liberica-jdk-21-full-bin
LOW
maintainer Nevuly
3 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads prebuilt Liberica JDK binaries from BellSoft's official domain (download.bell-sw.com), which is the project's legitimate release infrastructure; despite the static analyzer flag for a non-standard host, the source is trustworthy and checksums are provided, making this a standard AUR package for a vendor-built JDK.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Liberica JDK binaries from BellSoft's official domain (download.bell-sw.com), which is the project's legitimate release infrastructure; despite the static analyzer flag for a non-standard host, the source is trustworthy and checksums are provided, making this a standard AUR package for a vendor-built JDK.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:56
source_aarch64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-aarch64-full.tar.gz)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yang Jeong Hun (Nevuly) <onyxclover9931@gmail.com>
2
# Contributor: Yurii Kolesnykov <root@yurikoles.com>
3
# Contributor: Jonathon Fernyhough <jonathon"m2x+dev>
4
# Contributor: Sam Guymer <sam at guymer dot me>
5
# Contributor: Levente Polyak <anthraxx[at]archlinux[dot]org>
6
# Contributor: Guillaume ALAUX <guillaume@archlinux.org>
7
8
# This PKGBUILD adapted from zulu-11-bin
9
10
_pkgbase=liberica-jdk-full
11
_java_ver=21
12
_jdkname="liberica-jdk-${_java_ver}-full"
13
pkgname="${_jdkname}-bin"
14
pkgver=21.0.13.0.2+5
15
pkgrel=1
16
pkgdesc='BellSoft builds of OpenJDK are fully certified and 100% open source Java Development Kits (JDKs) for all Java development and production workloads. Full version includes OpenJFX.'
17
arch=(aarch64 armv7h armv8h x86_64)
18
url='https://bell-sw.com/'
19
license=('custom')
20
depends=('java-environment-common=3' 'java-runtime-common>=3' 'ca-certificates-utils')
21
optdepends=(ffmpeg freetype2 gtk2 gtk3 libnet)
22
provides=(
23
"java-environment=${pkgver/.*}"
24
"java-environment-openjdk=${pkgver/.*}"
25
"java-openjfx=${pkgver/.*}"
26
"java-runtime-headless=${pkgver/.*}"
27
"java-runtime-headless-openjdk=${pkgver/.*}"
28
"java-runtime=${pkgver/.*}"
29
"java-runtime-openjdk=${pkgver/.*}"
30
"liberica-jdk-21-bin=$pkgver"
31
"liberica-jdk-21-full-bin=$pkgver"
32
"liberica-jdk-21-lite-bin=$pkgver"
33
"liberica-jre-21-bin=$pkgver"
34
"liberica-jre-21-full-bin=$pkgver"
35
)
36
install=$_jdkname.install
37
38
backup=(etc/${_jdkname}/logging.properties
39
etc/${_jdkname}/management/jmxremote.access
40
etc/${_jdkname}/management/jmxremote.password.template
41
etc/${_jdkname}/management/management.properties
42
etc/${_jdkname}/net.properties
43
etc/${_jdkname}/security/java.policy
44
etc/${_jdkname}/security/java.security
45
etc/${_jdkname}/security/policy/README.txt
46
etc/${_jdkname}/security/policy/limited/default_US_export.policy
47
etc/${_jdkname}/security/policy/limited/default_local.policy
48
etc/${_jdkname}/security/policy/limited/exempt_local.policy
49
etc/${_jdkname}/security/policy/unlimited/default_US_export.policy
50
etc/${_jdkname}/security/policy/unlimited/default_local.policy
51
etc/${_jdkname}/sound.properties)
52
53
source=(freedesktop-java.desktop.in
54
freedesktop-jconsole.desktop.in
55
freedesktop-jshell.desktop.in)
56
source_aarch64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-aarch64-full.tar.gz)
57
source_armv7h=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-arm32-vfp-hflt-full.tar.gz)
58
source_armv8h=(${source_armv7h[@]})
59
source_x86_64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-amd64-full.tar.gz)
60
61
sha1sums=('ec278cbc0a5f7a188140703c63e3b9cdb3931c29'
62
'41cece227a4641fbb1e04d246c51ac2dac7f0012'
63
'13af0192b2ffe02efaf5ae6a592b3ea15d9f7194')
64
sha1sums_aarch64=('5315d58f3cbe1079c7925a921e0e91050a31d634')
65
sha1sums_armv7h=('46225656f215cc9932b8025f483ce416979af007')
66
sha1sums_armv8h=('46225656f215cc9932b8025f483ce416979af007')
67
sha1sums_x86_64=('2305b636601f4be8d9a32f93fea6c6804e5c9e53')
68
69
# Skip debug package generation and stripping for prebuilt binaries
70
options=(!debug !strip)
71
72
# Upstream-provided
73
74
_jvmdir="/usr/lib/jvm/${_jdkname}"
75
76
prepare() {
77
for f in *.desktop.in; do
78
sed "s|@@VER@@|${pkgver/.*}|g; s|@@PATH@@|${_jvmdir}|g" $f >> ${f/.in}
79
done
80
}
81
82
package() {
83
cd jdk-${pkgver/+*}-full
84
85
install -dm 755 "${pkgdir}/${_jvmdir}"
86
cp -r . "${pkgdir}/${_jvmdir}/"
87
88
# copied from java11-openjdk
89
90
# Conf
91
install -dm 755 "${pkgdir}/etc"
92
cp -r conf "${pkgdir}/etc/${_jdkname}"
93
rm -rf "${pkgdir}/${_jvmdir}/conf"
94
ln -s "/etc/${_jdkname}" "${pkgdir}/${_jvmdir}/conf"
95
96
# Legal
97
install -dm 755 "${pkgdir}/usr/share/licenses"
98
cp -r legal "${pkgdir}/usr/share/licenses/${_jdkname}"
99
rm -rf "${pkgdir}/${_jvmdir}/legal"
100
ln -s "/usr/share/licenses/${_jdkname}" "${pkgdir}/${_jvmdir}/legal"
101
102
# Man pages
103
for f in man/man1/*; do
104
install -Dm 644 "${f}" "${pkgdir}/usr/share/${f/\.1/-$_jdkname.1}"
105
done
106
rm -rf "${pkgdir}/${_jvmdir}/man"
107
ln -s /usr/share/man "${pkgdir}/${_jvmdir}/man"
108
109
# Link JKS keystore from ca-certificates-utils
110
rm -f "${pkgdir}/${_jvmdir}/lib/security/cacerts"
111
ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}/${_jvmdir}/lib/security/cacerts"
112
113
# Launchers
114
for f in java jconsole jshell; do
115
install -Dm644 "${srcdir}"/freedesktop-${f}.desktop "${pkgdir}"/usr/share/applications/${f}-${_jdkname}.desktop
116
done
117
}
118
Changes since previous scan
--- PKGBUILD @ 2026-10-24 00:14+++ PKGBUILD @ 2026-11-01 00:21@@ -11,7 +11,7 @@ _java_ver=21 _jdkname="liberica-jdk-${_java_ver}-full" pkgname="${_jdkname}-bin"-pkgver=21.0.13+11+pkgver=21.0.13.0.2+5 pkgrel=1 pkgdesc='BellSoft builds of OpenJDK are fully certified and 100% open source Java Development Kits (JDKs) for all Java development and production workloads. Full version includes OpenJFX.' arch=(aarch64 armv7h armv8h x86_64)@@ -61,10 +61,10 @@ sha1sums=('ec278cbc0a5f7a188140703c63e3b9cdb3931c29' '41cece227a4641fbb1e04d246c51ac2dac7f0012' '13af0192b2ffe02efaf5ae6a592b3ea15d9f7194')-sha1sums_aarch64=('94ee10f3e2dbf817e73534b61b8a21ea52f93dff')-sha1sums_armv7h=('b3f096f6694ef633792c27d26deacb5ceb8d6171')-sha1sums_armv8h=('b3f096f6694ef633792c27d26deacb5ceb8d6171')-sha1sums_x86_64=('011a95a0b704495c125856a6c05bb20d95c09437')+sha1sums_aarch64=('5315d58f3cbe1079c7925a921e0e91050a31d634')+sha1sums_armv7h=('46225656f215cc9932b8025f483ce416979af007')+sha1sums_armv8h=('46225656f215cc9932b8025f483ce416979af007')+sha1sums_x86_64=('2305b636601f4be8d9a32f93fea6c6804e5c9e53') # Skip debug package generation and stripping for prebuilt binaries options=(!debug !strip)Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 03:49:04 | Medium | 1 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 13:40:12 | Medium | 1 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 03:33:54 | Medium | 1 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |