liberica-jdk-8-full-bin
maintainer Nevuly
· 4 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads prebuilt Liberica JDK binaries from BellSoft's official domain (download.bell-sw.com), which is the project's legitimate release infrastructure; despite the static analyzer flag for a non-standard host, the source is trustworthy and the binaries are from the official vendor, making this a normal AUR packaging pattern with low risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Liberica JDK binaries from BellSoft's official domain (download.bell-sw.com), which is the project's legitimate release infrastructure; despite the static analyzer flag for a non-standard host, the source is trustworthy and the binaries are from the official vendor, making this a normal AUR packaging pattern with low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
source_i686=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-i586-full.tar.gz)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yang Jeong Hun (Nevuly) <onyxclover9931@gmail.com>
2
# Contributor: Jonathon Fernyhough <jonathon"m2x+dev>
3
# Contributor: Sam Guymer <sam at guymer dot me>
4
5
# This PKGBUILD adapted from zulu-8-bin
6
7
_jdkname=liberica-jdk-8-full
8
pkgname="${_jdkname}-bin"
9
_java_ver=8
10
pkgver=8u502+9
11
pkgrel=1
12
pkgdesc='BellSoft builds of OpenJDK are fully certified and 100% open source Java Development Kits (JDKs) for all Java development and production workloads. Full version includes OpenJFX.'
13
arch=(i686 x86_64)
14
url='https://bell-sw.com/'
15
license=('custom')
16
depends=('java-environment-common=3' 'java-runtime-common>=3' 'ca-certificates-utils')
17
optdepends=(ffmpeg freetype2 gtk2 gtk3 libnet)
18
provides=(
19
"java-environment=$_java_ver"
20
"java-environment-openjdk=$_java_ver"
21
"java-runtime-headless=$_java_ver"
22
"java-runtime-headless-openjdk=$_java_ver"
23
"java-runtime=$_java_ver"
24
"java-runtime-openjdk=$_java_ver"
25
"liberica-jdk-8-bin=$pkgver"
26
"libercia-jdk-8-full-bin=$pkgver"
27
"liberica-jdk-8-lite-bin=$pkgver"
28
"liberica-jre-8-bin=$pkgver"
29
"liberica-jre-8-full-bin=$pkgver"
30
)
31
install=$_jdkname.install
32
33
source_i686=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-i586-full.tar.gz)
34
source_x86_64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-amd64-full.tar.gz)
35
36
# Upstream-provided
37
sha1sums_i686=('466523aa383b7591dca4cdb9c21216a49199637e')
38
sha1sums_x86_64=('319fe227404afd474445661e0eb611be2cc080af')
39
40
_jvmdir="/usr/lib/jvm/${_jdkname}"
41
42
# Upstream config files that should go to etc and get backup
43
_conf_files=(
44
amd64/jvm.cfg
45
calendars.properties
46
content-types.properties
47
flavormap.properties
48
images/cursors/cursors.properties
49
logging.properties
50
management/jmxremote.access
51
management/jmxremote.password
52
management/management.properties
53
management/snmp.acl
54
net.properties
55
psfont.properties.ja
56
psfontj2d.properties
57
security/java.policy
58
security/java.security
59
sound.properties
60
)
61
62
package() {
63
cd jdk${pkgver/+*/}-full
64
65
install -dm 755 "${pkgdir}/${_jvmdir}"
66
cp -a * "${pkgdir}/${_jvmdir}/"
67
68
# copied from java8-openjdk
69
70
# Set config files
71
mv "${pkgdir}${_jvmdir}"/jre/lib/management/jmxremote.password{.template,}
72
mv "${pkgdir}${_jvmdir}"/jre/lib/management/snmp.acl{.template,}
73
74
# Conf
75
install -dm 755 "${pkgdir}/etc/${_jdkname}"
76
for f in "${_conf_files[@]}"; do
77
_file="${_jvmdir}/jre/lib/$f"
78
install -D -m 644 "${pkgdir}${_file}" "${pkgdir}/etc/${_jdkname}/$f"
79
ln -sf "/etc/${_jdkname}/$f" "${pkgdir}${_file}"
80
done
81
82
# Install license
83
install -d -m 755 "${pkgdir}/usr/share/licenses/${_jdkname}/"
84
install -m 644 ASSEMBLY_EXCEPTION LICENSE THIRD_PARTY_README "${pkgdir}/usr/share/licenses/${_jdkname}"
85
86
# Man pages
87
for f in man/man1/* man/ja/man1/*; do
88
install -Dm 644 "${f}" "${pkgdir}/usr/share/${f/\.1/-$_jdkname.1}"
89
done
90
rm -rf "${pkgdir}/${_jvmdir}/man"
91
ln -s /usr/share/man "${pkgdir}/${_jvmdir}/man"
92
93
# Link JKS keystore from ca-certificates-utils
94
rm -f "${pkgdir}${_jvmdir}/jre/lib/security/cacerts"
95
ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/jre/lib/security/cacerts"
96
}
97
Changes since previous scan
--- PKGBUILD @ 2026-06-19 19:07+++ PKGBUILD @ 2026-08-03 00:08@@ -7,7 +7,7 @@ _jdkname=liberica-jdk-8-full pkgname="${_jdkname}-bin" _java_ver=8-pkgver=8u492+9+pkgver=8u502+9 pkgrel=1 pkgdesc='BellSoft builds of OpenJDK are fully certified and 100% open source Java Development Kits (JDKs) for all Java development and production workloads. Full version includes OpenJFX.' arch=(i686 x86_64)@@ -34,8 +34,8 @@ source_x86_64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-amd64-full.tar.gz) # Upstream-provided-sha1sums_i686=('bf6d47bd22bea9f6ba402db072ba7454c10bdc43')-sha1sums_x86_64=('0996541c65cc6eb0afff14271aaa3b2dbd6e67e1')+sha1sums_i686=('466523aa383b7591dca4cdb9c21216a49199637e')+sha1sums_x86_64=('319fe227404afd474445661e0eb611be2cc080af') _jvmdir="/usr/lib/jvm/${_jdkname}" Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 09:14:07 | MEDIUM | 1 |
| 2026-06-19 19:07:35 | CLEAN | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |