10'; _hash='d7fc238d0cbf4b0dac67be84580cfb4b'
17#_minor='301'; _build='b09'; _hash='d3c52aa6bfa54d3ca74e617f18309292'
18#_minor='311'; _build='b11'; _hash='4d5417147a92418ea8b615e228bb6935'
19#_minor='331'; _build='b09'; _hash='165374ff4ea84ef0bbd821706e29b123'
20#_minor='333'; _build='b02'; _hash='2dee051a5d0647d5be72a7c0abff270e'
21#_minor='341'; _build='b10'; _hash='424b9da4b48848379167015dcc250d8d'
22#_minor='351'; _build='b10'; _hash='10e8cce67c7843478f41411b7003171c'
23#_minor='361'; _build='b09'; _hash='0ae14417abb444ebb02b9815e2103550'
24#_minor='371'; _build='b11'; _hash='ce59cff5c23f4e2eaf4e778a117d4c5b'
25#_minor='391'; _build='b13'; _hash='b291ca3e0c8548b5a51d5a5f50063037'
26#_minor='401'; _build='b10'; _hash='4d245f941845490c91360409ecffb3b4'
27#_minor='431'; _build='b10'; _hash='0d8f12bc927a4e2c9f8568ca567db4ee'
28#_minor='441'; _build='b07'; _hash='7ed26d28139143f38c58992680c214a5'
29#_minor='491'; _build='b10'; _hash='f7fe8e644f724108bdb54139381e29a7'
30_minor='501'; _build='b08'; _hash='ba687cb3cbb24342adc8fdf890b993dc'
31pkgver="${_major}u${_minor}"
32pkgrel='1'
33pkgdesc="Oracle Java ${_major} Development Kit"
34pkgdesc+=' LTS'
35arch=('x86_64')
36url='https://www.oracle.com/java/technologies/javase/javase8u211-later-archive-downloads.html'
37license=('custom:Oracle')
38depends=('ca-certificates-java' 'hicolor-icon-theme' 'java-runtime-common' 'nss' 'xdg-utils')
39depends+=('java-environment-common')
40optdepends=(
41 'alsa-lib: for basic sound support'
42 'gtk2: for Gtk+ look and feel (desktop)'
43 'eclipse-java: to use "Oracle Java Mission Control" plugins in Eclipse'
44)
45makedepends=('awk')
46provides=(
47 "java-runtime=${_major}"
48 "java-runtime-headless=${_major}"
49 "java-web-start=${_major}"
50 "java-runtime-jre=${_major}"
51 "java-runtime-headless-jre=${_major}"
52 "java-web-start-jre=${_major}"
53 "java-openjfx=${_major}"
54 "java-environment=${_major}"
55 "java-environment-jdk=${_major}"
56)
57
58# Variables
59
60_jname="${_pkgname}${_major}"
61_jvmdir="/usr/lib/jvm/java-${_major}-${_pkgname}"
62
63backup=(
64 "etc/java-${_jname}/amd64/jvm.cfg"
65 "etc/java-${_jname}/images/cursors/cursors.properties"
66 "etc/java-${_jname}/management/jmxremote.access"
67 "etc/java-${_jname}/management/management.properties"
68 "etc/java-${_jname}/security/java.policy"
69 "etc/java-${_jname}/security/java.security"
70 "etc/java-${_jname}/security/javaws.policy"
71 "etc/java-${_jname}/content-types.properties"
72 "etc/java-${_jname}/flavormap.properties"
73 "etc/java-${_jname}/fontconfig.properties.src"
74 "etc/java-${_jname}/logging.properties"
75 "etc/java-${_jname}/net.properties"
76 "etc/java-${_jname}/psfont.properties.ja"
77 "etc/java-${_jname}/psfontj2d.properties"
78 "etc/java-${_jname}/sound.properties"
79)
80options=('!strip') # JDK debug-symbols
81install="${pkgname}.install"
82_srcfil="${_pkgname}-${pkgver}-linux-x64.tar.gz"
83source=(
84 #"https://download.oracle.com/otn-pub/java/jdk/${pkgver}-${_build}/${_hash}/${_srcfil}"
85 "https://cfdownload.adobe.com/pub/adobe/coldfusion/java/java8/java${pkgver}/jdk/jdk-${pkgver}-linux-x64.tar.gz"
86 "jconsole-${_jname}.desktop"
87 "jmc-${_jname}.desktop"
88 "jvisualvm-${_jname}.desktop"
89 "policytool-${_jname}.desktop"
90 'readme.sh'
91)
92# from oracle-sqldeveloper
93if ! :; then
94DLAGENTS+=("manual::${startdir:-}/readme.sh ${url} %o %u")
95source[0]="manual://${_srcfil}"
96if [ ! -z "${HOME:-}" ]; then # block mksrcinfo
97 XDG_DOWNLOAD_DIR="$(xdg-user-dir DOWNLOAD 2>/dev/null)" || :
98 if [ -z "${XDG_DOWNLOAD_DIR}" ]; then
99 XDG_DOWNLOAD_DIR=~/'Downloads'
100 fi
101 if [ -s "${XDG_DOWNLOAD_DIR}/${_srcfil}" ] && [ ! -e "${_srcfil}" ]; then
102 if type msg > /dev/null 2>&1; then
103 set +u
104 msg "Scooping files from ${XDG_DOWNLOAD_DIR}" 1>&2
105 msg2 "${_srcfil}" 1>&2
106 set -u
107 ln -sr "${XDG_DOWNLOAD_DIR}/${_srcfil}"
108 fi
109 fi
110fi
111unset _srcfil
112unset XDG_DOWNLOAD_DIR
113fi
114
115md5sums=('18897422ff699decd46afd5890ae9297'
116 '8a66f50efdc867ffd6a27168bc93b210'
117 '1cbde70639abd98db4bace284dbf2bc4'
118 'f0b39865361437f3778ecbe6ffbc0a06'
119 '89704501aff8efe859c31968d8d168e6'
120 '46d719bf4872333ad6d138b050f1ad2d')
121sha256sums=('4d0dc644547d3bb218a31c6c240f407d795233cef95857a24fd729a869df9b61'
122 '65282603bd0804d162f3f7da47bc7f3c91373e87504297d6a6fd6f2f8a1ec4ee'
123 '8f865b52946a9ab98556c56306c7e70ae7aa432b4d005c70df0bba9d2c3111b1'
124 '144e6651fcea08d95f3148d3a8ad17deb93fec4dd9236d37d27d7c648230b870'
125 '635433e9c78ff58af65c316232ac9907d289a324428923788ea0f82ae7f8083b'
126 '4c9d5ab69494b3d0d8b166fd5552aa7d587f44f804cec9e2990842ebcd1c8e1d')
127
128#PKGEXT='.pkg.tar.zst' # gz is much faster than .xz, zst is much faster than gz
129## Alternative mirror, if your local one is throttled:
130## Posting new sites does no good. They get taken down by the admin
131## from too much traffic or complaints from Oracle.
132#source[0]=???
133
134DLAGENTS=("${DLAGENTS[@]// -gqb \"\"/ -gq}")
135DLAGENTS=("${DLAGENTS[@]//curl -/curl -b 'oraclelicense=a' -}")
136
137# https://bugs.openjdk.java.net/browse/JDK-8170157
138# 2020-06-19 jce_policy-8.zip/UnlimitedJCEPolicyJDK8/README.txt
139if [ "${_minor}" -lt 161 ]; then
140 source+=("https://download.oracle.com/otn-pub/java/jce/${_major}/jce_policy-${_major}.zip")
141 _opt_JCE=1
142else
143 _opt_JCE=0
144fi
145
146if ! :; then
147 for _d in "${!DLAGENTS[@]}"; do
148 case "${DLAGENTS[${_d}]}" in
149 'https::'*) DLAGENTS["${_d}"]='https::/usr/bin/wget --no-cookies --header Cookie:oraclelicense=a --no-glob --no-config --continue --tries=3 --waitretry=3 -O %o %u';;
150 esac
151 done
152 makedepends+=('wget')
153fi
154
155prepare() {
156 local -; set -u
157 cd "${_pkgname}1.${_major}.0_${_minor}"
158 chmod 644 lib/amd64/*.so
159 chmod 644 jre/lib/amd64/*.so
160}
161
162package() {
163 local -; set -u
164 cd "${_pkgname}1.${_major}.0_${_minor}"
165
166 set +u; msg2 'Creating directory structure...'; set -u
167 install -d "${pkgdir}/etc/.java/.systemPrefs"
168 install -d "${pkgdir}/usr/lib/jvm/java-${_major}-${_pkgname}/bin"
169 install -d "${pkgdir}/usr/lib/mozilla/plugins"
170 install -d "${pkgdir}/usr/share/licenses/java${_major}-${_pkgname}"
171
172 set +u; msg2 'Removing redundancies...'; set -u
173 pushd 'jre' > /dev/null
174 rm -r 'lib/desktop/icons/HighContrast/'
175 rm -r 'lib/desktop/icons/HighContrastInverse/'
176 rm -r 'lib/desktop/icons/LowContrast/'
177 rm lib/fontconfig.*.bfc
178 rm lib/fontconfig.*.properties.src
179 rm *.txt
180 rm 'COPYRIGHT'
181 rm 'LICENSE'
182 rm 'README'
183 rm -r 'plugin/'
184 popd > /dev/null
185 rm 'man/ja'
186
187 set +u; msg2 'Moving contents...'; set -u
188 mv * "${pkgdir}/${_jvmdir}"
189
190 # Cd to the new playground
191 cd "${pkgdir}/${_jvmdir}"
192
193 set +u; msg2 'Fixing directory structure...'; set -u
194 # Replace duplicate binaries in bin/ with links to jre/bin/
195 local _i
196 for _i in jre/bin/*; do
197 ln -sf "${_jvmdir}/jre/bin/${_i##*/}" "bin/${_i##*/}"
198 done
199
200 # Suffix .desktops + icons (sun-java.png -> sun-java-${_jname}.png)
201 local _i
202 for _i in $(find 'jre/lib/desktop/' -type 'f'); do
203 rename -- '.' "-${_jname}." "${_i}"
204 done
205
206 # Fix .desktop paths
207 sed -e "s|Exec=|Exec=${_jvmdir}/jre/bin/|" \
208 -e "s|.png|-${_jname}.png|" \
209 -i 'jre/lib/desktop/applications'/*
210
211 # Move .desktops + icons to /usr/share
212 mv 'jre/lib/desktop'/* "${pkgdir}/usr/share/"
213 install -m644 "${srcdir}"/*.desktop -t "${pkgdir}/usr/share/applications/"
214
215 # Enable context menu launch (Austcool)
216 sed -e 's:^NoDisplay=true:#&:g' \
217 -e 's:^Exec=/usr.*$:& -F:g' \
218 -i "${pkgdir}/usr/share/applications/sun-java-jdk8.desktop"
219
220 # Move confs to /etc and link back to /usr: /usr/lib/jvm/java-${_jname}/jre/lib -> /etc
221 local _new_etc_path
222 for _new_etc_path in "${backup[@]}"; do
223 # Old location
224 local _old_usr_path="jre/lib/${_new_etc_path#*${_jname}/}"
225
226 # Move
227 install -Dm644 "${_old_usr_path}" "${pkgdir}/${_new_etc_path}"
228 ln -sf "/${_new_etc_path}" "${_old_usr_path}"
229 done
230
231 # Link NPAPI plugin
232 ln -s "${_jvmdir}/jre/lib/amd64/libnpjp2.so" "${pkgdir}/usr/lib/mozilla/plugins/libnpjp2-${_jname}.so"
233
234 # Replace JKS keystore with 'ca-certificates-java'
235 ln -sf '/etc/ssl/certs/java/cacerts' 'jre/lib/security/cacerts'
236
237 # Suffix man pages
238 for _i in $(find 'man/' -type 'f'); do
239 rename -- '.1' "-${_jname}.1" "${_i}"
240 done
241
242 # Move man pages
243 mv 'man/ja_JP.UTF-8/' 'man/ja'
244 mv 'man/' "${pkgdir}/usr/share"
245
246 # Move/link licenses
247 mv 'COPYRIGHT' 'LICENSE' *.txt "${pkgdir}/usr/share/licenses/java${_major}-${_pkgname}/"
248 ln -s "/usr/share/licenses/java${_major}-${_pkgname}/" "${pkgdir}/usr/share/licenses/${pkgname}"
249
250if [ "${_opt_JCE}" -ne 0 ]; then
251 set +u; msg2 'Installing Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files...'; set -u
252 # Replace default "strong", but limited, cryptography to get an "unlimited strength" one for
253 # things like 256-bit AES. Enabled by default in OpenJDK:
254 # - http://suhothayan.blogspot.com/2012/05/how-to-install-java-cryptography.html
255 # - http://www.eyrie.org/~eagle/notes/debian/jce-policy.html
256 install -m644 "${srcdir}/UnlimitedJCEPolicyJDK${_major}"/*.jar 'jre/lib/security/'
257 install -Dm644 "${srcdir}/UnlimitedJCEPolicyJDK${_major}/README.txt" \
258 "${pkgdir}/usr/share/doc/${_pkgname}/README_-_Java_JCE_Unlimited_Strength.txt"
259fi
260
261 set +u; msg2 'Enabling copy+paste in unsigned applets...'; set -u
262 # Copy/paste from system clipboard to unsigned Java applets has been disabled since 6u24:
263 # - https://blogs.oracle.com/kyle/entry/copy_and_paste_in_java
264 # - http://slightlyrandombrokenthoughts.blogspot.com/2011/03/oracle-java-applet-clipboard-injection.html
265 local _text='\
266 // (AUR) Allow unsigned applets to read system clipboard, see:
267 // - https://blogs.oracle.com/kyle/entry/copy_and_paste_in_java
268 // - http://slightlyrandombrokenthoughts.blogspot.com/2011/03/oracle-java-applet-clipboard-injection.html
269 permission java.awt.AWTPermission "accessClipboard";'
270 local _lf=$'\n'
271 _text="${_text//${_lf}/\\n}"
272 local _line
273 _line="$(awk '/permission/{a=NR}; END{print a}' "${pkgdir}/etc/java-${_jname}/security/java.policy")"
274 sed -e "${_line} a ${_text}" -i "${pkgdir}/etc/java-${_jname}/security/java.policy"
275}
276set +u
277

Changes since previous scan

--- PKGBUILD @ 2026-10-17 00:21
+++ PKGBUILD @ 2026-11-01 00:21
@@ -26,13 +26,14 @@
#_minor='401'; _build='b10'; _hash='4d245f941845490c91360409ecffb3b4'
#_minor='431'; _build='b10'; _hash='0d8f12bc927a4e2c9f8568ca567db4ee'
#_minor='441'; _build='b07'; _hash='7ed26d28139143f38c58992680c214a5'
-_minor='491'; _build='b10'; _hash='f7fe8e644f724108bdb54139381e29a7'
+#_minor='491'; _build='b10'; _hash='f7fe8e644f724108bdb54139381e29a7'
+_minor='501'; _build='b08'; _hash='ba687cb3cbb24342adc8fdf890b993dc'
pkgver="${_major}u${_minor}"
pkgrel='1'
pkgdesc="Oracle Java ${_major} Development Kit"
pkgdesc+=' LTS'
arch=('x86_64')
-url='https://www.oracle.com/technetwork/java/javase/downloads/index.html'
+url='https://www.oracle.com/java/technologies/javase/javase8u211-later-archive-downloads.html'
license=('custom:Oracle')
depends=('ca-certificates-java' 'hicolor-icon-theme' 'java-runtime-common' 'nss' 'xdg-utils')
depends+=('java-environment-common')
@@ -111,13 +112,13 @@
unset XDG_DOWNLOAD_DIR
fi
-md5sums=('64e1da87a154fb4cfb100714ee0d25fd'
+md5sums=('18897422ff699decd46afd5890ae9297'
'8a66f50efdc867ffd6a27168bc93b210'
'1cbde70639abd98db4bace284dbf2bc4'
'f0b39865361437f3778ecbe6ffbc0a06'
'89704501aff8efe859c31968d8d168e6'
'46d719bf4872333ad6d138b050f1ad2d')
-sha256sums=('29b93a849cc47f62b38a504853bd472cea20bb04a1b1a512eb6c16be9a6a6d98'
+sha256sums=('4d0dc644547d3bb218a31c6c240f407d795233cef95857a24fd729a869df9b61'
'65282603bd0804d162f3f7da47bc7f3c91373e87504297d6a6fd6f2f8a1ec4ee'
'8f865b52946a9ab98556c56306c7e70ae7aa432b4d005c70df0bba9d2c3111b1'
'144e6651fcea08d95f3148d3a8ad17deb93fec4dd9236d37d27d7c648230b870'
@@ -152,15 +153,14 @@
fi
prepare() {
- set -u
+ local -; set -u
cd "${_pkgname}1.${_major}.0_${_minor}"
chmod 644 lib/amd64/*.so
chmod 644 jre/lib/amd64/*.so
- set +u
}
package() {
- set -u
+ local -; set -u
cd "${_pkgname}1.${_major}.0_${_minor}"
set +u; msg2 'Creating directory structure...'; set -u
@@ -272,7 +272,6 @@
local _line
_line="$(awk '/permission/{a=NR}; END{print a}' "${pkgdir}/etc/java-${_jname}/security/java.policy")"
sed -e "${_line} a ${_text}" -i "${pkgdir}/etc/java-${_jname}/security/java.policy"
- set +u
}
set +u

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Medium 2
2026-10-31 00:07:41 Medium 2
2026-10-30 00:29:30 Medium 2
2026-10-29 00:13:55 Medium 2
2026-10-28 00:06:54 Medium 2
2026-10-27 00:23:28 Medium 2
2026-10-26 00:12:40 Medium 2
2026-10-25 00:20:48 Medium 2
2026-10-24 00:14:55 Medium 2
2026-10-23 00:02:19 Medium 2
2026-10-22 00:13:10 Medium 2
2026-10-21 00:12:50 Medium 2
2026-10-20 00:10:31 Medium 2
2026-10-19 00:03:55 Medium 2
2026-10-18 00:06:55 Medium 2
2026-10-17 19:19:13 Medium 2
2026-10-17 00:21:55 Medium 2
2026-10-16 00:12:47 Medium 2
2026-10-15 00:28:05 Medium 2
2026-10-14 00:06:47 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion