lombok-eclipse-java
LOW
maintainer Musikolo
3 votes
base
lombok
scanned 2026-10-17 00:21:55.226236
Why flagged
The source is a JAR file from the official projectlombok.org domain, which is the project's own release infrastructure; building and installing the project's own unexecuted source artifact is normal AUR packaging behavior.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a JAR file from the official projectlombok.org domain, which is the project's own release infrastructure; building and installing the project's own unexecuted source artifact is normal AUR packaging behavior.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
source=("https://projectlombok.org/downloads/lombok-${pkgver}.jar"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Musikolo <musikolo {at} hotmail [dot] com>
2
# Contributor: Infernio <infernio at icloud dot com>
3
# Contributor: BluePeril <blueperil (at) blueperil _dot_ de>
4
5
pkgbase="lombok"
6
pkgname=('lombok-common' 'lombok-eclipse-java' 'lombok-eclipse-jee' 'lombok-spring-tools-for-eclipse')
7
pkgver=1.18.48
8
pkgrel=1
9
pkgdesc="Project Lombok integrated with several Eclipse-based installations."
10
makedepends=('java-runtime')
11
arch=("any")
12
url="https://projectlombok.org"
13
license=('MIT')
14
source=("https://projectlombok.org/downloads/lombok-${pkgver}.jar"
15
'lombok-eclipse.install'
16
'lombok-st4e.install')
17
sha256sums=('85477a4655ebb2c074a9099cfb749be454449fee564d4282610df1b85f7c508b'
18
'bbf61e76d08d23045c9c78869650e3741b22b7e197032e3c6ffdaa4c6582dd8a'
19
'5da2cd360808c724b5d26ac5451a9c9c905c5ac99d35ccd7718bd414a0456e81')
20
noextract=("lombok.jar")
21
22
build() {
23
java -jar lombok-$pkgver.jar publicApi
24
}
25
26
package_lombok-common() {
27
replaces=('lombok-eclipse')
28
conflicts=('lombok-eclipse')
29
install -Dm644 lombok-$pkgver.jar "${pkgdir}"/usr/lib/$pkgname/lombok.jar
30
install -Dm644 lombok-api.jar "${pkgdir}"/usr/lib/$pkgname/lombok-api.jar
31
install -Dm644 LICENSE "${pkgdir}"/usr/share/licenses/$pkgname/LICENSE
32
}
33
34
package_lombok-eclipse-java() {
35
pkgdesc="Lombok integration with Eclipse IDE for Java Developers."
36
depends=(lombok-common=$pkgver-$pkgrel 'eclipse-java-bin')
37
install=lombok-eclipse.install
38
}
39
40
package_lombok-eclipse-jee() {
41
pkgdesc="Lombok integration with Eclipse IDE for Java EE Developers."
42
depends=(lombok-common=$pkgver-$pkgrel 'eclipse-jee-bin')
43
install=lombok-eclipse.install
44
}
45
46
package_lombok-spring-tools-for-eclipse() {
47
pkgdesc="Lombok integration with Spring Tools (aka Spring Tool Suite)."
48
depends=(lombok-common=$pkgver-$pkgrel 'spring-tools-for-eclipse>=5.0.0')
49
provides=('lombok-spring-tool-suite')
50
conflicts=('lombok-spring-tool-suite')
51
install=lombok-st4e.install
52
}
53
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |