jre8
MEDIUM
maintainer zen
44 votes
scanned 2026-10-18 07:21:11.915849
Why flagged
The package downloads a prebuilt Oracle JRE binary from a non-standard Oracle download URL that requires a cookie for access, which is an unverifiable source with potential supply-chain risk due to the inability to independently verify the integrity and origin of the binary.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:86
"${_pkgname}-${pkgver}-linux-x64.tar.gz::https://javadl.oracle.com/webapps/download/AutoDL?BundleId=${_bundleid}_${_hash}"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt Oracle JRE binary from a non-standard Oracle download URL that requires a cookie for access, which is an unverifiable source with potential supply-chain risk due to the inability to independently verify the integrity and origin of the binary.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Zen Wen <zen.8841@gmail.com>
2
# Contributor: Chris Severance aur.severach AatT spamgourmet.com
3
# Contributor: Det <nimetonmaili g-mail>
4
# Contributors: Charles Ghislain, Guillaume ALAUX, Daniel J Griffiths, Jason Chu, Geoffroy Carrier,
5
# Army, kfgz, Thomas Dziedzic, Dan Serban, jjacky, EasySly
6
7
set -u
8
_pkgname='jre'
9
_major='8'
10
pkgname="${_pkgname}${_major}"
11
#_minor='211'; _build='b12'; _bundleid='238719'; _hash='478a62b7d4e34b78b671c754eaaf38ab'
12
#_minor='212'; _build='b10'; _bundleid='??????'; _hash='59066701cf1a433da9770636fbc4c9aa'
13
#_minor='221'; _bundleid='239848'; _hash='230deb18db3e4014bb8e3e8324f81b43'
14
#_minor='231'; _bundleid='240718'; _hash='5b13a193868b4bf28bcb45c792fce896'
15
#_minor='241'; _bundleid='241526'; _hash='1f5b5a70bf22433b84d0e960903adac8'
16
#_minor='251'; _bundleid='242050'; _hash='3d5a2bb8f8d4428bbe94aed7ec7ae784'
17
#_minor='261'; _bundleid='242980'; _hash='a4634525489241b9a9e1aa73d9e118e6'
18
#_minor='271'; _bundleid='243727'; _hash='61ae65e088624f5aaa0b1d2d801acb16'
19
#_minor='281'; _bundleid='244058'; _hash='89d678f2be164786b292527658ca1605'
20
#_minor='291'; _bundleid='244575'; _hash='d7fc238d0cbf4b0dac67be84580cfb4b'
21
#_minor='301'; _bundleid='245050'; _hash='d3c52aa6bfa54d3ca74e617f18309292'
22
#_minor='311'; _bundleid='245469'; _hash='4d5417147a92418ea8b615e228bb6935'
23
#_minor='321'; _bundleid='245797'; _hash='df5ad55fdd604472a86a45a217032c7d'
24
#_minor='331'; _bundleid='246255'; _hash='165374ff4ea84ef0bbd821706e29b123'
25
#_minor='333'; _bundleid='246464'; _hash='2dee051a5d0647d5be72a7c0abff270e'
26
#_minor='341'; _bundleid='246799'; _hash='424b9da4b48848379167015dcc250d8d'
27
#_minor='351'; _bundleid='247127'; _hash='10e8cce67c7843478f41411b7003171c'
28
#_minor='361'; _bundleid='247938'; _hash='0ae14417abb444ebb02b9815e2103550'
29
#_minor='371'; _bundleid='248233'; _hash='ce59cff5c23f4e2eaf4e778a117d4c5b'
30
#_minor='381'; _bundleid='248763'; _hash='8c876547113c4e4aab3c868e9e0ec572'
31
