jetty

LOW

maintainer Dominiquini 49 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The source is a legitimate Jetty release from Maven Central, a trusted repository; the privileged installs are standard systemd/sysusers/tmpfiles configurations for proper service operation, not malicious activity.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a legitimate Jetty release from Maven Central, a trusted repository; the privileged installs are standard systemd/sysusers/tmpfiles configurations for proper service operation, not malicious activity.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=(https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-home/$pkgver/$_distname.tar.gz

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:43 find "$pkgdir/etc/$pkgname" -type f -exec chmod 640 {} + -o -type d -exec chmod 2755 {} +

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dor com>
    
      2# Contributor: Holger Schramm <dev@strace.it>
    
      3# Contributor: Massimiliano Torromeo <massimiliano.torromeo@gmail.com>
    
      4# Contributor: Yegorius <yegorius@domic.us>
    
      5# Contributor: Sergey Shatunov <me@prok.pw>
    
      6
    
      7pkgname=jetty
    
      8pkgver=12.1.14
    
      9pkgrel=1
    
      10pkgdesc="A pure Java-based HTTP server and Java Servlet container"
    
      11arch=('any')
    
      12url="http://www.eclipse.org/jetty/"
    
      13license=('Apache-2.0' 'EPL-2.0')
    
      14depends=('java-environment')
    
      15options=('!strip')
    
      16_distname="$pkgname-home-$pkgver"
    
      17
    
      18source=(https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-home/$pkgver/$_distname.tar.gz
    
      19        jetty.default
    
      20        jetty.logrotate
    
      21        jetty.service
    
      22        jetty.sysusers
    
      23        jetty.tmpfiles)
    
      24
    
      25sha256sums=('f269b7b98691a48647e54ca5bce9d1042c0eb5f12a0887879974f418f70baa23'
    
      26            'd3190c73096fdb9f3c2aeef00b568c75431b0fbc0c322a2b21b06e829ce1852f'
    
      27            'da0402440e0a3b66e55387700b2c178c294dc65cc4a7bd079c622343845adecb'
    
      28            'b27ef0342c3b22fbf1e3e7d104e23670b53eab9b648c1882cf295bd82ccadc66'
    
      29            '5664891275f3e489f85efd85b9740e36265f5ed3cf9512d245c500bdc31b568a'
    
      30            'a69fa966c33343cb42394d80796ebfb29f5325c7610d8214657cdd17c58cc8d3')
    
      31
    
      32
    
      33package() {
    
      34    cd "$srcdir/$_distname"
    
      35
    
      36    install -dm2755 "$pkgdir/etc/$pkgname"
    
      37    install -dm755 "$pkgdir/usr/bin"
    
      38    install -dm2755 "$pkgdir/var/log/$pkgname"
    
      39    install -dm2755 "$pkgdir/var/lib/$pkgname/webapps"
    
      40
    
      41    install -Dm755 bin/jetty.sh "$pkgdir/usr/share/$pkgname/bin/jetty.sh"
    
      42    cp -r etc/* "$pkgdir/etc/$pkgname"
    
      43    find "$pkgdir/etc/$pkgname" -type f -exec chmod 640 {} + -o -type d -exec chmod 2755 {} +
    
      44
    
      45    cp -r {lib,modules,start.jar,README.adoc} "$pkgdir/usr/share/$pkgname/"
    
      46    install -dm2755 "$pkgdir/etc/$pkgname/start.d"
    
      47    install -dm2755 "$pkgdir/etc/$pkgname/resources"
    
      48    install -dm2755 "$pkgdir/var/lib/$pkgname/webapps"
    
      49
    
      50    ln -s /etc/$pkgname "$pkgdir/usr/share/$pkgname/etc"
    
      51    ln -s etc/start.d "$pkgdir/usr/share/$pkgname/start.d"
    
      52    ln -s etc/resources "$pkgdir/usr/share/$pkgname/resources"
    
      53    ln -s /usr/share/$pkgname/bin/jetty.sh "$pkgdir/usr/bin/$pkgname"
    
      54    ln -s /var/lib/$pkgname/webapps "$pkgdir/usr/share/$pkgname/webapps"
    
      55    ln -s /var/log/$pkgname "$pkgdir/usr/share/$pkgname/logs"
    
      56
    
      57    install -Dm644 "$srcdir/jetty.default" "$pkgdir/etc/default/$pkgname"
    
      58    install -Dm644 "$srcdir/jetty.logrotate" "$pkgdir/etc/logrotate.d/$pkgname"
    
      59    install -Dm644 "$srcdir/jetty.service" "$pkgdir/usr/lib/systemd/system/$pkgname.service"
    
      60    install -Dm644 "$srcdir/jetty.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      61    install -Dm644 "$srcdir/jetty.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
    
      62
    
      63    sed -i 's|su - |su -s /bin/sh - |' "$pkgdir/usr/share/$pkgname/bin/jetty.sh"
    
      64}
    
      65
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	3
2026-10-31 00:07:41	Low	3
2026-10-30 00:29:30	Low	3
2026-10-29 00:13:55	Low	3
2026-10-28 00:06:54	Low	3
2026-10-27 00:23:28	Low	3
2026-10-26 00:12:40	Low	3
2026-10-25 00:20:48	Low	3
2026-10-24 00:14:55	Low	3
2026-10-23 00:02:19	Low	3
2026-10-22 00:13:10	Low	3
2026-10-21 00:12:50	Low	3
2026-10-20 00:10:31	Low	3
2026-10-19 00:03:55	Low	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 00:23:45	Low	3