neoforge-server

LOW

maintainer hashworks 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt installer JAR from the project's official Maven repository, which is a standard and trusted distribution method for Java-based projects; the source host, while not on a general whitelist, is specific to the project and the download is verified via checksum, making the risk low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt installer JAR from the project's official Maven repository, which is a standard and trusted distribution method for Java-based projects; the source host, while not on a general whitelist, is specific to the project and the download is verified via checksum, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 "https://maven.neoforged.net/releases/net/neoforged/neoforge/${pkgver}/neoforge-${pkgver}-installer.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Justin Kromlinger <hashworks@archlinux.org>
    
      2# Contributor: Brian Elder <gth747m@gmail.com>
    
      3
    
      4pkgname=neoforge-server
    
      5pkgdesc="Neo Modding API for Minecraft, based on Forge"
    
      6url="https://neoforged.net"
    
      7
    
      8# See https://projects.neoforged.net/neoforged/neoforge to select a version
    
      9
    
      10pkgver=21.1.172 # Minecraft version 1.21.1
    
      11pkgrel=2
    
      12_licensever=1.21.x
    
      13_srvpath="/opt"
    
      14
    
      15arch=("any")
    
      16license=("LGPL-2.1-or-later")
    
      17depends=("jdk-openjdk")
    
      18optdepends=("tar: needed in order to create world backups")
    
      19provides=("neoforge-server=${forge_major}.${forge_minor}.${forge_patch}")
    
      20backup=("opt/neoforge-server/banned-ips.json"
    
      21        "opt/neoforge-server/banned-players.json"
    
      22        "opt/neoforge-server/config"
    
      23        "opt/neoforge-server/eula.txt"
    
      24        "opt/neoforge-server/logs"
    
      25        "opt/neoforge-server/mods"
    
      26        "opt/neoforge-server/ops.json"
    
      27        "opt/neoforge-server/server.properties"
    
      28        "opt/neoforge-server/usercache.json"
    
      29        "opt/neoforge-server/user_jvm_args.txt"
    
      30        "opt/neoforge-server/whitelist.json"
    
      31        "opt/neoforge-server/world")
    
      32install="neoforge-server.install"
    
      33source=("https://raw.githubusercontent.com/neoforged/NeoForge/refs/heads/${_licensever}/LICENSE.txt"
    
      34        "https://maven.neoforged.net/releases/net/neoforged/neoforge/${pkgver}/neoforge-${pkgver}-installer.jar"
    
      35        "neoforge-server.service"
    
      36        "eula.txt")
    
      37noextract=("neoforge-${pkgver}-installer.jar")
    
      38sha512sums=('d5591535f567c0504f99ef81904646ef370608b6008feaca4310786adbeae06a402d9a283847172241bce679501c39af4c0b271facc6c6ea2d7b7edbc798c1f9'
    
      39            'e6e0cd6d176e4c040229ef0df8150f92e3a916ad5663580f39e8ce7a32ca479efb418f99bed8228be89cfde4310301ee49a23f9216f0aaf672c2105321441166'
    
      40            '51dd56ffa9d6f21f829cdee7f75602f14769ad5ffdd89e4c1700ad0bfd393224a179fcd6cb58a8f94015860d1113047f8058883ee8479a9147666da64576cf39'
    
      41            '68205ffc60327c67a5ebe778598c3350d64b48aad9dacf52fcde435a535a074ba2056db30dff1b18e3c8e38510acd6ececa298b13cd4c4203636560fa4cf70cb')
    
      42
    
      43prepare() {
    
      44    mkdir -p neoforge-server || exit
    
      45}
    
      46
    
      47build() {
    
      48    java -jar "./neoforge-${pkgver}-installer.jar" --installServer ./neoforge-server
    
      49}
    
      50
    
      51package() {
    
      52    install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      53    install -Dm444 "LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      54    install -d "${pkgdir}/${_srvpath}/${pkgname}"
    
      55    install -Dm644 "eula.txt" "${pkgdir}/${_srvpath}/${pkgname}"
    
      56    cp -r "./${pkgname}" "${pkgdir}/${_srvpath}"
    
      57    rm "${pkgdir}/${_srvpath}/${pkgname}/run.bat"
    
      58    install -Dm644 "${srcdir}/neoforge-server.service" "${pkgdir}/usr/lib/systemd/system/neoforge-server.service"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2