jre21-zulu-bin

LOW

maintainer puddings233 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt JRE binaries from Azul's official CDN (cdn.azul.com), which is the legitimate source for Zulu builds; despite the non-whitelisted host, this is a standard and expected source for this software, and the downloads are verified with matching sha256 checksums.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt JRE binaries from Azul's official CDN (cdn.azul.com), which is the legitimate source for Zulu builds; despite the non-whitelisted host, this is a standard and expected source for this software, and the downloads are verified with matching sha256 checksums.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:44 "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_aarch64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: puddings233 <puddings233 at outlook dot com>
    
      2
    
      3_majorver=21
    
      4_minorver=0
    
      5_securityver=12.1
    
      6_updatever=1
    
      7_zulu_build="52.203"
    
      8pkgname=jre${_majorver}-zulu-bin
    
      9pkgver=${_majorver}.${_minorver}.${_securityver}+${_updatever}
    
      10pkgrel=2
    
      11pkgdesc='Azul Zulu OpenJDK full runtime environment, bin version.'
    
      12arch=('aarch64' 'x86_64')
    
      13url='https://www.azul.com/downloads/'
    
      14license=('custom')
    
      15depends=(
    
      16  "java-runtime-common>=3"
    
      17  "ca-certificates-utils"
    
      18  "freetype2"
    
      19  "glibc"
    
      20  "harfbuzz"
    
      21  "lcms2"
    
      22  "libgcc"
    
      23  "libjpeg-turbo"
    
      24  "libnet"
    
      25  "libstdc++"
    
      26  "nss"
    
      27  "giflib"
    
      28  "libpng"
    
      29)
    
      30optdepends=(
    
      31  'alsa-lib: for basic sound support'
    
      32  'gtk3: for the Gtk+ 3 look and feel - desktop usage'
    
      33)
    
      34provides=(
    
      35  "java-runtime=${_majorver}"
    
      36  "java-runtime-openjdk=${_majorver}"
    
      37  "jre${_majorver}-openjdk=${pkgver}-${pkgrel}"
    
      38  "java-runtime-headless=${_majorver}"
    
      39  "java-runtime-headless-openjdk=${_majorver}"
    
      40  "jre${_majorver}-openjdk-headless=${pkgver}-${pkgrel}"
    
      41)
    
      42install="$pkgname.install"
    
      43source_aarch64=(
    
      44  "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_aarch64.tar.gz"
    
      45  "freedesktop-java.desktop"
    
      46)
    
      47source_x86_64=(
    
      48  "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_x64.tar.gz"
    
      49  "freedesktop-java.desktop"
    
      50)
    
      51sha256sums_aarch64=(
    
      52  '519c4639c49b36cd3e37594e35ee4d54d207aef4325439baf6b3d70d4cd92b76'
    
      53  '64e1442e837d09e950059c56e0908107488edfbf7cf9c0b71fa8442ea3451270'
    
      54)
    
      55sha256sums_x86_64=(
    
      56  '170f31af477726931543e91a5c44dfef4b7117382800dfd962aaea9fbbca4e50'
    
      57  '64e1442e837d09e950059c56e0908107488edfbf7cf9c0b71fa8442ea3451270'
    
      58)
    
      59
    
      60_jvmdir=/usr/lib/jvm/java-${_majorver}-zulu
    
      61
    
      62case "${CARCH}" in
    
      63  aarch64) _JARCH='aarch64';;
    
      64  x86_64) _JARCH='x64';;
    
      65esac
    
      66
    
      67package() {
    
      68
    
      69  cd "$srcdir/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_${_JARCH}"
    
      70
    
      71  install -dm 755 "${pkgdir}${_jvmdir}"
    
      72
    
      73  cp -a bin lib \
    
      74    "${pkgdir}${_jvmdir}"
    
      75
    
      76  # Conf
    
      77  install -dm 755 "${pkgdir}/etc"
    
      78  cp -r conf "${pkgdir}/etc/java${_majorver}-zulu"
    
      79  ln -s "/etc/java${_majorver}-zulu" "${pkgdir}/${_jvmdir}/conf"
    
      80
    
      81  # Legal
    
      82  install -dm 755 "${pkgdir}/usr/share/licenses"
    
      83  cp -r legal "${pkgdir}/usr/share/licenses/java${_majorver}-zulu"
    
      84  cp DISCLAIMER "${pkgdir}/usr/share/licenses/java${_majorver}-zulu/"
    
      85  ln -s "/usr/share/licenses/java${_majorver}-zulu" "${pkgdir}/${_jvmdir}/legal"
    
      86
    
      87  # Link JKS keystore from ca-certificates-utils
    
      88  rm -f "${pkgdir}${_jvmdir}/lib/security/cacerts"
    
      89  ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/lib/security/cacerts"
    
      90
    
      91  # Desktop files
    
      92  install -Dm 644 \
    
      93    "${srcdir}/freedesktop-java.desktop" \
    
      94    "${pkgdir}/usr/share/applications/java-java${_majorver}-zulu.desktop"
    
      95}
    
      96
    
      97# vim: ts=2 sw=2 et:
    
      98

Changes since previous scan

--- PKGBUILD @ 2026-09-02 00:02
+++ PKGBUILD @ 2026-09-17 00:27
@@ -2,12 +2,12 @@
 
 _majorver=21
 _minorver=0
-_securityver=12
-_updatever=8
-_zulu_build="52.15"
+_securityver=12.1
+_updatever=1
+_zulu_build="52.203"
 pkgname=jre${_majorver}-zulu-bin
-pkgver=${_majorver}.${_minorver}.${_securityver}.u${_updatever}
-pkgrel=1
+pkgver=${_majorver}.${_minorver}.${_securityver}+${_updatever}
+pkgrel=2
 pkgdesc='Azul Zulu OpenJDK full runtime environment, bin version.'
 arch=('aarch64' 'x86_64')
 url='https://www.azul.com/downloads/'
@@ -49,11 +49,11 @@
   "freedesktop-java.desktop"
 )
 sha256sums_aarch64=(
-  '8301c06f6e020d09fd30068160adc12d33728c11c03d9ace3a1087be8e84f6e2'
+  '519c4639c49b36cd3e37594e35ee4d54d207aef4325439baf6b3d70d4cd92b76'
   '64e1442e837d09e950059c56e0908107488edfbf7cf9c0b71fa8442ea3451270'
 )
 sha256sums_x86_64=(
-  '8e0374ffe9ff662c2f6b1872d6b48ab3859f69de11afe583af363264d24b299f'
+  '170f31af477726931543e91a5c44dfef4b7117382800dfd962aaea9fbbca4e50'
   '64e1442e837d09e950059c56e0908107488edfbf7cf9c0b71fa8442ea3451270'
 )
 
@@ -87,6 +87,11 @@
   # Link JKS keystore from ca-certificates-utils
   rm -f "${pkgdir}${_jvmdir}/lib/security/cacerts"
   ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/lib/security/cacerts"
+
+  # Desktop files
+  install -Dm 644 \
+    "${srcdir}/freedesktop-java.desktop" \
+    "${pkgdir}/usr/share/applications/java-java${_majorver}-zulu.desktop"
 }
 
 # vim: ts=2 sw=2 et:

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 13:50:58	Medium	1
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2