jsettlers-git

maintainer aligator · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a Gradle distribution from services.gradle.org, a legitimate and official source, which is used to build the project from its own GitHub repository; the build process is transparent and uses pinned checksums, posing no supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Gradle distribution from services.gradle.org, a legitimate and official source, which is used to build the project from its own GitHub repository; the build process is transparent and uses pinned checksums, posing no supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "https://services.gradle.org/distributions/gradle-${_gradlever}-all.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: aligator <aligator at-symbol aligator.dev>
    
      2pkgrel=1
    
      3_pkgname='jsettlers'
    
      4pkgname=${_pkgname}'-git'
    
      5
    
      6pkgver=0.6.0.8.alpha.r0.g990134459
    
      7pkgver() {
    
      8  cd  ${_pkgname}
    
      9  git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      10}
    
      11_gradlever='7.4.2'
    
      12
    
      13arch=('any')
    
      14pkgdesc='A Remake of "The Settlers III" for Windows, Linux, Mac and Android - forked by paulwedeck'
    
      15url='https://github.com/paulwedeck/settlers-remake'
    
      16license=('MIT')
    
      17provides=(${_pkgname})
    
      18depends=('java-runtime>=11' 'sh')
    
      19optdepends=('settlers3-demo-data')
    
      20makedepends=('jdk11-openjdk' 'unzip' 'git')
    
      21install=${pkgname}'.install'
    
      22source=("jsettlers::git+https://github.com/paulwedeck/settlers-remake.git"
    
      23        "https://services.gradle.org/distributions/gradle-${_gradlever}-all.zip"
    
      24        "jsettlers-mapcreator.desktop"
    
      25        "jsettlers.desktop")
    
      26noextract=("gradle-${_gradlever}-all.zip")
    
      27sha512sums=('SKIP'
    
      28            '2e1d05486baa9661d5c8ffead2df87874a66f6cfc958ee6840432b89d221d8b0af9e3cad3675766f5413d12aa61c5b5fb0dd82f4164e5da3022865eba9ceadbf'
    
      29            '67d61b580daeb1dd098f10af99dccf81986732d9c6720432ec78cdfc093681b8f1a537c13b7460520ab0ae7443c1dc8da765f49cc8e90c27d59d14e6ee260179'
    
      30            '0c875bb6eb384867d46048054679ca555ff0600cbf197d170f9afda2b4a6c5e7bb275a08dad903cbf499508e2a96906a0f0267b4122f7cde8b42ed668ec17cc0')
    
      31
    
      32prepare() {
    
      33  # prepare gradle to use downloaded zip
    
      34  sed -i "/distributionUrl=/c\distributionUrl=gradle-${_gradlever}-all.zip" ${srcdir}/${_pkgname}/gradle/wrapper/gradle-wrapper.properties
    
      35  mv gradle-${_gradlever}-all.zip ${srcdir}/${_pkgname}/gradle/wrapper
    
      36}
    
      37
    
      38build() {
    
      39    cd ${srcdir}/${_pkgname}
    
      40    
    
      41    # build game (without android)
    
      42    JAVA_HOME="/usr/lib/jvm/java-11-openjdk" ANDROID_HOME="" ./gradlew --gradle-user-home=. releaseJSettlers || return 1
    
      43    # build server
    
      44    JAVA_HOME="/usr/lib/jvm/java-11-openjdk" ANDROID_HOME="" ./gradlew --gradle-user-home=. releaseDedicatedServer || return 1
    
      45}
    
      46
    
      47package() {
    
      48    _jarDest=${pkgdir}/usr/share/java/${_pkgname}
    
      49    _dataDest=${pkgdir}/usr/share/${_pkgname}
    
      50    _licenseDest=${pkgdir}/usr/share/licenses/${pkgname}
    
      51    bin=${pkgdir}/usr/bin
    
      52    
    
      53    _progName='JSettlers'
    
      54    
    
      55    _mapCreatorName='MapCreator'
    
