neoforge-server

maintainer hashworks · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt installer JAR from the project's official Maven repository, which is a standard and trusted distribution method for Java-based projects; the source host, while not on a general whitelist, is specific to the project and the download is verified via checksum, making the risk low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt installer JAR from the project's official Maven repository, which is a standard and trusted distribution method for Java-based projects; the source host, while not on a general whitelist, is specific to the project and the download is verified via checksum, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 "https://maven.neoforged.net/releases/net/neoforged/neoforge/${pkgver}/neoforge-${pkgver}-installer.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Justin Kromlinger <hashworks@archlinux.org>
    
      2# Contributor: Brian Elder <gth747m@gmail.com>
    
      3
    
      4pkgname=neoforge-server
    
      5pkgdesc="Neo Modding API for Minecraft, based on Forge"
    
      6url="https://neoforged.net"
    
      7
    
      8# See https://projects.neoforged.net/neoforged/neoforge to select a version
    
      9
    
      10pkgver=21.1.172 # Minecraft version 1.21.1
    
      11pkgrel=2
    
      12_licensever=1.21.x
    
      13_srvpath="/opt"
    
      14
    
      15arch=("any")
    
      16license=("LGPL-2.1-or-later")
    
      17depends=("jdk-openjdk")
    
      18optdepends=("tar: needed in order to create world backups")
    
      19provides=("neoforge-server=${forge_major}.${forge_minor}.${forge_patch}")
    
      20backup=("opt/neoforge-server/banned-ips.json"
    
      21        "opt/neoforge-server/banned-players.json"
    
      22        "opt/neoforge-server/config"
    
      23        "opt/neoforge-server/eula.txt"
    
      24        "opt/neoforge-server/logs"
    
      25        "opt/neoforge-server/mods"
    
      26        "opt/neoforge-server/ops.json"
    
      27        "opt/neoforge-server/server.properties"
    
      28        "opt/neoforge-server/usercache.json"
    
      29        "opt/neoforge-server/user_jvm_args.txt"
    
      30        "opt/neoforge-server/whitelist.json"
    
      31        "opt/neoforge-server/world")
    
      32install="neoforge-server.install"
    
      33source=("https://raw.githubusercontent.com/neoforged/NeoForge/refs/heads/${_licensever}/LICENSE.txt"
    
      34        "https://maven.neoforged.net/releases/net/neoforged/neoforge/${pkgver}/neoforge-${pkgver}-installer.jar"
    
      35        "neoforge-server.service"
    
      36        "eula.txt")
    
      37noextract=("neoforge-${pkgver}-installer.jar")
    
      38sha512sums=('d5591535f567c0504f99ef81904646ef370608b6008feaca4310786adbeae06a402d9a283847172241bce679501c39af4c0b271facc6c6ea2d7b7edbc798c1f9'
    
      39            'e6e0cd6d176e4c040229ef0df8150f92e3a916ad5663580f39e8ce7a32ca479efb418f99bed8228be89cfde4310301ee49a23f9216f0aaf672c2105321441166'
    
      40            '51dd56ffa9d6f21f829cdee7f75602f14769ad5ffdd89e4c1700ad0bfd393224a179fcd6cb58a8f94015860d1113047f8058883ee8479a9147666da64576cf39'
    
      41            '68205ffc60327c67a5ebe778598c3350d64b48aad9dacf52fcde435a535a074ba2056db30dff1b18e3c8e38510acd6ececa298b13cd4c4203636560fa4cf70cb')
    
      42
    
      43prepare() {
    
      44    mkdir -p neoforge-server || exit
    
      45}
    
      46
    
      47build() {
    
      48    java -jar "./neoforge-${pkgver}-installer.jar" --installServer ./neoforge-server
    
      49}
    
      50
    
      51package() {
    
      52    install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      53    install -Dm444 "LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      54    install -d "${pkgdir}/${_srvpath}/${pkgname}"
    
      55    install -Dm644 "eula.txt" "${pkgdir}/${_srvpath}/${pkgname}"
    
      56    cp -r "./${pkgname}" "${pkgdir}/${_srvpath}"
    
      57    rm "${pkgdir}/${_srvpath}/${pkgname}/run.bat"
    
      58    install -Dm644 "${srcdir}/neoforge-server.service" "${pkgdir}/usr/lib/systemd/system/neoforge-server.service"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2