jdk8

maintainer severach · 103 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Oracle JDK 8 binary from Adobe's CDN (cfdownload.adobe.com) rather than from Oracle's official download servers. The original Oracle URL is commented out. While Adobe does legitimately redistribute Oracle JDK 8 for use with ColdFusion, this is still a non-official redistribution channel for a JDK that will be executed on the user's system. The checksums (md5 and sha256) are present and would catch tampering, but the source host is not Oracle's official distribution point. This is a genuine supply-chain concern: Adobe's CDN could serve a different binary than Oracle's official release, and users have no way to verify this matches Oracle's canonical release without independently obtaining the official tarball. The risk is real but not clearly malicious — it's a convenience workaround for Oracle's login-gated downloads, similar to other AUR packages that use mirror hosts for Oracle software. The presence of both md5 and sha256 checksums mitigates (but does not eliminate) the risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:84 "https://cfdownload.adobe.com/pub/adobe/coldfusion/java/java8/java${pkgver}/jdk/jdk-${pkgver}-linux-x64.tar.gz"

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it MEDIUM (confidence 75%): The PKGBUILD downloads a prebuilt Oracle JDK 8 binary from Adobe's CDN (cfdownload.adobe.com) rather than from Oracle's official download servers. The original Oracle URL is commented out. While Adobe does legitimately redistribute Oracle JDK 8 for use with ColdFusion, this is still a non-official redistribution channel for a JDK that will be executed on the user's system. The checksums (md5 and sha256) are present and would catch tampering, but the source host is not Oracle's official distribution point. This is a genuine supply-chain concern: Adobe's CDN could serve a different binary than Oracle's official release, and users have no way to verify this matches Oracle's canonical release without independently obtaining the official tarball. The risk is real but not clearly malicious — it's a convenience workaround for Oracle's login-gated downloads, similar to other AUR packages that use mirror hosts for Oracle software. The presence of both md5 and sha256 checksums mitigates (but does not eliminate) the risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Chris Severance aur.severach AatT spamgourmet.com
    
      2# Contributor: Det <nimetonmaili g-mail>
    
      3
    
      4set -u
    
      5_pkgname='jdk'
    
      6_major='8'
    
      7pkgname="${_pkgname}${_major}"
    
      8#_minor='212'; _build='b10'; _hash='59066701cf1a433da9770636fbc4c9aa'
    
      9#_minor='221'; _build='b11'; _hash='230deb18db3e4014bb8e3e8324f81b43'
    
      10#_minor='231'; _build='b11'; _hash='5b13a193868b4bf28bcb45c792fce896'
    
      11#_minor='241'; _build='b07'; _hash='1f5b5a70bf22433b84d0e960903adac8'
    
      12#_minor='251'; _build='b08'; _hash='3d5a2bb8f8d4428bbe94aed7ec7ae784'
    
      13#_minor='261'; _build='b12'; _hash='a4634525489241b9a9e1aa73d9e118e6'
    
      14#_minor='271'; _build='b09'; _hash='61ae65e088624f5aaa0b1d2d801acb16'
    
      15#_minor='281'; _build='b09'; _hash='89d678f2be164786b292527658ca1605'
    
      16#_minor='291'; _build='b10'; _hash='d7fc238d0cbf4b0dac67be84580cfb4b'
    
      17#_minor='301'; _build='b09'; _hash='d3c52aa6bfa54d3ca74e617f18309292'
    
      18#_minor='311'; _build='b11'; _hash='4d5417147a92418ea8b615e228bb6935'
    
      19#_minor='331'; _build='b09'; _hash='165374ff4ea84ef0bbd821706e29b123'
    
      20#_minor='333'; _build='b02'; _hash='2dee051a5d0647d5be72a7c0abff270e'
    
      21#_minor='341'; _build='b10'; _hash='424b9da4b48848379167015dcc250d8d'
    
      22#_minor='351'; _build='b10'; _hash='10e8cce67c7843478f41411b7003171c'
    
      23#_minor='361'; _build='b09'; _hash='0ae14417abb444ebb02b9815e2103550'
    
      24#_minor='371'; _build='b11'; _hash='ce59cff5c23f4e2eaf4e778a117d4c5b'
    
      25#_minor='391'; _build='b13'; _hash='b291ca3e0c8548b5a51d5a5f50063037'
    
      26#_minor='401'; _build='b10'; _hash='4d245f941845490c91360409ecffb3b4'
    
      27#_minor='431'; _build='b10'; _hash='0d8f12bc927a4e2c9f8568ca567db4ee'
    
      28#_minor='441'; _build='b07'; _hash='7ed26d28139143f38c58992680c214a5'
    
      29_minor='491'; _build='b10'; _hash='f7fe8e644f724108bdb54139381e29a7'
    
      30pkgver="${_major}u${_minor}"
    
      31pkgrel='1'
    
      32pkgdesc="Oracle Java ${_major} Development Kit"
    
      33pkgdesc+=' LTS'
    
      34arch=('x86_64')
    
      35url='https://www.oracle.com/technetwork/java/javase/downloads/index.html'
    
      36license=('custom:Oracle')
    
      37depends=('ca-certificates-java' 'hicolor-icon-theme' 'java-runtime-common' 'nss' 'xdg-utils')
    
      38depends+=('java-environment-common')
    
      39optdepends=(
    
      40  'alsa-lib: for basic sound support'
    
      41  'gtk2: for Gtk+ look and feel (desktop)'
    
      42  'eclipse-java: to use "Oracle Java Mission Control" plugins in Eclipse'
    
      43)
    
      44makedepends=('awk')
    
      45provides=(
    
      46  "java-runtime=${_major}"
    
      47  "java-runtime-headless=${_major}"
    
      48  "java-web-start=${_major}"
    
      49  "java-runtime-jre=${_major}"
    
      50  "java-runtime-headless-jre=${_major}"
    
      51  "java-web-start-jre=${_major}"
    
      52  "java-openjfx=${_major}"
    
      53  "java-environment=${_major}"
    
      54  "java-environment-jdk=${_major}"
    
      55)
    
      56
    
      57# Variables
    
      58
    
      59_jname="${_pkgname}${_major}"
    
      60_jvmdir="/usr/lib/jvm/java-${_major}-${_pkgname}"
    
      61
    
      62backup=(
    
      63  "etc/java-${_jname}/amd64/jvm.cfg"
    
      64  "etc/java-${_jname}/images/cursors/cursors.properties"
    
      65  "etc/java-${_jname}/management/jmxremote.access"
    
      66  "etc/java-${_jname}/management/management.properties"
    
      67  "etc/java-${_jname}/security/java.policy"
    
      68  "etc/java-${_jname}/security/java.security"
    
      69  "etc/java-${_jname}/security/javaws.policy"
    
      70  "etc/java-${_jname}/content-types.properties"
    
      71  "etc/java-${_jname}/flavormap.properties"
    
      72  "etc/java-${_jname}/fontconfig.properties.src"
    
      73  "etc/java-${_jname}/logging.properties"
    
      74  "etc/java-${_jname}/net.properties"
    
      75  "etc/java-${_jname}/psfont.properties.ja"
    
      76  "etc/java-${_jname}/psfontj2d.properties"
    
      77  "etc/java-${_jname}/sound.properties"
    
      78)
    
      79options=('!strip') # JDK debug-symbols
    
      80install="${pkgname}.install"
    
      81_srcfil="${_pkgname}-${pkgver}-linux-x64.tar.gz"
    
      82source=(
    
      83  #"https://download.oracle.com/otn-pub/java/jdk/${pkgver}-${_build}/${_hash}/${_srcfil}"
    
      84  "https://cfdownload.adobe.com/pub/adobe/coldfusion/java/java8/java${pkgver}/jdk/jdk-${pkgver}-linux-x64.tar.gz"
    
      85  "jconsole-${_jname}.desktop"
    
      86  "jmc-${_jname}.desktop"
    
      87  "jvisualvm-${_jname}.desktop"
    
      88  "policytool-${_jname}.desktop"
    
      89  'readme.sh'
    
      90)
    
      91# from oracle-sqldeveloper
    
      92if ! :; then
    
      93DLAGENTS+=("manual::${startdir:-}/readme.sh ${url} %o %u")
    
      94source[0]="manual://${_srcfil}"
    
      95if [ ! -z "${HOME:-}" ]; then # block mksrcinfo
    
      96  XDG_DOWNLOAD_DIR="$(xdg-user-dir DOWNLOAD 2>/dev/null)" || :
    
      97  if [ -z "${XDG_DOWNLOAD_DIR}" ]; then
    
      98    XDG_DOWNLOAD_DIR=~/'Downloads'
    
      99  fi
    
      100  if [ -s "${XDG_DOWNLOAD_DIR}/${_srcfil}" ] && [ ! -e "${_srcfil}" ]; then
    
      101    if type msg > /dev/null 2>&1; then
    
      102      set +u
    
      103      msg "Scooping files from ${XDG_DOWNLOAD_DIR}" 1>&2
    
      104      msg2 "${_srcfil}" 1>&2
    
      105      set -u
    
      106      ln -sr "${XDG_DOWNLOAD_DIR}/${_srcfil}"
    
      107    fi
    
      108  fi
    
      109fi
    
      110unset _srcfil
    
      111unset XDG_DOWNLOAD_DIR
    
      112fi
    
      113
    
      114md5sums=('64e1da87a154fb4cfb100714ee0d25fd'
    
      115         '8a66f50efdc867ffd6a27168bc93b210'
    
      116         '1cbde70639abd98db4bace284dbf2bc4'
    
      117         'f0b39865361437f3778ecbe6ffbc0a06'
    
      118         '89704501aff8efe859c31968d8d168e6'
    
      119         '46d719bf4872333ad6d138b050f1ad2d')
    
      120sha256sums=('29b93a849cc47f62b38a504853bd472cea20bb04a1b1a512eb6c16be9a6a6d98'
    
      121            '65282603bd0804d162f3f7da47bc7f3c91373e87504297d6a6fd6f2f8a1ec4ee'
    
      122            '8f865b52946a9ab98556c56306c7e70ae7aa432b4d005c70df0bba9d2c3111b1'
    
      123            '144e6651fcea08d95f3148d3a8ad17deb93fec4dd9236d37d27d7c648230b870'
    
      124            '635433e9c78ff58af65c316232ac9907d289a324428923788ea0f82ae7f8083b'
    
      125            '4c9d5ab69494b3d0d8b166fd5552aa7d587f44f804cec9e2990842ebcd1c8e1d')
    
      126
    
      127#PKGEXT='.pkg.tar.zst' # gz is much faster than .xz, zst is much faster than gz
    
      128## Alternative mirror, if your local one is throttled:
    
      129## Posting new sites does no good. They get taken down by the admin
    
      130## from too much traffic or complaints from Oracle.
    
      131#source[0]=???
    
      132
    
      133DLAGENTS=("${DLAGENTS[@]// -gqb \"\"/ -gq}")
    
      134DLAGENTS=("${DLAGENTS[@]//curl -/curl -b 'oraclelicense=a' -}")
    
      135
    
      136# https://bugs.openjdk.java.net/browse/JDK-8170157
    
      137# 2020-06-19 jce_policy-8.zip/UnlimitedJCEPolicyJDK8/README.txt
    
      138if [ "${_minor}" -lt 161 ]; then
    
      139  source+=("https://download.oracle.com/otn-pub/java/jce/${_major}/jce_policy-${_major}.zip")
    
      140  _opt_JCE=1
    
      141else
    
      142  _opt_JCE=0
    
      143fi
    
      144
    
      145if ! :; then
    
      146  for _d in "${!DLAGENTS[@]}"; do
    
      147    case "${DLAGENTS[${_d}]}" in
    
      148    'https::'*) DLAGENTS["${_d}"]='https::/usr/bin/wget --no-cookies --header Cookie:oraclelicense=a --no-glob --no-config --continue --tries=3 --waitretry=3 -O %o %u';;
    
      149    esac
    
      150  done
    
      151  makedepends+=('wget')
    
      152fi
    
      153
    
      154prepare() {
    
      155  set -u
    
      156  cd "${_pkgname}1.${_major}.0_${_minor}"
    
      157  chmod 644 lib/amd64/*.so
    
      158  chmod 644 jre/lib/amd64/*.so
    
      159  set +u
    
      160}
    
      161
    
      162package() {
    
      163  set -u
    
      164  cd "${_pkgname}1.${_major}.0_${_minor}"
    
      165
    
      166  set +u; msg2 'Creating directory structure...'; set -u
    
      167  install -d "${pkgdir}/etc/.java/.systemPrefs"
    
      168  install -d "${pkgdir}/usr/lib/jvm/java-${_major}-${_pkgname}/bin"
    
      169  install -d "${pkgdir}/usr/lib/mozilla/plugins"
    
      170  install -d "${pkgdir}/usr/share/licenses/java${_major}-${_pkgname}"
    
      171
    
      172  set +u; msg2 'Removing redundancies...'; set -u
    
      173  pushd 'jre' > /dev/null
    
      174  rm -r 'lib/desktop/icons/HighContrast/'
    
      175  rm -r 'lib/desktop/icons/HighContrastInverse/'
    
      176  rm -r 'lib/desktop/icons/LowContrast/'
    
      177  rm    lib/fontconfig.*.bfc
    
      178  rm    lib/fontconfig.*.properties.src
    
      179  rm    *.txt
    
      180  rm    'COPYRIGHT'
    
      181  rm    'LICENSE'
    
      182  rm    'README'
    
      183  rm -r 'plugin/'
    
      184  popd > /dev/null
    
      185  rm    'man/ja'
    
      186
    
      187  set +u; msg2 'Moving contents...'; set -u
    
      188  mv * "${pkgdir}/${_jvmdir}"
    
      189
    
      190  # Cd to the new playground
    
      191  cd "${pkgdir}/${_jvmdir}"
    
      192
    
      193  set +u; msg2 'Fixing directory structure...'; set -u
    
      194  # Replace duplicate binaries in bin/ with links to jre/bin/
    
      195  local _i
    
      196  for _i in jre/bin/*; do
    
      197    ln -sf "${_jvmdir}/jre/bin/${_i##*/}" "bin/${_i##*/}"
    
      198  done
    
      199
    
      200  # Suffix .desktops + icons (sun-java.png -> sun-java-${_jname}.png)
    
      201  local _i
    
      202  for _i in $(find 'jre/lib/desktop/' -type 'f'); do
    
      203    rename -- '.' "-${_jname}." "${_i}"
    
      204  done
    
      205
    
      206  # Fix .desktop paths
    
      207  sed -e "s|Exec=|Exec=${_jvmdir}/jre/bin/|" \
    
      208      -e "s|.png|-${_jname}.png|" \
    
      209    -i 'jre/lib/desktop/applications'/*
    
      210
    
      211  # Move .desktops + icons to /usr/share
    
      212  mv 'jre/lib/desktop'/* "${pkgdir}/usr/share/"
    
      213  install -m644 "${srcdir}"/*.desktop -t "${pkgdir}/usr/share/applications/"
    
      214
    
      215  # Enable context menu launch (Austcool)
    
      216  sed -e 's:^NoDisplay=true:#&:g' \
    
      217      -e 's:^Exec=/usr.*$:& -F:g' \
    
      218    -i "${pkgdir}/usr/share/applications/sun-java-jdk8.desktop"
    
      219
    
      220  # Move confs to /etc and link back to /usr: /usr/lib/jvm/java-${_jname}/jre/lib -> /etc
    
      221  local _new_etc_path
    
      222  for _new_etc_path in "${backup[@]}"; do
    
      223    # Old location
    
      224    local _old_usr_path="jre/lib/${_new_etc_path#*${_jname}/}"
    
      225
    
      226    # Move
    
      227    install -Dm644 "${_old_usr_path}" "${pkgdir}/${_new_etc_path}"
    
      228    ln -sf "/${_new_etc_path}" "${_old_usr_path}"
    
      229  done
    
      230
    
      231  # Link NPAPI plugin
    
      232  ln -s "${_jvmdir}/jre/lib/amd64/libnpjp2.so" "${pkgdir}/usr/lib/mozilla/plugins/libnpjp2-${_jname}.so"
    
      233
    
      234  # Replace JKS keystore with 'ca-certificates-java'
    
      235  ln -sf '/etc/ssl/certs/java/cacerts' 'jre/lib/security/cacerts'
    
      236
    
      237  # Suffix man pages
    
      238  for _i in $(find 'man/' -type 'f'); do
    
      239    rename -- '.1' "-${_jname}.1" "${_i}"
    
      240  done
    
      241
    
      242  # Move man pages
    
      243  mv 'man/ja_JP.UTF-8/' 'man/ja'
    
      244  mv 'man/' "${pkgdir}/usr/share"
    
      245
    
      246  # Move/link licenses
    
      247  mv 'COPYRIGHT' 'LICENSE' *.txt "${pkgdir}/usr/share/licenses/java${_major}-${_pkgname}/"
    
      248  ln -s "/usr/share/licenses/java${_major}-${_pkgname}/" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      249
    
      250if [ "${_opt_JCE}" -ne 0 ]; then
    
      251  set +u; msg2 'Installing Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files...'; set -u
    
      252  # Replace default "strong", but limited, cryptography to get an "unlimited strength" one for
    
      253  # things like 256-bit AES. Enabled by default in OpenJDK:
    
      254  # - http://suhothayan.blogspot.com/2012/05/how-to-install-java-cryptography.html
    
      255  # - http://www.eyrie.org/~eagle/notes/debian/jce-policy.html
    
      256  install -m644 "${srcdir}/UnlimitedJCEPolicyJDK${_major}"/*.jar 'jre/lib/security/'
    
      257  install -Dm644 "${srcdir}/UnlimitedJCEPolicyJDK${_major}/README.txt" \
    
      258                 "${pkgdir}/usr/share/doc/${_pkgname}/README_-_Java_JCE_Unlimited_Strength.txt"
    
      259fi
    
      260
    
      261  set +u; msg2 'Enabling copy+paste in unsigned applets...'; set -u
    
      262  # Copy/paste from system clipboard to unsigned Java applets has been disabled since 6u24:
    
      263  # - https://blogs.oracle.com/kyle/entry/copy_and_paste_in_java
    
      264  # - http://slightlyrandombrokenthoughts.blogspot.com/2011/03/oracle-java-applet-clipboard-injection.html
    
      265  local _text='\
    
      266         // (AUR) Allow unsigned applets to read system clipboard, see:
    
      267         // - https://blogs.oracle.com/kyle/entry/copy_and_paste_in_java
    
      268         // - http://slightlyrandombrokenthoughts.blogspot.com/2011/03/oracle-java-applet-clipboard-injection.html
    
      269         permission java.awt.AWTPermission "accessClipboard";'
    
      270  local _lf=$'\n'
    
      271  _text="${_text//${_lf}/\\n}"
    
      272  local _line
    
      273  _line="$(awk '/permission/{a=NR}; END{print a}' "${pkgdir}/etc/java-${_jname}/security/java.policy")"
    
      274  sed -e "${_line} a ${_text}" -i "${pkgdir}/etc/java-${_jname}/security/java.policy"
    
      275  set +u
    
      276}
    
      277set +u
    
      278

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2