jetty

maintainer Dominiquini · 49 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a legitimate Maven repository (trusted for Java projects), and the privileged install refers to standard systemd/sysusers setup, not malicious self-updates or setuid abuse.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a legitimate Maven repository (trusted for Java projects), and the privileged install refers to standard systemd/sysusers setup, not malicious self-updates or setuid abuse.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=(https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-home/$pkgver/$_distname.tar.gz

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:43 find "$pkgdir/etc/$pkgname" -type f -exec chmod 640 {} + -o -type d -exec chmod 2755 {} +

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dor com>
    
      2# Contributor: Holger Schramm <dev@strace.it>
    
      3# Contributor: Massimiliano Torromeo <massimiliano.torromeo@gmail.com>
    
      4# Contributor: Yegorius <yegorius@domic.us>
    
      5# Contributor: Sergey Shatunov <me@prok.pw>
    
      6
    
      7pkgname=jetty
    
      8pkgver=12.1.11
    
      9pkgrel=1
    
      10pkgdesc="A pure Java-based HTTP server and Java Servlet container"
    
      11arch=('any')
    
      12url="http://www.eclipse.org/jetty/"
    
      13license=('Apache-2.0' 'EPL-2.0')
    
      14depends=('java-environment')
    
      15options=('!strip')
    
      16_distname="$pkgname-home-$pkgver"
    
      17
    
      18source=(https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-home/$pkgver/$_distname.tar.gz
    
      19        jetty.default
    
      20        jetty.logrotate
    
      21        jetty.service
    
      22        jetty.sysusers
    
      23        jetty.tmpfiles)
    
      24
    
      25sha256sums=('7e45cf8f23bac4567faf94624b3ac43e0aeb4925cb925409e76040990a1cbe9c'
    
      26            'd3190c73096fdb9f3c2aeef00b568c75431b0fbc0c322a2b21b06e829ce1852f'
    
      27            'da0402440e0a3b66e55387700b2c178c294dc65cc4a7bd079c622343845adecb'
    
      28            'b27ef0342c3b22fbf1e3e7d104e23670b53eab9b648c1882cf295bd82ccadc66'
    
      29            '5664891275f3e489f85efd85b9740e36265f5ed3cf9512d245c500bdc31b568a'
    
      30            'a69fa966c33343cb42394d80796ebfb29f5325c7610d8214657cdd17c58cc8d3')
    
      31
    
      32
    
      33package() {
    
      34    cd "$srcdir/$_distname"
    
      35
    
      36    install -dm2755 "$pkgdir/etc/$pkgname"
    
      37    install -dm755 "$pkgdir/usr/bin"
    
      38    install -dm2755 "$pkgdir/var/log/$pkgname"
    
      39    install -dm2755 "$pkgdir/var/lib/$pkgname/webapps"
    
      40
    
      41    install -Dm755 bin/jetty.sh "$pkgdir/usr/share/$pkgname/bin/jetty.sh"
    
      42    cp -r etc/* "$pkgdir/etc/$pkgname"
    
      43    find "$pkgdir/etc/$pkgname" -type f -exec chmod 640 {} + -o -type d -exec chmod 2755 {} +
    
      44
    
      45    cp -r {lib,modules,start.jar,README.adoc} "$pkgdir/usr/share/$pkgname/"
    
      46    install -dm2755 "$pkgdir/etc/$pkgname/start.d"
    
      47    install -dm2755 "$pkgdir/etc/$pkgname/resources"
    
      48    install -dm2755 "$pkgdir/var/lib/$pkgname/webapps"
    
      49
    
      50    ln -s /etc/$pkgname "$pkgdir/usr/share/$pkgname/etc"
    
      51    ln -s etc/start.d "$pkgdir/usr/share/$pkgname/start.d"
    
      52    ln -s etc/resources "$pkgdir/usr/share/$pkgname/resources"
    
      53    ln -s /usr/share/$pkgname/bin/jetty.sh "$pkgdir/usr/bin/$pkgname"
    
      54    ln -s /var/lib/$pkgname/webapps "$pkgdir/usr/share/$pkgname/webapps"
    
      55    ln -s /var/log/$pkgname "$pkgdir/usr/share/$pkgname/logs"
    
      56
    
      57    install -Dm644 "$srcdir/jetty.default" "$pkgdir/etc/default/$pkgname"
    
      58    install -Dm644 "$srcdir/jetty.logrotate" "$pkgdir/etc/logrotate.d/$pkgname"
    
      59    install -Dm644 "$srcdir/jetty.service" "$pkgdir/usr/lib/systemd/system/$pkgname.service"
    
      60    install -Dm644 "$srcdir/jetty.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      61    install -Dm644 "$srcdir/jetty.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
    
      62
    
      63    sed -i 's|su - |su -s /bin/sh - |' "$pkgdir/usr/share/$pkgname/bin/jetty.sh"
    
      64}
    
      65
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3