native-image-jdk11-ee-bin

MEDIUM

maintainer orphaned 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The source is a prebuilt binary JAR (GraalVM Enterprise Edition native-image component) that gets installed directly into the JVM directory and executed as part of the GraalVM toolchain. The concern is real but nuanced: (1) Oracle requires authentication to download this file, so the maintainer archived it on web.archive.org as a workaround — this is a common AUR pattern for login-gated Oracle downloads; (2) web.archive.org is a well-known, reputable archival service, not a personal or sketchy host, and the Wayback Machine does not allow content modification after archival; (3) a sha256 checksum is provided and verified, which substantially mitigates substitution risk; (4) however, the file is a prebuilt binary (JAR containing native executables/libraries) from an unofficial redistribution point rather than directly from Oracle, and it is installed into the JVM directory where it will be executed. The combination of: prebuilt binary content, non-official distribution host (even if reputable), and Oracle EE license terms (which prohibit redistribution) keeps this at MEDIUM. The cheaper model's reasoning is directionally correct — this is a genuine supply-chain concern for executed binary content from a non-official host — though the risk is mitigated by the checksum and web.archive.org's immutability guarantees.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("${pkgname_}-installable-svmee-java${java_}-linux-amd64-${pkgver}.jar::https://web.archive.org/web/20200228083230/https%3A%2F%2Fdownload.oracle.com%2Fotn%2Futilities_drivers%2Foracle-labs%2Fnative-image-installable-svm-svmee-java11-linux-amd64-20.0.0.jar%3FAuthParam%3D1582878853_656f39126124eddc70c07568cddaf024")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source is a prebuilt binary JAR (GraalVM Enterprise Edition native-image component) that gets installed directly into the JVM directory and executed as part of the GraalVM toolchain. The concern is real but nuanced: (1) Oracle requires authentication to download this file, so the maintainer archived it on web.archive.org as a workaround — this is a common AUR pattern for login-gated Oracle downloads; (2) web.archive.org is a well-known, reputable archival service, not a personal or sketchy host, and the Wayback Machine does not allow content modification after archival; (3) a sha256 checksum is provided and verified, which substantially mitigates substitution risk; (4) however, the file is a prebuilt binary (JAR containing native executables/libraries) from an unofficial redistribution point rather than directly from Oracle, and it is installed into the JVM directory where it will be executed. The combination of: prebuilt binary content, non-official distribution host (even if reputable), and Oracle EE license terms (which prohibit redistribution) keeps this at MEDIUM. The cheaper model's reasoning is directionally correct — this is a genuine supply-chain concern for executed binary content from a non-official host — though the risk is mitigated by the checksum and web.archive.org's immutability guarantees.

PKGBUILD

1 offending line(s) highlighted

      1java_=11
    
      2pkgname_=native-image
    
      3pkgname="${pkgname_}-jdk${java_}-ee-bin"
    
      4pkgver=20.0.0
    
      5pkgrel=1
    
      6pkgdesc="(Enterprise Edition) Plugin to turn GraalVM-based applications into native binary images (Java ${java_} version)"
    
      7arch=('x86_64')
    
      8url='https://github.com/oracle/graal'
    
      9license=('custom')
    
      10depends=("jdk${java_}-graalvm-ee-bin")
    
      11# Oracle requires login to download. Downloaded from https://www.oracle.com/tools/graalvm-enterprise-edition.html
    
      12source_x86_64=("${pkgname_}-installable-svmee-java${java_}-linux-amd64-${pkgver}.jar::https://web.archive.org/web/20200228083230/https%3A%2F%2Fdownload.oracle.com%2Fotn%2Futilities_drivers%2Foracle-labs%2Fnative-image-installable-svm-svmee-java11-linux-amd64-20.0.0.jar%3FAuthParam%3D1582878853_656f39126124eddc70c07568cddaf024")
    
      13sha256sums_x86_64=('57086123a95f1e9d4e67b92f830bad9325431908c69a40ef10f28ed586d8bd35')
    
      14
    
      15package() {
    
      16    local file eq permissions mode name target
    
      17
    
      18    mkdir -p "$pkgdir/usr/lib/jvm/java-${java_}-graalvm-ee/"
    
      19    cp -a -t "$pkgdir/usr/lib/jvm/java-${java_}-graalvm-ee/" lib/ LICENSE_NATIVEIMAGE.txt
    
      20
    
      21    printf '\n' >> META-INF/permissions
    
      22    while read -r file eq permissions; do
    
      23        if [[ $eq != '=' ]]; then
    
      24            printf >&2 'second word should be "=": %s %s %s\n' "$file" "$eq" "$permissions"
    
      25            return 1
    
      26        fi
    
      27        case $permissions in
    
      28            'rw-------') mode=600;;
    
      29            'rw-r--r--') mode=644;;
    
      30            'rw-rw-r--') mode=664;;
    
      31            'rwxr-xr-x') mode=755;;
    
      32            'rwxrwxr-x') mode=775;;
    
      33            'rwxrwxrwx') continue;; # symbolic link
    
      34            *)
    
      35                printf >&2 'unknown permissions: %s\n' "$permissions"
    
      36                return 1
    
      37                ;;
    
      38        esac
    
      39        chmod "$mode" -- "$pkgdir/usr/lib/jvm/java-${java_}-graalvm-ee/$file"
    
      40    done < META-INF/permissions
    
      41
    
      42    printf '\n' >> META-INF/symlinks
    
      43    while read -r name eq target; do
    
      44        if [[ $eq != '=' ]]; then
    
      45            printf >&2 'second word should be "=": %s %s %s\n' "$name" "$eq" "$target"
    
      46            return 1
    
      47        fi
    
      48        mkdir -p -- "$pkgdir/usr/lib/jvm/java-${java_}-graalvm-ee/$(dirname -- "$name")"
    
      49        ln -s -- "$target" "$pkgdir/usr/lib/jvm/java-${java_}-graalvm-ee/$name"
    
      50    done < META-INF/symlinks
    
      51
    
      52    install -DTm644 LICENSE_NATIVEIMAGE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2