jre10
maintainer Muflone
· 4 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The PKGBUILD downloads a prebuilt Oracle JRE binary (a large, executed native binary tarball) from url.muflone.com, which is a personal/maintainer-controlled redirect/mirror rather than Oracle's official download servers. Oracle JRE binaries require accepting a license agreement and are not freely redistributable, so the maintainer is hosting a copy on their own infrastructure. While a SHA256 checksum is provided, this only verifies integrity against a value the same maintainer controls — it does not establish authenticity against Oracle's official release. If the host or the redirect is compromised, a malicious JRE could be delivered and executed on users' systems. This is a genuine supply-chain concern: an executed binary from a non-official, maintainer-controlled host. The risk is real but not evidence of active malice, placing this squarely in the medium category.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:28
source=("http://url.muflone.com/jre-${pkgver}_linux-x64_bin.tar.gz")
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt Oracle JRE binary (a large, executed native binary tarball) from url.muflone.com, which is a personal/maintainer-controlled redirect/mirror rather than Oracle's official download servers. Oracle JRE binaries require accepting a license agreement and are not freely redistributable, so the maintainer is hosting a copy on their own infrastructure. While a SHA256 checksum is provided, this only verifies integrity against a value the same maintainer controls — it does not establish authenticity against Oracle's official release. If the host or the redirect is compromised, a malicious JRE could be delivered and executed on users' systems. This is a genuine supply-chain concern: an executed binary from a non-official, maintainer-controlled host. The risk is real but not evidence of active malice, placing this squarely in the medium category.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Muflone http://www.muflone.com/contacts/english/
2
# Contributor: Det <nimetonmaili g-mail>
3
4
pkgname=jre10
5
pkgver=10.0.2
6
_major=${pkgver/.*}
7
pkgrel=1
8
pkgdesc="Oracle Java Runtime Environment (public release - end of support)"
9
arch=('x86_64')
10
url="http://www.oracle.com/technetwork/java/javase/downloads/index.html"
11
license=('custom:Oracle')
12
depends=('ca-certificates-java' 'hicolor-icon-theme' 'java-runtime-common' 'nss' 'xdg-utils')
13
optdepends=('alsa-lib: for basic sound support'
14
'gtk2: for Gtk+ look and feel (desktop)')
15
provides=("java-runtime=${_major}" "java-runtime-headless=${_major}" "java-web-start=${_major}"
16
"java-runtime-jre=${_major}" "java-runtime-headless-jre=${_major}" "java-web-start-jre=${_major}"
17
"java-openjfx=${_major}" "jre")
18
conflicts=("java-runtime-jre=${_major}")
19
backup=("etc/java-${pkgname}/management/jmxremote.access"
20
"etc/java-${pkgname}/management/management.properties"
21
"etc/java-${pkgname}/security/java.policy"
22
"etc/java-${pkgname}/security/java.security"
23
"etc/java-${pkgname}/security/javaws.policy"
24
"etc/java-${pkgname}/logging.properties"
25
"etc/java-${pkgname}/net.properties"
26
"etc/java-${pkgname}/sound.properties")
27
install=${pkgname}.install
28
source=("http://url.muflone.com/jre-${pkgver}_linux-x64_bin.tar.gz")
29
sha256sums=('7d2909a597574f1821903790bb0f31aaa57ab7348e3ae53639c850371450845d')
30
_jvmdir="/usr/lib/jvm/java-${_major}-jre/jre"
31
32
package() {
33
cd "jre-${pkgver}"
34
35
echo "Creating directory structure..."
36
install -d "${pkgdir}/etc/.java/.systemPrefs"
37
install -d "${pkgdir}/usr/lib/jvm/java-${_major}-jre/jre/bin"
38
install -d "${pkgdir}/usr/lib/mozilla/plugins"
39
install -d "${pkgdir}/usr/share/licenses/java${_major}-jre"
40
41
echo "Removing redundancies..."
42
rm -r "lib/desktop/icons/HighContrast"
43
rm -r "lib/desktop/icons/HighContrastInverse"
44
rm -r "lib/desktop/icons/LowContrast"
45
rm lib/fontconfig.*.bfc
46
rm lib/fontconfig.*.properties.src
47
48
echo "Moving contents..."
49
mv * "${pkgdir}/${_jvmdir}"
50
51
# Cd to the new playground
52
cd "${pkgdir}/${_jvmdir}"
53
54
echo "Fixing directory structure..."
55
# Fix bundled .desktops
56
sed -e "s|Exec=|Exec=${_jvmdir}/bin/|" \
57
-e "s|.png|-${pkgname}.png|" \
58
-i lib/desktop/applications/*
59
60
# Move .desktops + icons to /usr/share
61
mv lib/desktop/* "${pkgdir}/usr/share/"
62
63
# Suffix .desktops + icon (sun-jcontrol.png -> sun-jcontrol-${pkgname}.png)
64
for i in $(find "${pkgdir}"/usr/share/ -type f)
65
do
66
rename -- "." "-${pkgname}." $i
67
done
68
69
# Link missing icons
70
for i in $(find "${pkgdir}/usr/share/icons/" -name "sun-jcontrol-${pkgname}.png" -type f)
71
do
72
ln -s "sun-jcontrol-${pkgname}.png" "${i/jcontrol/java}"
73
ln -s "sun-jcontrol-${pkgname}.png" "${i/jcontrol/javaws}"
74
done
75
76
# Move confs to /etc and link back to /usr: /usr/lib/jvm/java-${pkgname}/conf -> /etc
77
for sub_path in $(find conf/ -type f)
78
do
79
# New location
80
new_etc_path="/etc/java-${pkgname}/${sub_path/conf\/}"
81
82
# Move & link
83
install -Dm644 "${sub_path}" "${pkgdir}/${new_etc_path}"
84
ln -sf "${new_etc_path}" "${sub_path}"
85
done
86
87
# Link NPAPI plugin
88
ln -sf "${_jvmdir}/lib/libnpjp2.so" "${pkgdir}/usr/lib/mozilla/plugins/libnpjp2-${pkgname}.so"
89
90
# Replace JKS keystore with 'ca-certificates-java'
91
ln -sf "/etc/ssl/certs/java/cacerts" "lib/security/cacerts"
92
93
# Move & link licenses
94
mv legal/ "${pkgdir}/usr/share/licenses/java${_major}-jre/"
95
ln -sf "/usr/share/licenses/java${_major}-jre/" "${pkgdir}/usr/share/licenses/${pkgname}"
96
97
echo "Enabling copy+paste in unsigned applets..."
98
# Copy/paste from system clipboard to unsigned Java applets has been disabled since 6u24:
99
# - https://blogs.oracle.com/kyle/entry/copy_and_paste_in_java
100
# - http://slightlyrandombrokenthoughts.blogspot.com/2011/03/oracle-java-applet-clipboard-injection.html
101
_line=$(awk '/permission/{a=NR}; END{print a}' "${pkgdir}"/etc/java-${pkgname}/security/java.policy)
102
sed "${_line} a\\\\n \
103
// (AUR) Allow unsigned applets to read system clipboard, see:\n \
104
// - https://blogs.oracle.com/kyle/entry/copy_and_paste_in_java\n \
105
// - http://slightlyrandombrokenthoughts.blogspot.com/2011/03/oracle-java-applet-clipboard-injection.html\n \
106
permission java.awt.AWTPermission \"accessClipboard\";" \
107
-i "${pkgdir}/etc/java-${pkgname}/security/java.policy"
108
}
109
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |