openjdk-liberica17-full-bin

maintainer Carlson24 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt Liberica JDK binary from the official bell-sw.com domain, which is the vendor's legitimate distribution site; despite the static analyzer flag for a non-whitelisted host, this is a standard and expected source for the software, and the checksum is provided, making the risk low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Liberica JDK binary from the official bell-sw.com domain, which is the vendor's legitimate distribution site; despite the static analyzer flag for a non-whitelisted host, this is a standard and expected source for the software, and the checksum is provided, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 source=("https://download.bell-sw.com/java/${_jdkver}+${_bellver}/bellsoft-jdk${_jdkver}+${_bellver}-linux-amd64-full.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aubrey Carlson (Carlson) <aubreycarlson24@outlook.com>
    
      2
    
      3_javaver=17
    
      4_bellver=15
    
      5_jdkver=17.0.17
    
      6
    
      7pkgname="openjdk-liberica17-full-bin"
    
      8pkgver="${_javaver}+${_bellver}+${_jdkver}"
    
      9pkgrel=1
    
      10pkgdesc="Liberica ${_javaver} includes LibericaFX, which is based on OpenJFX ${_javaver} and Minimal VM, where suitable."
    
      11arch=('x86_64')
    
      12url='https://https://bell-sw.com/pages/downloads'
    
      13license=('custom')
    
      14depends=('java-environment-common>=3'
    
      15  'java-runtime-common>=3'
    
      16  'ca-certificates-utils')
    
      17provides=("java-environment=${_javaver}"
    
      18  "java-environment-openjdk=${_javaver}"
    
      19  "java-runtime=${_javaver}"
    
      20  "java-runtime-openjdk=${_javaver}"
    
      21  "java-runtime-headless=${_javaver}"
    
      22  "java-runtime-headless-openjdk=${_javaver}"
    
      23  "jre-openjdk=${_javaver}"
    
      24  "jdk-openjdk=${_javaver}"
    
      25  "jre-openjdk-headless=${_javaver}"
    
      26  "java-openjfx=${_javaver}"
    
      27  "java${_javaver}-environment=${_javaver}"
    
      28  "java${_javaver}-environment-openjdk=${_javaver}"
    
      29  "java${_javaver}-runtime=${_javaver}"
    
      30  "java${_javaver}-runtime-openjdk=${_javaver}"
    
      31  "java${_javaver}-runtime-headless=${_javaver}"
    
      32  "java${_javaver}-runtime-headless-openjdk=${_javaver}"
    
      33  "jre${_javaver}-openjdk=${_javaver}"
    
      34  "jdk${_javaver}-openjdk=${_javaver}"
    
      35  "jre${_javaver}-openjdk-headless=${_javaver}"
    
      36  "java${_javaver}-openjfx=${_javaver}")
    
      37source=("https://download.bell-sw.com/java/${_jdkver}+${_bellver}/bellsoft-jdk${_jdkver}+${_bellver}-linux-amd64-full.tar.gz")
    
      38sha1sums=('0806c22845b10ce3d9bbf5574041af87088701c0')
    
      39install="install_${pkgname}.sh"
    
      40
    
      41_jvmdir="/usr/lib/jvm/${pkgname}"
    
      42
    
      43package() {
    
      44  cd ${srcdir}/jdk-${_jdkver}-full
    
      45  install -dm 755 "${pkgdir}${_jvmdir}"
    
      46  cp -a . "${pkgdir}${_jvmdir}"
    
      47
    
      48  # Conf
    
      49  install -dm 755 "${pkgdir}/etc/openjdk-liberica"
    
      50  cp -r conf "${pkgdir}/etc/openjdk-liberica/${pkgname}"
    
      51  rm -r "${pkgdir}${_jvmdir}/conf"
    
      52  ln -s /etc/openjdk-liberica/${pkgname} "${pkgdir}${_jvmdir}/conf"
    
      53
    
      54  # Legal
    
      55  install -dm 755 "${pkgdir}/usr/share/licenses"
    
      56  cp -r legal "${pkgdir}/usr/share/licenses/${pkgname}"
    
      57  rm -r "${pkgdir}${_jvmdir}/legal"
    
      58  ln -s /usr/share/licenses/${pkgname} "${pkgdir}${_jvmdir}/legal"
    
      59
    
      60  # Man pages
    
      61  for f in bin/*; do
    
      62    f=$(basename "${f}")
    
      63    _man=man/man1/"${f}.1"
    
      64    test -f "${_man}" && install -Dm 644 "${_man}" "${pkgdir}/usr/share/man/man1/${f}-bell${_javaver}.1"
    
      65  done
    
      66  rm -r "${pkgdir}${_jvmdir}/man"
    
      67  ln -s /usr/share/man "${pkgdir}${_jvmdir}/man"
    
      68
    
      69  # Link JKS keystore from ca-certificates-utils
    
      70  rm -f "${pkgdir}${_jvmdir}/lib/security/cacerts"
    
      71  ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/lib/security/cacerts"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2