liberica-jdk-17-full-bin

maintainer bacteriostat · 5 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt Liberica JDK binaries from BellSoft's official domain (download.bell-sw.com), which is the project's legitimate release infrastructure; despite the static analyzer flagging the host as non-standard, the source is trustworthy and the binaries are checksummed, making this a standard AUR packaging pattern with low risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Liberica JDK binaries from BellSoft's official domain (download.bell-sw.com), which is the project's legitimate release infrastructure; despite the static analyzer flagging the host as non-standard, the source is trustworthy and the binaries are checksummed, making this a standard AUR packaging pattern with low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:58 source_aarch64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-aarch64-full.tar.gz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Bacteriostat <dev dot bacteria at aleeas dot com>
    
      2# Contributor: Jonathon Fernyhough <jonathon"m2x+dev>
    
      3# Contributor: Sam Guymer <sam at guymer dot me>
    
      4# Contributor: Levente Polyak <anthraxx[at]archlinux[dot]org>
    
      5# Contributor: Guillaume ALAUX <guillaume@archlinux.org>
    
      6
    
      7# This PKGBUILD adapted from zulu-11-bin
    
      8
    
      9_pkgbase=liberica-jdk-full
    
      10_java_ver=17
    
      11_jdkname="liberica-jdk-${_java_ver}-full"
    
      12pkgname="${_jdkname}-bin"
    
      13pkgver=17.0.20+10
    
      14pkgrel=1
    
      15pkgdesc='BellSoft builds of OpenJDK are fully certified and 100% open source Java Development Kits (JDKs) for all Java development and production workloads. Full version includes OpenJFX.'
    
      16arch=(aarch64 armv7h armv8h x86_64)
    
      17url='https://bell-sw.com/'
    
      18license=('custom')
    
      19depends=('java-environment-common=3' 'java-runtime-common>=3' 'ca-certificates-utils')
    
      20optdepends=(ffmpeg freetype2 gtk2 gtk3 libnet)
    
      21provides=(
    
      22  "java-environment=${pkgver/.*}"
    
      23  "java-environment-openjdk=${pkgver/.*}"
    
      24  "java-openjfx=${pkgver/.*}"
    
      25  "java-runtime-headless=${pkgver/.*}"
    
      26  "java-runtime-headless-openjdk=${pkgver/.*}"
    
      27  "java-runtime=${pkgver/.*}"
    
      28  "java-runtime-openjdk=${pkgver/.*}"
    
      29  "liberica-jdk-17-bin=$pkgver"
    
      30  "liberica-jdk-17-lite-bin=$pkgver"
    
      31  "liberica-jre-17-bin=$pkgver"
    
      32  "liberica-jre-17-full-bin=$pkgver"
    
      33  "liberica-jdk-17-full-bin=$pkgver"
    
      34)
    
      35install=$_jdkname.install
    
      36
    
      37backup=(etc/${_jdkname}/logging.properties
    
      38        etc/${_jdkname}/management/jmxremote.access
    
      39        etc/${_jdkname}/management/jmxremote.password.template
    
      40        etc/${_jdkname}/management/management.properties
    
      41        etc/${_jdkname}/net.properties
    
      42        etc/${_jdkname}/security/java.policy
    
      43        etc/${_jdkname}/security/java.security
    
      44        etc/${_jdkname}/security/policy/README.txt
    
      45        etc/${_jdkname}/security/policy/limited/default_US_export.policy
    
      46        etc/${_jdkname}/security/policy/limited/default_local.policy
    
      47        etc/${_jdkname}/security/policy/limited/exempt_local.policy
    
      48        etc/${_jdkname}/security/policy/unlimited/default_US_export.policy
    
      49        etc/${_jdkname}/security/policy/unlimited/default_local.policy
    
      50        etc/${_jdkname}/sound.properties)
    
      51
    
      52source=(
    
      53  freedesktop-java.desktop.in
    
      54  freedesktop-jconsole.desktop.in
    
      55  freedesktop-jshell.desktop.in
    
      56)
    
      57
    
      58source_aarch64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-aarch64-full.tar.gz)
    
      59source_armv7h=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-arm32-vfp-hflt-full.tar.gz)
    
      60source_armv8h=(${source_armv7h[@]})
    
      61source_x86_64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-amd64-full.tar.gz)
    
      62
    
      63sha1sums=('7d79a8c26a125f55f52493df7dca2189c8521b3c'
    
      64          '80a166acf99b351aa466452782a8faac3eca2d26'
    
      65          '4b5684dc98370ecbff274195b42c3ce559226596')
    
      66sha1sums_aarch64=('15ba548c7130df102f6caff528a3e16e2a6a6679')
    
      67sha1sums_armv7h=('8caec866ecc287ca7fd69e6a53dc0f67f78a7a36')
    
      68sha1sums_armv8h=('8caec866ecc287ca7fd69e6a53dc0f67f78a7a36')
    
      69sha1sums_x86_64=('8b26bb1d042664b8e1fc801189ef91b38d842ddb')
    
      70
    
      71# Upstream-provided
    
      72
    
      73_jvmdir="/usr/lib/jvm/${_jdkname}"
    
      74
    
      75prepare() {
    
      76  for f in *.desktop.in; do
    
      77    sed "s|@@VER@@|${pkgver/.*}|g; s|@@PATH@@|${_jvmdir}|g; s|@@ICON@@|${_jdkname}|g;" $f >> ${f/.in}
    
      78  done
    
      79}
    
      80
    
      81package() {
    
      82  cd jdk-${pkgver/+*}-full
    
      83
    
      84  install -dm 755 "${pkgdir}/${_jvmdir}"
    
      85  cp -a . "${pkgdir}/${_jvmdir}/"
    
      86
    
      87  # copied from java11-openjdk
    
      88
    
      89  # Conf
    
      90  install -dm 755 "${pkgdir}/etc"
    
      91  cp -r conf "${pkgdir}/etc/${_jdkname}"
    
      92  rm -rf "${pkgdir}/${_jvmdir}/conf"
    
      93  ln -s "/etc/${_jdkname}" "${pkgdir}/${_jvmdir}/conf"
    
      94
    
      95  # Legal
    
      96  install -dm 755 "${pkgdir}/usr/share/licenses"
    
      97  cp -r legal "${pkgdir}/usr/share/licenses/${_jdkname}"
    
      98  rm -rf "${pkgdir}/${_jvmdir}/legal"
    
      99  ln -s "/usr/share/licenses/${_jdkname}" "${pkgdir}/${_jvmdir}/legal"
    
      100
    
      101  # Man pages
    
      102  for f in man/man1/*; do
    
      103    install -Dm 644 "${f}" "${pkgdir}/usr/share/${f/\.1/-$_jdkname.1}"
    
      104  done
    
      105  rm -rf "${pkgdir}/${_jvmdir}/man"
    
      106  ln -s /usr/share/man "${pkgdir}/${_jvmdir}/man"
    
      107
    
      108  # Link JKS keystore from ca-certificates-utils
    
      109  rm -f "${pkgdir}/${_jvmdir}/lib/security/cacerts"
    
      110  ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}/${_jvmdir}/lib/security/cacerts"
    
      111
    
      112}
    
      113

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -10,8 +10,7 @@
 _java_ver=17
 _jdkname="liberica-jdk-${_java_ver}-full"
 pkgname="${_jdkname}-bin"
-pkgver=${_java_ver}.0.19.u11
-_pkgver=${_java_ver}.0.19+11
+pkgver=17.0.20+10
 pkgrel=1
 pkgdesc='BellSoft builds of OpenJDK are fully certified and 100% open source Java Development Kits (JDKs) for all Java development and production workloads. Full version includes OpenJFX.'
 arch=(aarch64 armv7h armv8h x86_64)
@@ -56,18 +55,18 @@
   freedesktop-jshell.desktop.in
 )
 
-source_aarch64=(https://download.bell-sw.com/java/$_pkgver/bellsoft-jdk$_pkgver-linux-aarch64-full.tar.gz)
-source_armv7h=(https://download.bell-sw.com/java/$_pkgver/bellsoft-jdk$_pkgver-linux-arm32-vfp-hflt-full.tar.gz)
+source_aarch64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-aarch64-full.tar.gz)
+source_armv7h=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-arm32-vfp-hflt-full.tar.gz)
 source_armv8h=(${source_armv7h[@]})
-source_x86_64=(https://download.bell-sw.com/java/$_pkgver/bellsoft-jdk$_pkgver-linux-amd64-full.tar.gz)
+source_x86_64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-amd64-full.tar.gz)
 
 sha1sums=('7d79a8c26a125f55f52493df7dca2189c8521b3c'
           '80a166acf99b351aa466452782a8faac3eca2d26'
           '4b5684dc98370ecbff274195b42c3ce559226596')
-sha1sums_aarch64=('3f855b7c47848e3c26b1577116c0809f34266667')
-sha1sums_armv7h=('692c3b8de4756e39d13b4dd26b8a1f576ffd6efd')
-sha1sums_armv8h=('692c3b8de4756e39d13b4dd26b8a1f576ffd6efd')
-sha1sums_x86_64=('9e7ffdc9f849265d5b1bb1d1238f64d7cf3478c5')
+sha1sums_aarch64=('15ba548c7130df102f6caff528a3e16e2a6a6679')
+sha1sums_armv7h=('8caec866ecc287ca7fd69e6a53dc0f67f78a7a36')
+sha1sums_armv8h=('8caec866ecc287ca7fd69e6a53dc0f67f78a7a36')
+sha1sums_x86_64=('8b26bb1d042664b8e1fc801189ef91b38d842ddb')
 
 # Upstream-provided
 
@@ -80,7 +79,7 @@
 }
 
 package() {
-  cd jdk-${_pkgver/+*}-full
+  cd jdk-${pkgver/+*}-full
 
   install -dm 755 "${pkgdir}/${_jvmdir}"
   cp -a . "${pkgdir}/${_jvmdir}/"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 13:24:23	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1