jre7

maintainer severach · 42 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads Oracle JRE and JCE policy files from Oracle's official domain (download.oracle.com), which is a legitimate source despite not being on the analyzer's whitelist; the build process installs only the official Oracle binaries and configuration files, with no evidence of malicious payloads or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads Oracle JRE and JCE policy files from Oracle's official domain (download.oracle.com), which is a legitimate source despite not being on the analyzer's whitelist; the build process installs only the official Oracle binaries and configuration files, with no evidence of malicious payloads or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:59 "https://download.oracle.com/otn/java/jdk/${pkgver}-${_build}/${_srcfil}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Chris Severance aur.severach AatT spamgourmet.com
    
      2# Contributor: Det <nimetonmaili g-mail>
    
      3# Contributor: josephgbr
    
      4
    
      5set -u
    
      6_pkgname='jre'
    
      7_major='7'
    
      8pkgname="${_pkgname}${_major}"
    
      9_minor='80'; _build='b15'
    
      10pkgver="${_major}u${_minor}"
    
      11pkgrel='1'
    
      12pkgdesc="Oracle Java ${_major} Runtime Environment (public release - end of support)"
    
      13arch=('x86_64')
    
      14#url='https://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html'
    
      15url='https://www.oracle.com/technetwork/java/archive-139210.html'
    
      16license=('custom:Oracle')
    
      17depends=('ca-certificates-java' 'hicolor-icon-theme' 'java-runtime-common' 'nss' 'xdg-utils')
    
      18optdepends=(
    
      19  'alsa-lib: for basic sound support'
    
      20  'gtk2: for Gtk+ look and feel (desktop)'
    
      21)
    
      22makedepends=('awk')
    
      23provides=(
    
      24  "java-runtime=${_major}"
    
      25  "java-runtime-headless=${_major}"
    
      26  "java-web-start=${_major}"
    
      27  "java-runtime-jre=${_major}"
    
      28  "java-runtime-headless-jre=${_major}"
    
      29  "java-web-start-jre=${_major}"
    
      30  "java-openjfx=${_major}"
    
      31)
    
      32
    
      33# Variables
    
      34
    
      35_jname="${_pkgname}${_major}"
    
      36_jvmdir="/usr/lib/jvm/java-${_major}-${_pkgname}/${_pkgname}"
    
      37
    
      38backup=(
    
      39  "etc/java-${_jname}/amd64/jvm.cfg"
    
      40  "etc/java-${_jname}/images/cursors/cursors.properties"
    
      41  "etc/java-${_jname}/management/jmxremote.access"
    
      42  "etc/java-${_jname}/management/management.properties"
    
      43  "etc/java-${_jname}/security/java.policy"
    
      44  "etc/java-${_jname}/security/java.security"
    
      45  "etc/java-${_jname}/security/javaws.policy"
    
      46  "etc/java-${_jname}/content-types.properties"
    
      47  "etc/java-${_jname}/flavormap.properties"
    
      48  "etc/java-${_jname}/fontconfig.properties.src"
    
      49  "etc/java-${_jname}/logging.properties"
    
      50  "etc/java-${_jname}/net.properties"
    
      51  "etc/java-${_jname}/psfont.properties.ja"
    
      52  "etc/java-${_jname}/psfontj2d.properties"
    
      53  "etc/java-${_jname}/sound.properties"
    
      54)
    
      55options=('!strip') # JDK debug-symbols
    
      56install="${pkgname}.install"
    
      57_srcfil="${_pkgname}-${pkgver}-linux-x64.tar.gz"
    
      58source=(
    
      59  "https://download.oracle.com/otn/java/jdk/${pkgver}-${_build}/${_srcfil}" # Now /otn/, Oracle sso required
    
      60  "policytool-${_jname}.desktop"
    
      61  'readme.sh'
    
      62)
    
      63# from oracle-sqldeveloper
    
      64DLAGENTS+=("manual::${startdir:-}/readme.sh %o %u")
    
      65source[0]="manual://${_srcfil}"
    
      66if [ ! -z "${HOME:-}" ]; then # block mksrcinfo
    
      67  XDG_DOWNLOAD_DIR=~/'Downloads'; source <(grep -Ee '^XDG_DOWNLOAD_DIR="[^"]+"$' ~/'.config/user-dirs.dirs' 2> /dev/null || :)
    
