jdk8-docs

maintainer Firechris · 6 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads official Oracle JDK and JavaFX documentation archives from Oracle's own domain; despite the static analyzer flag for a non-standard host, the sources are legitimate project documentation, not executable code, and the worst case of a swapped source would be tampered documentation, not code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official Oracle JDK and JavaFX documentation archives from Oracle's own domain; despite the static analyzer flag for a non-standard host, the sources are legitimate project documentation, not executable code, and the worst case of a swapped source would be tampered documentation, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "https://download.oracle.com/otn-pub/java/jdk/${pkgver}-${_buildjd}/${_hashjd}/jdk-${pkgver}-docs-all.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Chris G. <chris-git@gmx.com>
    
      2# Contributor: Chris Severance aur.severach AatT spamgourmet.com
    
      3# Contributor: Felix Golatofski <contact@xdfr.de>
    
      4# Contributor: Det
    
      5# Contributor: Ondrej Kucera <ondrej.kucera@centrum.cz>
    
      6# Contributor: Andrea Scarpino <bash.lnx@gmail.com>
    
      7
    
      8
    
      9set -u
    
      10_major='8'
    
      11pkgname="jdk${_major}-docs"
    
      12_minorjd='401'
    
      13_buildjd='b10'
    
      14_hashjd='4d245f941845490c91360409ecffb3b4'
    
      15_minorfx='401'
    
      16_buildfx='b10'
    
      17_hashfx='4d245f941845490c91360409ecffb3b4'
    
      18pkgver="${_major}u${_minorjd}"
    
      19pkgverfx="${_major}u${_minorfx}"
    
      20pkgrel='1'
    
      21pkgdesc="Documentation for Oracle Java ${_major} Development Kit and JavaFX ${_major}"
    
      22arch=('any')
    
      23url='https://www.oracle.com/java/technologies/javase-jdk8-doc-downloads.html'
    
      24license=('custom:Oracle')
    
      25depends=("java-environment>=${_major}")
    
      26options=('!strip')
    
      27_srcfil="jdk-${pkgver}-docs-all.zip"
    
      28source=(
    
      29  "https://download.oracle.com/otn-pub/java/jdk/${pkgver}-${_buildjd}/${_hashjd}/jdk-${pkgver}-docs-all.zip"
    
      30  "https://download.oracle.com/otn-pub/java/javafx/${_major}.0.${_minorfx}-${_buildfx}/${_hashfx}/javafx-${pkgverfx}-apidocs.zip"
    
      31  'LICENSE-Documentation.txt'
    
      32  'LICENSE-Oracle-Legal-Notices.txt'
    
      33)
    
      34# from oracle-sqldeveloper
    
      35DLAGENTS+=("manual::${startdir:-}/readme.sh %o %u")
    
      36source[0]="manual://${_srcfil}"
    
      37if [ ! -z "${HOME:-}" ]; then # block mksrcinfo
    
      38  XDG_DOWNLOAD_DIR="$(xdg-user-dir DOWNLOAD 2>/dev/null)" || :
    
      39  if [ -z "${XDG_DOWNLOAD_DIR}" ]; then
    
      40    XDG_DOWNLOAD_DIR=~/'Downloads'
    
      41  fi
    
      42  if [ -s "${XDG_DOWNLOAD_DIR}/${_srcfil}" ] && [ ! -e "${_srcfil}" ]; then
    
      43    if type msg > /dev/null 2>&1; then
    
      44      set +u
    
      45      msg "Scooping files from ${XDG_DOWNLOAD_DIR}" 1>&2
    
      46      msg2 "${_srcfil}" 1>&2
    
      47      set -u
    
      48      ln -sr "${XDG_DOWNLOAD_DIR}/${_srcfil}"
    
      49    fi
    
      50  fi
    
      51fi
    
      52unset _srcfil
    
      53unset XDG_DOWNLOAD_DIR
    
      54
    
      55sha256sums=('ca37a49cec8ea4171743d8802c30600742a668abb837de488afdcd99b8e1301f'
    
      56            '6618f37f41cb6feb95eba7333e2395ee35a6f1fb2517ed1da95a98e25bb4ce00'
    
      57            '14dc1953902010f7b48891e795183b39c048b19881815eec6a57cf3d62631ab7'
    
      58            '99e666088f11baacfe1816747e69441a7002e024ac0d7a4ca4092c6cb2658c9f')
    
      59sha512sums=('613e55927872d2f3aaabf70d73ad2f206dcada5bf7a652ccc833d947d0ec88b0ab2d6fea5f80ce4fd1c2c3bb2dfc9f63f7931a72da6788df5a65c0eca83126c7'
    
      60            'fa6a7ca1acbd42c8b9bf82ab2c8f072bd46a71005d684c4e2c34be5b331c85556034e935f87ab3c140dd1baddcc2ed607f3a10c2d76daad9cea562ca0cc2eaca'
    
      61            '16ec94fa0739547af03192be3bc4ba74888fc0f3c1fefb2a1be3e0801f52f62af438dab91669a1598da30eb45e0ce2d9694e5fc106c77a42411828c4b29cf751'
    
      62            '5137995bf26bbae92d5e33107a1c90ec88ea67bd3b22d28166e3c47cece04c67685f012fec2c61e41be86e07842b93ec1f72a4e05d47111b0f21de060c3b09ad')
    
      63
    
      64DLAGENTS=('https::/usr/bin/curl -fLC - --retry 3 --retry-delay 3 -b oraclelicense=a -o %o %u')
    
      65
    
      66package() {
    
      67  set -u
    
      68  # Create Dirs
    
      69  install -d "${pkgdir}/usr/share/doc/java${_major}/javafx/"
    
      70
    
      71  # Install
    
      72  mv docs/* "${pkgdir}/usr/share/doc/java${_major}/"
    
      73  mv api "${pkgdir}/usr/share/doc/java${_major}/javafx/"
    
      74
    
      75  # License
    
      76  install -Dpm644 'LICENSE-Oracle-Legal-Notices.txt' "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      77  set +u
    
      78}
    
      79set +u
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2