      56    _mapCreatorScript=${_pkgname}'-'${_mapCreatorName,,}
    
      57
    
      58    _serverJar='DedicatedJSettlersServer.jar'
    
      59    _serverName='Server'
    
      60    _serverScript=${_pkgname}'-'${_serverName,,}
    
      61
    
      62    # create destination-dirs
    
      63    mkdir -p ${_jarDest} ${_dataDest} ${_licenseDest}
    
      64    
    
      65    # copy game-files
    
      66    cd ${srcdir}/${_pkgname}/release
    
      67    unzip -j ${_progName}'.zip' ${_progName}'/'${_progName}'.jar' -d ${_jarDest} 
    
      68    unzip -j ${_progName}'.zip' ${_progName}'/'${_mapCreatorName}'.jar' -d ${_jarDest}
    
      69    unzip -j ${_progName}'.zip' ${_progName}'/maps/*' -d ${_dataDest}'/maps'
    
      70    cp ${_serverJar} ${_jarDest}
    
      71
    
      72    # copy license
    
      73    cd ${srcdir}   
    
      74    cp ${_pkgname}'/LICENSE.txt' ${_licenseDest}
    
      75    
    
      76    # create launch-scripts
    
      77    mkdir -p ${bin}
    
      78    echo '#!/bin/sh' > ${bin}/${_pkgname}
    
      79    echo 'mkdir -p "${XDG_DATA_HOME:-$HOME/.local/share}/'${_pkgname}'"' >> ${bin}/${_pkgname}
    
      80    echo 'cd "${XDG_DATA_HOME:-$HOME/.local/share}/'${_pkgname}'"' >> ${bin}/${_pkgname}
    
      81    echo 'exec /usr/bin/java -jar /usr/share/java/'${_pkgname}'/'${_progName}'.jar --maps=/usr/share/'${_pkgname}'/maps "$@"' >> ${bin}/${_pkgname}
    
      82    chmod +x ${bin}/${_pkgname}
    
      83
    
      84    echo '#!/bin/sh' > ${bin}/${_mapCreatorScript}
    
      85    echo 'mkdir -p "${XDG_DATA_HOME:-$HOME/.local/share}/'${_pkgname}'"' >> ${bin}/${_mapCreatorScript}
    
      86    echo 'cd "${XDG_DATA_HOME:-$HOME/.local/share}/'${_pkgname}'"' >> ${bin}/${_mapCreatorScript}
    
      87    echo 'exec /usr/bin/java -jar /usr/share/java/'${_pkgname}'/'${_mapCreatorName}'.jar --maps=/usr/share/'${_pkgname}'/maps "$@"' >> ${bin}/${_mapCreatorScript}
    
      88    chmod +x ${bin}/${_mapCreatorScript}
    
      89
    
      90    echo '#!/bin/sh' > ${bin}/${_serverScript}
    
      91    echo 'mkdir -p "${XDG_DATA_HOME:-$HOME/.local/share}/'${_pkgname}'"' >> ${bin}/${_serverScript}
    
      92    echo 'cd "${XDG_DATA_HOME:-$HOME/.local/share}/'${_pkgname}'"' >> ${bin}/${_serverScript}
    
      93    echo 'exec /usr/bin/java -jar /usr/share/java/'${_pkgname}'/'${_serverJar}' "$@"' >> ${bin}/${_serverScript}
    
      94    chmod +x ${bin}/${_serverScript}
    
      95
    
      96    install -Dm644 ../${_pkgname}.desktop "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      97    install -Dm644 ../${_mapCreatorScript}.desktop "${pkgdir}/usr/share/applications/${_mapCreatorScript}.desktop"
    
      98    install -Dm644 ${srcdir}/jsettlers/jsettlers.main.swing/src/main/resources/jsettlers/main/swing/icon.png "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      99    install -Dm644 ${srcdir}/jsettlers/jsettlers.main.swing/src/main/resources/jsettlers/main/swing/icon.png "${pkgdir}/usr/share/pixmaps/${_mapCreatorScript}.png"
    
      100}
    
      101

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2