      68  if [ -s "${XDG_DOWNLOAD_DIR}/${_srcfil}" ] && [ ! -e "${_srcfil}" ]; then
    
      69    if type msg > /dev/null 2>&1; then
    
      70      set +u
    
      71      msg "Scooping files from ${XDG_DOWNLOAD_DIR}"
    
      72      msg2 "${_srcfil}"
    
      73      set -u
    
      74      ln -sr "${XDG_DOWNLOAD_DIR}/${_srcfil}"
    
      75    fi
    
      76  fi
    
      77fi
    
      78unset _srcfil
    
      79unset XDG_DOWNLOAD_DIR
    
      80
    
      81md5sums=('c0e01ae8683b2d8924ce79cd6ce6a691'
    
      82         'db24e699517801b35343cc7ebc93ce88'
    
      83         '51c8839211cc53f09c9b11a8e28ed1ef'
    
      84         '5504e2d9029ee2c41730a228758c50e1')
    
      85sha256sums=('4c01efd0d8e80bb6e2f324ec3408ce64f066d4506c7ec93a491f615a4523f4f3'
    
      86            '54cc70523556dc4858dd8ba258d78244a0aff01b0867254dd225eba68303a83f'
    
      87            'f1081b08cfbb467277e95b3794191c9963398579733fa8832425b308b5917711'
    
      88            '6774aa9adc740b417868de4f36967275ad15e153645d8ee875fee318caabd6f7')
    
      89
    
      90PKGEXT='.pkg.tar.gz' # much faster than .xz
    
      91## Alternative mirror, if your local one is throttled:
    
      92## Posting new sites does no good. They get taken down by the admin
    
      93## from too much traffic or complaints from Oracle.
    
      94#source[1]=???
    
      95
    
      96DLAGENTS=("${DLAGENTS[@]// -gqb \"\"/ -gq}")
    
      97DLAGENTS=("${DLAGENTS[@]//curl -/curl -b 'oraclelicense=a' -}")
    
      98
    
      99# https://bugs.openjdk.java.net/browse/JDK-8170157
    
      100# 2020-06-25 UnlimitedJCEPolicyJDK7.zip/UnlimitedJCEPolicy/README.txt
    
      101if [ "${_minor}" -lt 171 ]; then
    
      102  source+=("https://download.oracle.com/otn-pub/java/jce/${_major}/UnlimitedJCEPolicyJDK${_major}.zip")
    
      103  _opt_JCE=1
    
      104else
    
      105  _opt_JCE=0
    
      106fi
    
      107
    
      108package() {
    
      109  set -u
    
      110  cd "${_pkgname}1.${_major}.0_${_minor}"
    
      111
    
      112  set +u; msg2 'Creating directory structure...'; set -u
    
      113  install -d "${pkgdir}/etc/.java/.systemPrefs"
    
      114  install -d "${pkgdir}/usr/lib/jvm/java-${_major}-${_pkgname}/${_pkgname}/bin"
    
      115  install -d "${pkgdir}/usr/lib/mozilla/plugins"
    
      116  install -d "${pkgdir}/usr/share/licenses/java${_major}-${_pkgname}"
    
      117
    
      118  set +u; msg2 'Removing redundancies...'; set -u
    
      119  rm -r 'lib/desktop/icons/HighContrast/'
    
      120  rm -r 'lib/desktop/icons/HighContrastInverse/'
    
      121  rm -r 'lib/desktop/icons/LowContrast/'
    
      122  rm    lib/fontconfig.*.bfc
    
      123  rm    lib/fontconfig.*.properties.src
    
      124  rm -r 'plugin/'
    
      125  rm    'man/ja'
    
      126
    
      127  set +u; msg2 'Moving contents...'; set -u
    
      128  mv * "${pkgdir}/${_jvmdir}"
    
      129
    
      130  # Cd to the new playground
    
      131  cd "${pkgdir}/${_jvmdir}"
    
      132
    
      133  set +u; msg2 'Fixing directory structure...'; set -u
    
      134  # Suffix .desktops + icons (sun-java.png -> sun-java-${_jname}.png)
    
      135  local _i
    
      136  for _i in $(find 'lib/desktop/' -type 'f'); do
    
      137    rename -- '.' "-${_jname}." "${_i}"
    
      138  done
    
      139
    
      140  # Fix .desktop files
    
      141  sed -e '/JavaWS/! s|Name=Java|Name=Java '"${_major}"'|' \
    
      142      -e "s|Name=JavaWS|Name=JavaWS ${_major}|" \
    
      143      -e "s|Comment=Java|Comment=Java ${_major}|" \
    
      144      -e "s|Exec=|Exec=${_jvmdir}/bin/|" \
    
      145      -e "s|.png|-${_jname}.png|" \
    
      146    -i 'lib/desktop/applications'/*
    
      147
    
      148  # Move .desktops + icons to /usr/share
    
      149  mv 'lib/desktop'/* "${pkgdir}/usr/share/"
    
      150  install -m644 "${srcdir}"/*.desktop -t "${pkgdir}/usr/share/applications/"
    
      151
    
      152  # Move confs to /etc and link back to /usr: /usr/lib/jvm/java-${_jname}/lib -> /etc
    
      153  local _new_etc_path
    
      154  for _new_etc_path in "${backup[@]}"; do
    
      155    # Old location
    
      156    local _old_usr_path="lib/${_new_etc_path#*${_jname}/}"
    
      157
    
      158    # Move
    
      159    install -Dm644 "${_old_usr_path}" "${pkgdir}/${_new_etc_path}"
    
      160    ln -sf "/${_new_etc_path}" "${_old_usr_path}"
    
      161  done
    
      162
    
      163  # Link NPAPI plugin
    
      164  ln -s "${_jvmdir}/lib/amd64/libnpjp2.so" "${pkgdir}/usr/lib/mozilla/plugins/libnpjp2-${_jname}.so"
    
      165
    
      166  # Replace JKS keystore with 'ca-certificates-java'
    
      167  ln -sf '/etc/ssl/certs/java/cacerts' 'lib/security/cacerts'
    
      168
    
      169  # Suffix man pages
    
      170  for _i in $(find 'man/' -type 'f'); do
    
      171    mv "${_i}" "${_i/.1}-${_jname}.1"
    
      172  done
    
      173
    
      174  # Move man pages
    
      175  mv 'man/ja_JP.UTF-8/' 'man/ja'
    
      176  mv 'man/' "${pkgdir}/usr/share"
    
      177
    
      178  # Move/link licenses
    
      179  mv 'COPYRIGHT' 'LICENSE' 'README' *.txt "${pkgdir}/usr/share/licenses/java${_major}-${_pkgname}/"
    
      180  ln -s "/usr/share/licenses/java${_major}-${_pkgname}/" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      181
    
      182if [ "${_opt_JCE}" -ne 0 ]; then
    
      183  set +u; msg2 'Installing Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files...'; set -u
    
      184  # Replace default "strong", but limited, cryptography to get an "unlimited strength" one for
    
      185  # things like 256-bit AES. Enabled by default in OpenJDK:
    
      186  # - http://suhothayan.blogspot.com/2012/05/how-to-install-java-cryptography.html
    
      187  # - http://www.eyrie.org/~eagle/notes/debian/jce-policy.html
    
      188  install -m644 "${srcdir}/UnlimitedJCEPolicy"/*.jar 'lib/security/'
    
      189  install -Dm644 "${srcdir}/UnlimitedJCEPolicy/README.txt" \
    
      190                 "${pkgdir}/usr/share/doc/${pkgname}/README_-_Java_JCE_Unlimited_Strength.txt"
    
      191fi
    
      192
    
      193  set +u; msg2 'Enabling copy+paste in unsigned applets...'; set -u
    
      194  # Copy/paste from system clipboard to unsigned Java applets has been disabled since 6u24:
    
      195  # - https://blogs.oracle.com/kyle/entry/copy_and_paste_in_java
    
      196  # - http://slightlyrandombrokenthoughts.blogspot.com/2011/03/oracle-java-applet-clipboard-injection.html
    
      197  local _text='\
    
      198         // (AUR) Allow unsigned applets to read system clipboard, see:
    
      199         // - https://blogs.oracle.com/kyle/entry/copy_and_paste_in_java
    
      200         // - http://slightlyrandombrokenthoughts.blogspot.com/2011/03/oracle-java-applet-clipboard-injection.html
    
      201         permission java.awt.AWTPermission "accessClipboard";'
    
      202  local _lf=$'\n'
    
      203  _text="${_text//${_lf}/\\n}"
    
      204  local _line
    
      205  _line="$(awk '/permission/{a=NR}; END{print a}' "${pkgdir}/etc/java-${_jname}/security/java.policy")"
    
      206  sed -e "${_line} a ${_text}" -i "${pkgdir}/etc/java-${_jname}/security/java.policy"
    
      207  set +u
    
      208}
    
      209set +u
    
      210

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2