#_minor='391'; _bundleid='249192'; _hash='b291ca3e0c8548b5a51d5a5f50063037'
32
#_minor='401'; _bundleid='249542'; _hash='4d245f941845490c91360409ecffb3b4'
33
#_minor='431'; _bundleid='251398'; _hash='0d8f12bc927a4e2c9f8568ca567db4ee'
34
#_minor='441'; _bundleid='251646'; _hash='7ed26d28139143f38c58992680c214a5'
35
#_minor='491'; _bundleid='253185'; _hash='f7fe8e644f724108bdb54139381e29a7'
36
_minor='503'; _bundleid='253598'; _hash='2fde65a2208f40a5b5f4c844b0dff092'
37
pkgver="${_major}u${_minor}"
38
pkgrel='1'
39
pkgdesc="Oracle Java ${_major} Runtime Environment"
40
pkgdesc+=' LTS'
41
arch=('x86_64')
42
#url='https://www.oracle.com/technetwork/java/javase/downloads/index.html'
43
url='https://www.java.com/en/download/manual.jsp'
44
license=('custom:Oracle')
45
depends=('ca-certificates-java' 'hicolor-icon-theme' 'java-runtime-common' 'nss' 'xdg-utils')
46
optdepends=(
47
'alsa-lib: for basic sound support'
48
'gtk2: for Gtk+ look and feel (desktop)'
49
)
50
makedepends=('awk')
51
provides=(
52
"java-runtime=${_major}"
53
"java-runtime-headless=${_major}"
54
"java-web-start=${_major}"
55
"java-runtime-jre=${_major}"
56
"java-runtime-headless-jre=${_major}"
57
"java-web-start-jre=${_major}"
58
"java-openjfx=${_major}"
59
)
60
61
# Variables
62
63
_jname="${_pkgname}${_major}"
64
_jvmdir="/usr/lib/jvm/java-${_major}-${_pkgname}/${_pkgname}"
65
66
backup=(
67
"etc/java-${_jname}/amd64/jvm.cfg"
68
"etc/java-${_jname}/images/cursors/cursors.properties"
69
"etc/java-${_jname}/management/jmxremote.access"
70
"etc/java-${_jname}/management/management.properties"
71
"etc/java-${_jname}/security/java.policy"
72
"etc/java-${_jname}/security/java.security"
73
"etc/java-${_jname}/security/javaws.policy"
74
"etc/java-${_jname}/content-types.properties"
75
"etc/java-${_jname}/flavormap.properties"
76
"etc/java-${_jname}/fontconfig.properties.src"
77
"etc/java-${_jname}/logging.properties"
78
"etc/java-${_jname}/net.properties"
79
"etc/java-${_jname}/psfont.properties.ja"
80
"etc/java-${_jname}/psfontj2d.properties"
81
"etc/java-${_jname}/sound.properties"
82
)
83
options=('!strip') # JDK debug-symbols
84
install="${pkgname}.install"
85
source=(
86
"${_pkgname}-${pkgver}-linux-x64.tar.gz::https://javadl.oracle.com/webapps/download/AutoDL?BundleId=${_bundleid}_${_hash}"
87
#"https://download.oracle.com/otn-pub/java/jdk/${pkgver}-${_build}/${_hash}/${_pkgname}-${pkgver}-linux-x64.tar.gz" # Now /otn/, Oracle sso required
88
"policytool-${_jname}.desktop"
89
)
90
md5sums=('ab85b0d885177155015a240c6228966b'
91
'ef3ff483db5d38ed106e0b819006bdae')
92
sha256sums=('fadfd37a548434abd88e32d0ed2e1c4842d85ee31198c30b2f9752a9e06825ac'
93
'614b2a74b53728b7914c1407126a7ecfed781a79fb11e9963528c7cad39dbca8')
94
95
#PKGEXT='.pkg.tar.zst' # gz is much faster than .xz, zst is much faster than gz
96
## Alternative mirror, if your local one is throttled:
97
#source[0]=???
98
99
DLAGENTS=("${DLAGENTS[@]// -gqb \"\"/ -gq}")
100
DLAGENTS=("${DLAGENTS[@]//curl -/curl -b 'oraclelicense=a' -}")
101
102
# https://bugs.openjdk.java.net/browse/JDK-8170157
103
# 2020-06-19 jce_policy-8.zip/UnlimitedJCEPolicyJDK8/README.txt
104
if [ "${_minor}" -lt 161 ]; then
105
source+=("https://download.oracle.com/otn-pub/java/jce/${_major}/jce_policy-${_major}.zip")
106
_opt_JCE=1
107
else
108
_opt_JCE=0
109
fi
110
111
if ! :; then
112
for _d in "${!DLAGENTS[@]}"; do
113
case "${DLAGENTS[${_d}]}" in
114
'https::'*) DLAGENTS["${_d}"]='https::/usr/bin/wget --no-cookies --header Cookie:oraclelicense=a --no-glob --no-config --continue --tries=3 --waitretry=3 -O %o %u';;
115
esac
116
done
117
makedepends+=('wget')
118
fi
119
120
prepare() {
121
set -u
122
cd "${_pkgname}1.${_major}.0_${_minor}"
123
chmod 644 lib/amd64/*.so
124
set +u
125
}
126
127
package() {
128
set -u
129
cd "${_pkgname}1.${_major}.0_${_minor}"
130
131
set +u; msg2 'Creating directory structure...'; set -u
132
install -d "${pkgdir}/etc/.java/.systemPrefs"
133
install -d "${pkgdir}/usr/lib/jvm/java-${_major}-${_pkgname}/${_pkgname}/bin"
134
install -d "${pkgdir}/usr/lib/mozilla/plugins"
135
install -d "${pkgdir}/usr/share/licenses/java${_major}-${_pkgname}"
136
137
set +u; msg2 'Removing redundancies...'; set -u
138
rm -r 'lib/desktop/icons/HighContrast/'
139
rm -r 'lib/desktop/icons/HighContrastInverse/'
140
rm -r 'lib/desktop/icons/LowContrast/'
141
rm lib/fontconfig.*.bfc
142
rm lib/fontconfig.*.properties.src
143
rm -r 'plugin/'
144
rm 'man/ja'
145
146
set +u; msg2 'Moving contents...'; set -u
147
mv * "${pkgdir}/${_jvmdir}"
148
149
# Cd to the new playground
150
cd "${pkgdir}/${_jvmdir}"
151
152
set +u; msg2 'Fixing directory structure...'; set -u
153
# Suffix .desktops + icons (sun-java.png -> sun-java-${_jname}.png)
154
local _i
155
for _i in $(find 'lib/desktop/' -type 'f'); do
156
rename -- '.' "-${_jname}." "${_i}"
157
done
158
159
# Fix .desktop paths
160
sed -e "s|Exec=|Exec=${_jvmdir}/bin/|" \
161
-e "s|.png|-${_jname}.png|" \
162
-i 'lib/desktop/applications'/*
163
164
# Move .desktops + icons to /usr/share
165
mv 'lib/desktop'/* "${pkgdir}/usr/share/"
166
install -m644 "${srcdir}"/*.desktop -t "${pkgdir}/usr/share/applications/"
167
168
# Move confs to /etc and link back to /usr: /usr/lib/jvm/java-${_jname}/lib -> /etc
169
local _new_etc_path
170
for _new_etc_path in "${backup[@]}"; do
171
# Old location
172
local _old_usr_path="lib/${_new_etc_path#*${_jname}/}"
173
174
# Move
175
install -Dm644 "${_old_usr_path}" "${pkgdir}/${_new_etc_path}"
176
ln -sf "/${_new_etc_path}" "${_old_usr_path}"
177
done
178
179
# Link NPAPI plugin
180
ln -s "${_jvmdir}/lib/amd64/libnpjp2.so" "${pkgdir}/usr/lib/mozilla/plugins/libnpjp2-${_jname}.so"
181
182
# Replace JKS keystore with 'ca-certificates-java'
183
ln -sf '/etc/ssl/certs/java/cacerts' 'lib/security/cacerts'
184
185
# Suffix man pages
186
for _i in $(find 'man/' -type 'f'); do
187
rename -- '.1' "-${_jname}.1" "${_i}"
188
done
189
190
# Move man pages
191
mv 'man/ja_JP.UTF-8/' 'man/ja'
192
mv 'man/' "${pkgdir}/usr/share"
193
194
# Move/link licenses
195
mv 'COPYRIGHT' 'LICENSE' 'README' *.txt "${pkgdir}/usr/share/licenses/java${_major}-${_pkgname}/"
196
ln -s "/usr/share/licenses/java${_major}-${_pkgname}/" "${pkgdir}/usr/share/licenses/${pkgname}"
197
198
if [ "${_opt_JCE}" -ne 0 ]; then
199
set +u; msg2 'Installing Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files...'; set -u
200
# Replace default "strong", but limited, cryptography to get an "unlimited strength" one for
201
# things like 256-bit AES. Enabled by default in OpenJDK:
202
# - http://suhothayan.blogspot.com/2012/05/how-to-install-java-cryptography.html
203
# - http://www.eyrie.org/~eagle/notes/debian/jce-policy.html
204
install -m644 "${srcdir}/UnlimitedJCEPolicyJDK${_major}"/*.jar 'lib/security/'
205
install -Dm644 "${srcdir}/UnlimitedJCEPolicyJDK${_major}/README.txt" \
206
"${pkgdir}/usr/share/doc/${_pkgname}/README_-_Java_JCE_Unlimited_Strength.txt"
207
fi
208
209
set +u; msg2 'Enabling copy+paste in unsigned applets...'; set -u
210
# Copy/paste from system clipboard to unsigned Java applets has been disabled since 6u24:
211
# - https://blogs.oracle.com/kyle/entry/copy_and_paste_in_java
212
# - http://slightlyrandombrokenthoughts.blogspot.com/2011/03/oracle-java-applet-clipboard-injection.html
213
local _text='\
214
// (AUR) Allow unsigned applets to read system clipboard, see:
215
// - https://blogs.oracle.com/kyle/entry/copy_and_paste_in_java
216
// - http://slightlyrandombrokenthoughts.blogspot.com/2011/03/oracle-java-applet-clipboard-injection.html
217
permission java.awt.AWTPermission "accessClipboard";'
218
local _lf=$'\n'
219
_text="${_text//${_lf}/\\n}"
220
local _line
221
_line="$(awk '/permission/{a=NR}; END{print a}' "${pkgdir}/etc/java-${_jname}/security/java.policy")"
222
sed -e "${_line} a ${_text}" -i "${pkgdir}/etc/java-${_jname}/security/java.policy"
223
set +u
224
}
225
set +u
226
Changes since previous scan
--- PKGBUILD @ 2026-06-20 16:03+++ PKGBUILD @ 2026-10-18 07:21@@ -32,7 +32,8 @@ #_minor='401'; _bundleid='249542'; _hash='4d245f941845490c91360409ecffb3b4' #_minor='431'; _bundleid='251398'; _hash='0d8f12bc927a4e2c9f8568ca567db4ee' #_minor='441'; _bundleid='251646'; _hash='7ed26d28139143f38c58992680c214a5'-_minor='491'; _bundleid='253185'; _hash='f7fe8e644f724108bdb54139381e29a7'+#_minor='491'; _bundleid='253185'; _hash='f7fe8e644f724108bdb54139381e29a7'+_minor='503'; _bundleid='253598'; _hash='2fde65a2208f40a5b5f4c844b0dff092' pkgver="${_major}u${_minor}" pkgrel='1' pkgdesc="Oracle Java ${_major} Runtime Environment"@@ -86,9 +87,9 @@ #"https://download.oracle.com/otn-pub/java/jdk/${pkgver}-${_build}/${_hash}/${_pkgname}-${pkgver}-linux-x64.tar.gz" # Now /otn/, Oracle sso required "policytool-${_jname}.desktop" )-md5sums=('f2d5a50cd9ac00501834d0c9275ea26d'+md5sums=('ab85b0d885177155015a240c6228966b' 'ef3ff483db5d38ed106e0b819006bdae')-sha256sums=('db493e23bed1e1c6d605eaf9bc2d9c0f6e0dddd1d2d821aae2de3261c5062884'+sha256sums=('fadfd37a548434abd88e32d0ed2e1c4842d85ee31198c30b2f9752a9e06825ac' '614b2a74b53728b7914c1407126a7ecfed781a79fb11e9963528c7cad39dbca8') #PKGEXT='.pkg.tar.zst' # gz is much faster than .xz, zst is much faster than gzScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-18 07:21:11 | Medium | 2 |
| 2026-06-20 16:03:41 | Clean | 2 |
| 2026-06-20 00:50:07 | Medium | 2 |
| 2026-06-20 00:18:46 | Medium | 2 |
| 2026-06-19 23:51:18 | Medium | 2 |
| 2026-06-19 19:07:35 | Medium | 2 |
| 2026-06-18 18:55:24 | Clean | 2 |
| 2026-06-18 16:11:54 | Medium | 1 |