liberica-jdk-25-full-bin

maintainer Nevuly · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt Liberica JDK binaries from BellSoft's official domain (download.bell-sw.com), which is the project's legitimate source; the non-whitelisted host is not a risk because it is the vendor's own infrastructure, and the binaries are standard JDK distributions.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Liberica JDK binaries from BellSoft's official domain (download.bell-sw.com), which is the project's legitimate source; the non-whitelisted host is not a risk because it is the vendor's own infrastructure, and the binaries are standard JDK distributions.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:71 source_aarch64=(https://download.bell-sw.com/java/$_pkgver/bellsoft-jdk$_pkgver-linux-aarch64-full.tar.gz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yang Jeong Hun (Nevuly) <onyxclover9931@gmail.com>
    
      2# Contributor: Yurii Kolesnykov <root@yurikoles.com>
    
      3# Contributor: Jonathon Fernyhough <jonathon"m2x+dev>
    
      4# Contributor: Sam Guymer <sam at guymer dot me>
    
      5# Contributor: Levente Polyak <anthraxx[at]archlinux[dot]org>
    
      6# Contributor: Guillaume ALAUX <guillaume@archlinux.org>
    
      7
    
      8# This PKGBUILD adapted from zulu-11-bin
    
      9
    
      10_jdkname=liberica-jdk-25-full
    
      11pkgname="${_jdkname}-bin"
    
      12_java_ver=25
    
      13_pkgver=${_java_ver}.0.4+9
    
      14pkgver=${_pkgver/+/.u}
    
      15pkgrel=1
    
      16pkgdesc='BellSoft builds of OpenJDK are fully certified and 100% open source Java Development Kits (JDKs) for all Java development and production workloads. Full version includes OpenJFX.'
    
      17arch=(aarch64 armv7h armv8h x86_64)
    
      18url='https://bell-sw.com/'
    
      19license=('custom')
    
      20depends=('java-environment-common=3' 'java-runtime-common>=3' 'ca-certificates-utils')
    
      21optdepends=(ffmpeg freetype2 gtk2 gtk3 libnet)
    
      22provides=(
    
      23  "java-environment=${pkgver/.*}"
    
      24  "java-environment-openjdk=${pkgver/.*}"
    
      25  "java-openjfx=${pkgver/.*}"
    
      26  "java-runtime-headless=${pkgver/.*}"
    
      27  "java-runtime-headless-openjdk=${pkgver/.*}"
    
      28  "java-runtime=${pkgver/.*}"
    
      29  "java-runtime-openjdk=${pkgver/.*}"
    
      30  "liberica-jdk-25-bin=$pkgver"
    
      31  "liberica-jdk-25-full-bin=$pkgver"
    
      32  "liberica-jdk-25-lite-bin=$pkgver"
    
      33  "liberica-jre-25-bin=$pkgver"
    
      34  "liberica-jre-25-full-bin=$pkgver"
    
      35)
    
      36install=$_jdkname.install
    
      37
    
      38backup=(etc/${_jdkname}/logging.properties
    
      39        etc/${_jdkname}/management/jmxremote.access
    
      40        etc/${_jdkname}/management/jmxremote.password.template
    
      41        etc/${_jdkname}/management/management.properties
    
      42        etc/${_jdkname}/net.properties
    
      43        etc/${_jdkname}/security/java.security
    
      44        etc/${_jdkname}/security/policy/README.txt
    
      45        etc/${_jdkname}/security/policy/limited/default_US_export.policy
    
      46        etc/${_jdkname}/security/policy/limited/default_local.policy
    
      47        etc/${_jdkname}/security/policy/limited/exempt_local.policy
    
      48        etc/${_jdkname}/security/policy/unlimited/default_US_export.policy
    
      49        etc/${_jdkname}/security/policy/unlimited/default_local.policy
    
      50        etc/${_jdkname}/sound.properties)
    
      51
    
      52source=(freedesktop-java.desktop.in
    
      53        freedesktop-jconsole.desktop.in
    
      54        freedesktop-jshell.desktop.in
    
      55        ${_jdkname}16.png::https://raw.githubusercontent.com/openjdk/jdk/master/src/java.desktop/unix/classes/sun/awt/X11/java-icon16.png
    
      56        ${_jdkname}24.png::https://raw.githubusercontent.com/openjdk/jdk/master/src/java.desktop/unix/classes/sun/awt/X11/java-icon24.png
    
      57        ${_jdkname}32.png::https://raw.githubusercontent.com/openjdk/jdk/master/src/java.desktop/unix/classes/sun/awt/X11/java-icon32.png
    
      58        ${_jdkname}48.png::https://raw.githubusercontent.com/openjdk/jdk/master/src/java.desktop/unix/classes/sun/awt/X11/java-icon48.png)
    
      59sha1sums=('61f0d3b292aceafbce170592b5e50b99e47601fe'
    
      60          '774d5313a1d3bb0950c09cf29423fa4e2804dd18'
    
      61          '8544360dba8b53fb42d41429766cb7b13779b66f'
    
      62          '36096a57cebd346e08efc68326fe77960d43726f'
    
      63          'b8233f9ff931ce97a265827fac18ed90f4e248c6'
    
      64          'a0da2952bc87a425182c3ac88e88649fbaa7cb65'
    
      65          'eb36aa73a9be98164447774217865b91e79d503c')
    
      66sha1sums_aarch64=('ef93c77ea76cdc3a51506c3645cba93ef6ee6111')
    
      67sha1sums_armv7h=('a236e1765d4a5abadaa52f4f5b52e9ea8e8a5162')
    
      68sha1sums_armv8h=('a236e1765d4a5abadaa52f4f5b52e9ea8e8a5162')
    
      69sha1sums_x86_64=('b0c9756cc59a2a0af415387c808cf550b4181471')
    
      70
    
      71source_aarch64=(https://download.bell-sw.com/java/$_pkgver/bellsoft-jdk$_pkgver-linux-aarch64-full.tar.gz)
    
      72source_armv7h=(https://download.bell-sw.com/java/$_pkgver/bellsoft-jdk$_pkgver-linux-arm32-vfp-hflt-full.tar.gz)
    
      73source_armv8h=(${source_armv7h[@]})
    
      74source_x86_64=(https://download.bell-sw.com/java/$_pkgver/bellsoft-jdk$_pkgver-linux-amd64-full.tar.gz)
    
      75
    
      76# Skip debug package generation and stripping for prebuilt binaries
    
      77options=(!debug !strip)
    
      78
    
      79# Upstream-provided
    
      80
    
      81_jvmdir="/usr/lib/jvm/${_jdkname}"
    
      82
    
      83prepare() {
    
      84  for f in *.desktop.in; do
    
      85    sed "s|@@VER@@|${pkgver/.*}|g" $f >> ${f/.in}
    
      86  done
    
      87}
    
      88
    
      89package() {
    
      90  cd jdk-${_pkgver/+*}-full
    
      91
    
      92  install -dm 755 "${pkgdir}/${_jvmdir}"
    
      93  cp -r . "${pkgdir}/${_jvmdir}/"
    
      94
    
      95  # copied from java11-openjdk
    
      96
    
      97  # Conf
    
      98  install -dm 755 "${pkgdir}/etc"
    
      99  cp -r conf "${pkgdir}/etc/${_jdkname}"
    
      100  rm -rf "${pkgdir}/${_jvmdir}/conf"
    
      101  ln -s "/etc/${_jdkname}" "${pkgdir}/${_jvmdir}/conf"
    
      102
    
      103  # Legal
    
      104  install -dm 755 "${pkgdir}/usr/share/licenses"
    
      105  cp -r legal "${pkgdir}/usr/share/licenses/${_jdkname}"
    
      106  rm -rf "${pkgdir}/${_jvmdir}/legal"
    
      107  ln -s "/usr/share/licenses/${_jdkname}" "${pkgdir}/${_jvmdir}/legal"
    
      108
    
      109  # Man pages
    
      110  # for f in man/man1/*; do
    
      111  #   install -Dm 644 "${f}" "${pkgdir}/usr/share/${f/\.1/-$_jdkname.1}"
    
      112  # done
    
      113  # rm -rf "${pkgdir}/${_jvmdir}/man"
    
      114  # ln -s /usr/share/man "${pkgdir}/${_jvmdir}/man"
    
      115
    
      116  # Link JKS keystore from ca-certificates-utils
    
      117  rm -f "${pkgdir}/${_jvmdir}/lib/security/cacerts"
    
      118  ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}/${_jvmdir}/lib/security/cacerts"
    
      119
    
      120  # Icons and launchers
    
      121  for s in 16 24 32 48; do
    
      122    install -Dm644 "${srcdir}"/${_jdkname}${s}.png "${pkgdir}"/usr/share/icons/hicolor/${s}x${s}/apps/${_jdkname}.png
    
      123  done
    
      124  for f in java jconsole jshell; do
    
      125    install -Dm644 "${srcdir}"/freedesktop-${f}.desktop "${pkgdir}"/usr/share/applications/${f}-${_jdkname}.desktop
    
      126  done
    
      127}
    
      128

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -10,9 +10,9 @@
 _jdkname=liberica-jdk-25-full
 pkgname="${_jdkname}-bin"
 _java_ver=25
-_pkgver=${_java_ver}.0.3+11
+_pkgver=${_java_ver}.0.4+9
 pkgver=${_pkgver/+/.u}
-pkgrel=2
+pkgrel=1
 pkgdesc='BellSoft builds of OpenJDK are fully certified and 100% open source Java Development Kits (JDKs) for all Java development and production workloads. Full version includes OpenJFX.'
 arch=(aarch64 armv7h armv8h x86_64)
 url='https://bell-sw.com/'
@@ -56,17 +56,17 @@
         ${_jdkname}24.png::https://raw.githubusercontent.com/openjdk/jdk/master/src/java.desktop/unix/classes/sun/awt/X11/java-icon24.png
         ${_jdkname}32.png::https://raw.githubusercontent.com/openjdk/jdk/master/src/java.desktop/unix/classes/sun/awt/X11/java-icon32.png
         ${_jdkname}48.png::https://raw.githubusercontent.com/openjdk/jdk/master/src/java.desktop/unix/classes/sun/awt/X11/java-icon48.png)
-sha1sums=('a00825362b7bc4320f88abf4b1b832682dd2b542'
-          '9e93c3a5b920c6e1785ac86c74a30b3ffddd5d57'
-          '0f11c63504f7c7a038c84f1761723aac39e7e45a'
+sha1sums=('61f0d3b292aceafbce170592b5e50b99e47601fe'
+          '774d5313a1d3bb0950c09cf29423fa4e2804dd18'
+          '8544360dba8b53fb42d41429766cb7b13779b66f'
           '36096a57cebd346e08efc68326fe77960d43726f'
           'b8233f9ff931ce97a265827fac18ed90f4e248c6'
           'a0da2952bc87a425182c3ac88e88649fbaa7cb65'
           'eb36aa73a9be98164447774217865b91e79d503c')
-sha1sums_aarch64=('34ddfbf6b31202ae03316a0e4e8b5b3d1171f491')
-sha1sums_armv7h=('b05f0344dd28fdcc7eed8aae4b7088058224aff1')
-sha1sums_armv8h=('b05f0344dd28fdcc7eed8aae4b7088058224aff1')
-sha1sums_x86_64=('0da4f6fbe9593476e3a2f743d4992cd644d09416')
+sha1sums_aarch64=('ef93c77ea76cdc3a51506c3645cba93ef6ee6111')
+sha1sums_armv7h=('a236e1765d4a5abadaa52f4f5b52e9ea8e8a5162')
+sha1sums_armv8h=('a236e1765d4a5abadaa52f4f5b52e9ea8e8a5162')
+sha1sums_x86_64=('b0c9756cc59a2a0af415387c808cf550b4181471')
 
 source_aarch64=(https://download.bell-sw.com/java/$_pkgver/bellsoft-jdk$_pkgver-linux-aarch64-full.tar.gz)
 source_armv7h=(https://download.bell-sw.com/java/$_pkgver/bellsoft-jdk$_pkgver-linux-arm32-vfp-hflt-full.tar.gz)
@@ -90,7 +90,7 @@
   cd jdk-${_pkgver/+*}-full
 
   install -dm 755 "${pkgdir}/${_jvmdir}"
-  cp -a . "${pkgdir}/${_jvmdir}/"
+  cp -r . "${pkgdir}/${_jvmdir}/"
 
   # copied from java11-openjdk
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 09:14:07	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2