magma-server-1.16

maintainer artemklevtsov · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a JAR file from a project-owned GitLab instance and a GitHub release tarball, both used to build and install a Minecraft server; the sources are from legitimate project infrastructure, not swappable hosts, and the build process is transparent.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JAR file from a project-owned GitLab instance and a GitHub release tarball, both used to build and install a Minecraft server; the sources are from legitimate project infrastructure, not swappable hosts, and the build process is transparent.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("${pkgname}-${pkgver}-${_rev}.jar"::"https://git.magmafoundation.org/api/v4/projects/8/packages/maven/org/magmafoundation/Magma/${_gamever}-${pkgver}-${_rev}/Magma-${_gamever}-${pkgver}-${_rev}-server.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Artem Klevtsov <a.a.klevtsov@gmail.com>
    
      2
    
      3_pkgname=magma-server
    
      4_gamever=1.16.5
    
      5pkgname=${_pkgname}-${_gamever%.*}
    
      6pkgver=36.2.39
    
      7pkgrel=1
    
      8_rev=c1c5a946
    
      9_mng_ver=1.0.2
    
      10pkgdesc="Magma is the next generation of hybrid minecraft server softwares"
    
      11arch=('any')
    
      12url="https://magmafoundation.org/"
    
      13license=('custom')
    
      14depends=('java-runtime-headless=11' 'tmux' 'sudo' 'bash' 'awk' 'sed')
    
      15optdepends=("tar: needed in order to create world backups"
    
      16	"netcat: required in order to suspend an idle server")
    
      17makedepends=("gettext")
    
      18conflicts=()
    
      19backup=("etc/conf.d/magma-${_gamever%.*}")
    
      20install="${pkgname}.install"
    
      21# See https://launchermeta.mojang.com/mc/game/version_manifest.json for a list of all releases
    
      22source=("${pkgname}-${pkgver}-${_rev}.jar"::"https://git.magmafoundation.org/api/v4/projects/8/packages/maven/org/magmafoundation/Magma/${_gamever}-${pkgver}-${_rev}/Magma-${_gamever}-${pkgver}-${_rev}-server.jar"
    
      23	"minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz")
    
      24noextract=("${pkgname}-${pkgver}-${_rev}.jar")
    
      25sha512sums=('c954def2b70694e6669e92d1710180b5b92ca1de6c16d2efd9205a1fc8aa71cb26c4144451538f76597ca32efaab533e0cf83115654073a621665f9298108b11'
    
      26            '11d708d511b63e5541bcc1dbcaf29abbf7cb9583b1d313028770a39b26b41d48dcba023f7e1d6fe30f3c093d20e10a43363011edd432e5785a4580e5c5f852a6')
    
      27
    
      28_game="magma-${_gamever%.*}"
    
      29_user="${_game//./-}"
    
      30_server_root="/srv/magma-${_gamever%.*}"
    
      31
    
      32prepare() {
    
      33	export _game
    
      34	export _user
    
      35	export _server_root
    
      36	envsubst < "${startdir}/${pkgname}.install.tmpl" > "${startdir}/${pkgname}.install"
    
      37}
    
      38
    
      39build() {
    
      40	# Detect JAVA home
    
      41	JAVA_HOME="/usr/lib/jvm/$(archlinux-java status | tail -n +2 | cut -d ' ' -f 3 | grep '11-')"
    
      42
    
      43	make -C "${srcdir}/minecraft-server-${_mng_ver}" clean
    
      44
    
      45	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      46		GAME=${_game} \
    
      47		INAME=${_game}d \
    
      48		SERVER_ROOT=${_server_root} \
    
      49		BACKUP_PATHS="world world_nether world_the_end" \
    
      50		GAME_USER=${_user} \
    
      51		SESSION_NAME="magma" \
    
      52		MAIN_EXECUTABLE="${_pkgname}.jar" \
    
      53		SERVER_START_CMD="${JAVA_HOME}/bin/java -Xms512M -Xmx1024M -jar ./${_pkgname}.jar nogui" \
    
      54		all
    
      55}
    
      56
    
      57package() {
    
      58	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      59		DESTDIR="${pkgdir}" \
    
      60		GAME=${_game} \
    
      61		INAME=${_game}d \
    
      62		install
    
      63
    
      64	install -Dm644 "${pkgname}-${pkgver}-${_rev}.jar" "${pkgdir}${_server_root}/${pkgname}-${pkgver}.jar"
    
      65	# Link server jar file
    
      66	ln -s "${pkgname}-${pkgver}.jar" "${pkgdir}${_server_root}/${_pkgname}.jar"
    
      67
    
      68	# Link the log files
    
      69	mkdir -p "${pkgdir}/var/log/"
    
      70	install -dm2755 "${pkgdir}/${_server_root}/logs"
    
      71	ln -s "${_server_root}/logs" "${pkgdir}/var/log/${_game}"
    
      72
    
      73	# Give the group write permissions and set user or group ID on execution
    
      74	chmod g+ws "${pkgdir}${_server_root}"
    
      75}
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2