magma-server-1.19
maintainer artemklevtsov
· 1 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a prebuilt JAR from the project's own Git instance and a GitHub release tarball; both are from plausibly official sources, and the JAR is not executed during build but installed as data, making the risk low despite the non-whitelisted host.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt JAR from the project's own Git instance and a GitHub release tarball; both are from plausibly official sources, and the JAR is not executed during build but installed as data, making the risk low despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
source=("${pkgname}-${pkgver}-${_rev}.jar"::"https://git.magmafoundation.org/api/v4/projects/103/packages/maven/org/magmafoundation/Magma/${_gamever}-${pkgver}-${_rev}/Magma-${_gamever}-${pkgver}-${_rev}-server.jar"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Artem Klevtsov <a.a.klevtsov@gmail.com>
2
3
_pkgname=magma-server
4
_gamever=1.19.3
5
pkgname=${_pkgname}-${_gamever%.*}
6
pkgver=44.1.23
7
pkgrel=1
8
_rev=3a0ff713
9
_mng_ver=1.0.2
10
pkgdesc="Magma is the next generation of hybrid minecraft server softwares"
11
arch=('any')
12
url="https://magmafoundation.org/"
13
license=('custom')
14
depends=('java-runtime-headless>=16' 'tmux' 'sudo' 'bash' 'awk' 'sed')
15
optdepends=("tar: needed in order to create world backups"
16
"netcat: required in order to suspend an idle server")
17
makedepends=("gettext")
18
conflicts=()
19
backup=("etc/conf.d/magma-${_gamever%.*}")
20
install="${pkgname}.install"
21
# See https://launchermeta.mojang.com/mc/game/version_manifest.json for a list of all releases
22
source=("${pkgname}-${pkgver}-${_rev}.jar"::"https://git.magmafoundation.org/api/v4/projects/103/packages/maven/org/magmafoundation/Magma/${_gamever}-${pkgver}-${_rev}/Magma-${_gamever}-${pkgver}-${_rev}-server.jar"
23
"minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz")
24
noextract=("${pkgname}-${pkgver}-${_rev}.jar")
25
sha512sums=('6d0d4e0461243a6862ca19123f62b5058157f318d74a6971c5c6e9bff2837cb84d2fc4a6d8d513163e5742a4df74ef498ed48454ae837fb2eb8ecc571280af9d'
26
'11d708d511b63e5541bcc1dbcaf29abbf7cb9583b1d313028770a39b26b41d48dcba023f7e1d6fe30f3c093d20e10a43363011edd432e5785a4580e5c5f852a6')
27
28
_game="magma-${_gamever%.*}"
29
_user="${_game//./-}"
30
_server_root="/srv/magma-${_gamever%.*}"
31
32
prepare() {
33
export _game
34
export _user
35
export _server_root
36
envsubst < "${startdir}/${pkgname}.install.tmpl" > "${startdir}/${pkgname}.install"
37
}
38
39
build() {
40
make -C "${srcdir}/minecraft-server-${_mng_ver}" clean
41
42
make -C "${srcdir}/minecraft-server-${_mng_ver}" \
43
GAME=${_game} \
44
INAME=${_game}d \
45
SERVER_ROOT=${_server_root} \
46
BACKUP_PATHS="world world_nether world_the_end" \
47
GAME_USER=${_user} \
48
SESSION_NAME="magma" \
49
MAIN_EXECUTABLE="${_pkgname}.jar" \
50
SERVER_START_CMD="java -Xms512M -Xmx1024M -jar ./${_pkgname}.jar nogui" \
51
all
52
}
53
54
package() {
55
make -C "${srcdir}/minecraft-server-${_mng_ver}" \
56
DESTDIR="${pkgdir}" \
57
GAME=${_game} \
58
INAME=${_game}d \
59
install
60
61
install -Dm644 "${pkgname}-${pkgver}-${_rev}.jar" "${pkgdir}${_server_root}/${pkgname}-${pkgver}.jar"
62
# Link server jar file
63
ln -s "${pkgname}-${pkgver}.jar" "${pkgdir}${_server_root}/${_pkgname}.jar"
64
65
# Link the log files
66
mkdir -p "${pkgdir}/var/log/"
67
install -dm2755 "${pkgdir}/${_server_root}/logs"
68
ln -s "${_server_root}/logs" "${pkgdir}/var/log/${_game}"
69
70
# Give the group write permissions and set user or group ID on execution
71
chmod g+ws "${pkgdir}${_server_root}"
72
}
73
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |