liberica-jdk-8-full-bin

LOW

maintainer Nevuly 4 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt Liberica JDK binaries from BellSoft's official domain (download.bell-sw.com), which is the project's legitimate distribution host; despite the static analyzer flag for non-standard host, this is a normal and trusted source for the software, and the downloads are integrity-verified via upstream-provided SHA1 sums.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Liberica JDK binaries from BellSoft's official domain (download.bell-sw.com), which is the project's legitimate distribution host; despite the static analyzer flag for non-standard host, this is a normal and trusted source for the software, and the downloads are integrity-verified via upstream-provided SHA1 sums.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 source_i686=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-i586-full.tar.gz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yang Jeong Hun (Nevuly) <onyxclover9931@gmail.com>
    
      2# Contributor: Jonathon Fernyhough <jonathon"m2x+dev>
    
      3# Contributor: Sam Guymer <sam at guymer dot me>
    
      4
    
      5# This PKGBUILD adapted from zulu-8-bin
    
      6
    
      7_jdkname=liberica-jdk-8-full
    
      8pkgname="${_jdkname}-bin"
    
      9_java_ver=8
    
      10pkgver=8u513+5
    
      11pkgrel=1
    
      12pkgdesc='BellSoft builds of OpenJDK are fully certified and 100% open source Java Development Kits (JDKs) for all Java development and production workloads. Full version includes OpenJFX.'
    
      13arch=(i686 x86_64)
    
      14url='https://bell-sw.com/'
    
      15license=('custom')
    
      16depends=('java-environment-common=3' 'java-runtime-common>=3' 'ca-certificates-utils')
    
      17optdepends=(ffmpeg freetype2 gtk2 gtk3 libnet)
    
      18provides=(
    
      19  "java-environment=$_java_ver"
    
      20  "java-environment-openjdk=$_java_ver"
    
      21  "java-runtime-headless=$_java_ver"
    
      22  "java-runtime-headless-openjdk=$_java_ver"
    
      23  "java-runtime=$_java_ver"
    
      24  "java-runtime-openjdk=$_java_ver"
    
      25  "liberica-jdk-8-bin=$pkgver"
    
      26  "libercia-jdk-8-full-bin=$pkgver"
    
      27  "liberica-jdk-8-lite-bin=$pkgver"
    
      28  "liberica-jre-8-bin=$pkgver"
    
      29  "liberica-jre-8-full-bin=$pkgver"
    
      30)
    
      31install=$_jdkname.install
    
      32
    
      33source_i686=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-i586-full.tar.gz)
    
      34source_x86_64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-amd64-full.tar.gz)
    
      35
    
      36# Upstream-provided
    
      37sha1sums_i686=('c455a67e2ac5a0880ea6c10240b16d6345b961ea')
    
      38sha1sums_x86_64=('18e1621943027f24ae3dce3211a9aea7faab1c40')
    
      39
    
      40_jvmdir="/usr/lib/jvm/${_jdkname}"
    
      41
    
      42# Upstream config files that should go to etc and get backup
    
      43_conf_files=(
    
      44  amd64/jvm.cfg
    
      45  calendars.properties
    
      46  content-types.properties
    
      47  flavormap.properties
    
      48  images/cursors/cursors.properties
    
      49  logging.properties
    
      50  management/jmxremote.access
    
      51  management/jmxremote.password
    
      52  management/management.properties
    
      53  management/snmp.acl
    
      54  net.properties
    
      55  psfont.properties.ja
    
      56  psfontj2d.properties
    
      57  security/java.policy
    
      58  security/java.security
    
      59  sound.properties
    
      60)
    
      61
    
      62package() {
    
      63  cd jdk${pkgver/+*/}-full
    
      64
    
      65  install -dm 755 "${pkgdir}/${_jvmdir}"
    
      66  cp -a * "${pkgdir}/${_jvmdir}/"
    
      67
    
      68  # copied from java8-openjdk
    
      69
    
      70  # Set config files
    
      71  mv "${pkgdir}${_jvmdir}"/jre/lib/management/jmxremote.password{.template,}
    
      72  mv "${pkgdir}${_jvmdir}"/jre/lib/management/snmp.acl{.template,}
    
      73
    
      74  # Conf
    
      75  install -dm 755 "${pkgdir}/etc/${_jdkname}"
    
      76  for f in "${_conf_files[@]}"; do
    
      77    _file="${_jvmdir}/jre/lib/$f"
    
      78    install -D -m 644 "${pkgdir}${_file}" "${pkgdir}/etc/${_jdkname}/$f"
    
      79    ln -sf "/etc/${_jdkname}/$f" "${pkgdir}${_file}"
    
      80  done
    
      81
    
      82  # Install license
    
      83  install -d -m 755 "${pkgdir}/usr/share/licenses/${_jdkname}/"
    
      84  install -m 644 ASSEMBLY_EXCEPTION LICENSE THIRD_PARTY_README "${pkgdir}/usr/share/licenses/${_jdkname}"
    
      85
    
      86  # Man pages
    
      87  for f in man/man1/* man/ja/man1/*; do
    
      88    install -Dm 644 "${f}" "${pkgdir}/usr/share/${f/\.1/-$_jdkname.1}"
    
      89  done
    
      90  rm -rf "${pkgdir}/${_jvmdir}/man"
    
      91  ln -s /usr/share/man "${pkgdir}/${_jvmdir}/man"
    
      92
    
      93  # Link JKS keystore from ca-certificates-utils
    
      94  rm -f "${pkgdir}${_jvmdir}/jre/lib/security/cacerts"
    
      95  ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/jre/lib/security/cacerts"
    
      96}
    
      97

Changes since previous scan

--- PKGBUILD @ 2026-10-24 00:14
+++ PKGBUILD @ 2026-11-01 00:21
@@ -7,7 +7,7 @@
 _jdkname=liberica-jdk-8-full
 pkgname="${_jdkname}-bin"
 _java_ver=8
-pkgver=8u512+11
+pkgver=8u513+5
 pkgrel=1
 pkgdesc='BellSoft builds of OpenJDK are fully certified and 100% open source Java Development Kits (JDKs) for all Java development and production workloads. Full version includes OpenJFX.'
 arch=(i686 x86_64)
@@ -34,8 +34,8 @@
 source_x86_64=(https://download.bell-sw.com/java/$pkgver/bellsoft-jdk$pkgver-linux-amd64-full.tar.gz)
 
 # Upstream-provided
-sha1sums_i686=('abdfa994c3cc4e6d943f72fa96fe051fc07da7bf')
-sha1sums_x86_64=('d0d5f80d1244fdb61c067377ed3b3aad49180f1e')
+sha1sums_i686=('c455a67e2ac5a0880ea6c10240b16d6345b961ea')
+sha1sums_x86_64=('18e1621943027f24ae3dce3211a9aea7faab1c40')
 
 _jvmdir="/usr/lib/jvm/${_jdkname}"
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 03:49:04	Medium	1
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 13:40:12	Medium	1
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 03:33:54	Medium	1
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2