mangatan-extension-server

CLEAN

maintainer scrubeye 0 votes scanned 2026-08-30 00:04:14.825026

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from a source bundle hosted on the project's official GitHub repository, extracts a single JAR file, and links to the system JRE; all actions are transparent, verifiable, and follow standard AUR practices for packaging portable Java applications.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: Autumn (Bee) <10378052+bee-san at users dot noreply dot github dot com>
    
      2
    
      3pkgname=mangatan-extension-server
    
      4pkgver=1.0.6.3
    
      5pkgrel=1
    
      6pkgdesc="Headless Mihon extension server for Mangatan (Mihon bridge)"
    
      7# The JAR is byte-identical in the upstream Linux, macOS and Windows bundles and
    
      8# ships JNI natives for every architecture, so it is portable as-is.
    
      9arch=('any')
    
      10url="https://github.com/1Selxo/M-Extension-Server"
    
      11license=('MPL-2.0')
    
      12
    
      13makedepends=('libarchive')
    
      14# Pin the runtime rather than using java-runtime>=21: only jre21-openjdk (or
    
      15# jdk21-openjdk, which provides it) guarantees the exact interpreter path linked
    
      16# below. A newer JVM satisfies java-runtime>=21 but installs elsewhere, which
    
      17# would leave that symlink dangling.
    
      18depends=('jre21-openjdk')
    
      19
    
      20_bundle="${pkgname}-${pkgver}-bundle.zip"
    
      21_jar="MExtensionServer-v${pkgver}.jar"
    
      22_serverdir="usr/share/mangatan/extension_server"
    
      23
    
      24source=(
    
      25  "${_bundle}::${url}/releases/download/v${pkgver}/linux-x64-bundle.zip"
    
      26  "LICENSE-${pkgver}::https://raw.githubusercontent.com/1Selxo/M-Extension-Server/v${pkgver}/LICENSE"
    
      27)
    
      28# Upstream publishes no standalone JAR asset, only the four ~135 MiB platform
    
      29# bundles. Skip the automatic extraction so the vendored JRE inside never lands
    
      30# on disk; prepare() pulls out the one file this package installs.
    
      31noextract=("${_bundle}")
    
      32
    
      33sha256sums=(
    
      34  '4a8f4c3407de8b5b493f49b471748eafef324903486a63436c102bcaa912db44'
    
      35  '3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04'
    
      36)
    
      37
    
      38prepare() {
    
      39  # bsdtar fails on a pattern that matches nothing, but a pattern matching two
    
      40  # entries would concatenate them into one corrupt file and still exit 0, so
    
      41  # require exactly one match before extracting rather than after.
    
      42  local matches
    
      43  matches=$(bsdtar --list --file "${_bundle}" 'MExtensionServer-*.jar' | wc -l)
    
      44  if (( matches != 1 )); then
    
      45    printf 'Expected exactly one MExtensionServer JAR in %s, matched %s\n' \
    
      46      "${_bundle}" "${matches}" >&2
    
      47    return 1
    
      48  fi
    
      49
    
      50  # Renamed from the upstream MExtensionServer-v<ver>-r1.jar: Mangatan only
    
      51  # requires the MExtensionServer- prefix, the .jar suffix and a parseable
    
      52  # version in the basename, so dropping the build-number suffix keeps the
    
      53  # packaged name stable if upstream bumps it.
    
      54  bsdtar --extract --to-stdout --file "${_bundle}" 'MExtensionServer-*.jar' \
    
      55    > "${_jar}"
    
      56
    
      57  if (( $(stat -c %s "${_jar}") < 10000000 )); then
    
      58    printf 'Extracted %s is implausibly small\n' "${_jar}" >&2
    
      59    return 1
    
      60  fi
    
      61}
    
      62
    
      63package() {
    
      64  install -Dm644 "${srcdir}/${_jar}" "${pkgdir}/${_serverdir}/${_jar}"
    
      65
    
      66  # Mangatan looks for the interpreter at exactly <root>/jre/jre/bin/java, the
    
      67  # layout of the upstream bundle it normally downloads. Linking the system JRE
    
      68  # there lets the app adopt this install with no folder picking, and keeps the
    
      69  # ~135 MiB vendored runtime out of the package.
    
      70  install -dm755 "${pkgdir}/${_serverdir}/jre/jre/bin"
    
      71  ln -s /usr/lib/jvm/java-21-openjdk/bin/java \
    
      72    "${pkgdir}/${_serverdir}/jre/jre/bin/java"
    
      73
    
      74  install -Dm644 "${srcdir}/LICENSE-${pkgver}" \
    
      75    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      76}
    
      77

Changes since previous scan

--- PKGBUILD @ 2026-08-18 00:03
+++ PKGBUILD @ 2026-08-30 00:04
@@ -1,7 +1,7 @@
 # Maintainer: Autumn (Bee) <10378052+bee-san at users dot noreply dot github dot com>
 
 pkgname=mangatan-extension-server
-pkgver=1.0.6.2
+pkgver=1.0.6.3
 pkgrel=1
 pkgdesc="Headless Mihon extension server for Mangatan (Mihon bridge)"
 # The JAR is byte-identical in the upstream Linux, macOS and Windows bundles and
@@ -31,7 +31,7 @@
 noextract=("${_bundle}")
 
 sha256sums=(
-  '2570c062b06f7c81d483d7ee91132938474838ffd9fefbfcd2324230399eae03'
+  '4a8f4c3407de8b5b493f49b471748eafef324903486a63436c102bcaa912db44'
   '3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04'
 )
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-30 00:04:14	Clean	2
2026-08-29 23:41:07	Low	1
2026-08-18 00:03:42	Clean	2
2026-08-17 23:38:16	Low	1