jre21-zulu-bin
LOW
maintainer puddings233
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads prebuilt JRE binaries from Azul's official CDN (cdn.azul.com), which is the legitimate source for Zulu builds; despite the static analyzer flag for a non-standard host, this is a normal and expected source for this software, and the downloads are verified via fixed SHA256 checksums.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt JRE binaries from Azul's official CDN (cdn.azul.com), which is the legitimate source for Zulu builds; despite the static analyzer flag for a non-standard host, this is a normal and expected source for this software, and the downloads are verified via fixed SHA256 checksums.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:44
"https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_aarch64.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: puddings233 <puddings233 at outlook dot com>
2
3
_majorver=21
4
_minorver=0
5
_securityver=13
6
_updatever=9
7
_zulu_build="54.107"
8
pkgname=jre${_majorver}-zulu-bin
9
pkgver=${_majorver}.${_minorver}.${_securityver}+${_updatever}
10
pkgrel=1
11
pkgdesc='Azul Zulu OpenJDK full runtime environment, bin version.'
12
arch=('aarch64' 'x86_64')
13
url='https://www.azul.com/downloads/'
14
license=('custom')
15
depends=(
16
"java-runtime-common>=3"
17
"ca-certificates-utils"
18
"freetype2"
19
"glibc"
20
"harfbuzz"
21
"lcms2"
22
"libgcc"
23
"libjpeg-turbo"
24
"libnet"
25
"libstdc++"
26
"nss"
27
"giflib"
28
"libpng"
29
)
30
optdepends=(
31
'alsa-lib: for basic sound support'
32
'gtk3: for the Gtk+ 3 look and feel - desktop usage'
33
)
34
provides=(
35
"java-runtime=${_majorver}"
36
"java-runtime-openjdk=${_majorver}"
37
"jre${_majorver}-openjdk=${pkgver}-${pkgrel}"
38
"java-runtime-headless=${_majorver}"
39
"java-runtime-headless-openjdk=${_majorver}"
40
"jre${_majorver}-openjdk-headless=${pkgver}-${pkgrel}"
41
)
42
install="$pkgname.install"
43
source_aarch64=(
44
"https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_aarch64.tar.gz"
45
"freedesktop-java.desktop"
46
)
47
source_x86_64=(
48
"https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_x64.tar.gz"
49
"freedesktop-java.desktop"
50
)
51
sha256sums_aarch64=(
52
'3f4649159c0780bfb4c66b73f17f784830e1cbc0b79698a2b235bd7fe18dea25'
53
'64e1442e837d09e950059c56e0908107488edfbf7cf9c0b71fa8442ea3451270'
54
)
55
sha256sums_x86_64=(
56
'cb1021b29c2909faefa57589e9506dcb9c18d88d2659e5e22f4ac1bb20e36e50'
57
'64e1442e837d09e950059c56e0908107488edfbf7cf9c0b71fa8442ea3451270'
58
)
59
60
_jvmdir=/usr/lib/jvm/java-${_majorver}-zulu
61
62
case "${CARCH}" in
63
aarch64) _JARCH='aarch64';;
64
x86_64) _JARCH='x64';;
65
esac
66
67
package() {
68
69
cd "$srcdir/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_${_JARCH}"
70
71
install -dm 755 "${pkgdir}${_jvmdir}"
72
73
cp -a bin lib \
74
"${pkgdir}${_jvmdir}"
75
76
# Conf
77
install -dm 755 "${pkgdir}/etc"
78
cp -r conf "${pkgdir}/etc/java${_majorver}-zulu"
79
ln -s "/etc/java${_majorver}-zulu" "${pkgdir}/${_jvmdir}/conf"
80
81
# Legal
82
install -dm 755 "${pkgdir}/usr/share/licenses"
83
cp -r legal "${pkgdir}/usr/share/licenses/java${_majorver}-zulu"
84
cp DISCLAIMER "${pkgdir}/usr/share/licenses/java${_majorver}-zulu/"
85
ln -s "/usr/share/licenses/java${_majorver}-zulu" "${pkgdir}/${_jvmdir}/legal"
86
87
# Link JKS keystore from ca-certificates-utils
88
rm -f "${pkgdir}${_jvmdir}/lib/security/cacerts"
89
ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/lib/security/cacerts"
90
91
# Desktop files
92
install -Dm 644 \
93
"${srcdir}/freedesktop-java.desktop" \
94
"${pkgdir}/usr/share/applications/java-java${_majorver}-zulu.desktop"
95
}
96
97
# vim: ts=2 sw=2 et:
98
Changes since previous scan
--- PKGBUILD @ 2026-10-25 00:20+++ PKGBUILD @ 2026-11-01 00:21@@ -2,12 +2,12 @@ _majorver=21 _minorver=0-_securityver=12.1-_updatever=1-_zulu_build="52.203"+_securityver=13+_updatever=9+_zulu_build="54.107" pkgname=jre${_majorver}-zulu-bin pkgver=${_majorver}.${_minorver}.${_securityver}+${_updatever}-pkgrel=2+pkgrel=1 pkgdesc='Azul Zulu OpenJDK full runtime environment, bin version.' arch=('aarch64' 'x86_64') url='https://www.azul.com/downloads/'@@ -49,11 +49,11 @@ "freedesktop-java.desktop" ) sha256sums_aarch64=(- '519c4639c49b36cd3e37594e35ee4d54d207aef4325439baf6b3d70d4cd92b76'+ '3f4649159c0780bfb4c66b73f17f784830e1cbc0b79698a2b235bd7fe18dea25' '64e1442e837d09e950059c56e0908107488edfbf7cf9c0b71fa8442ea3451270' ) sha256sums_x86_64=(- '170f31af477726931543e91a5c44dfef4b7117382800dfd962aaea9fbbca4e50'+ 'cb1021b29c2909faefa57589e9506dcb9c18d88d2659e5e22f4ac1bb20e36e50' '64e1442e837d09e950059c56e0908107488edfbf7cf9c0b71fa8442ea3451270' ) Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 07:42:02 | Medium | 1 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |