openjdk-liberica21-full-bin

LOW

maintainer Carlson24 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a prebuilt Liberica JDK binary from download.bell-sw.com, the official vendor domain, which is not on the whitelist but is plausibly legitimate; installing a vendor-provided binary tarball is normal for AUR JDK packages and poses low risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt Liberica JDK binary from download.bell-sw.com, the official vendor domain, which is not on the whitelist but is plausibly legitimate; installing a vendor-provided binary tarball is normal for AUR JDK packages and poses low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 source=("https://download.bell-sw.com/java/${_jdkver}+${_bellver}/bellsoft-jdk${_jdkver}+${_bellver}-linux-amd64-full.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aubrey Carlson (Carlson) <aubreycarlson24@outlook.com>
    
      2
    
      3_javaver=21
    
      4_bellver=15
    
      5_jdkver=21.0.9
    
      6
    
      7pkgname="openjdk-liberica21-full-bin"
    
      8pkgver="${_javaver}+${_bellver}+${_jdkver}"
    
      9pkgrel=1
    
      10pkgdesc="Liberica ${_javaver} includes LibericaFX, which is based on OpenJFX ${_javaver} and Minimal VM, where suitable."
    
      11arch=('x86_64')
    
      12url='https://https://bell-sw.com/pages/downloads'
    
      13license=('custom')
    
      14depends=('java-environment-common>=3'
    
      15  'java-runtime-common>=3'
    
      16  'ca-certificates-utils')
    
      17provides=("java-environment=${_javaver}"
    
      18  "java-environment-openjdk=${_javaver}"
    
      19  "java-runtime=${_javaver}"
    
      20  "java-runtime-openjdk=${_javaver}"
    
      21  "java-runtime-headless=${_javaver}"
    
      22  "java-runtime-headless-openjdk=${_javaver}"
    
      23  "jre-openjdk=${_javaver}"
    
      24  "jdk-openjdk=${_javaver}"
    
      25  "jre-openjdk-headless=${_javaver}"
    
      26  "java-openjfx=${_javaver}"
    
      27  "java${_javaver}-environment=${_javaver}"
    
      28  "java${_javaver}-environment-openjdk=${_javaver}"
    
      29  "java${_javaver}-runtime=${_javaver}"
    
      30  "java${_javaver}-runtime-openjdk=${_javaver}"
    
      31  "java${_javaver}-runtime-headless=${_javaver}"
    
      32  "java${_javaver}-runtime-headless-openjdk=${_javaver}"
    
      33  "jre${_javaver}-openjdk=${_javaver}"
    
      34  "jdk${_javaver}-openjdk=${_javaver}"
    
      35  "jre${_javaver}-openjdk-headless=${_javaver}"
    
      36  "java${_javaver}-openjfx=${_javaver}")
    
      37source=("https://download.bell-sw.com/java/${_jdkver}+${_bellver}/bellsoft-jdk${_jdkver}+${_bellver}-linux-amd64-full.tar.gz")
    
      38sha1sums=('a3083b5adcd93b67e2f5a2276c92fad1916d53ec')
    
      39install="install_${pkgname}.sh"
    
      40
    
      41_jvmdir="/usr/lib/jvm/${pkgname}"
    
      42
    
      43package() {
    
      44  cd ${srcdir}/jdk-${_jdkver}-full
    
      45  install -dm 755 "${pkgdir}${_jvmdir}"
    
      46  cp -a . "${pkgdir}${_jvmdir}"
    
      47
    
      48  # Conf
    
      49  install -dm 755 "${pkgdir}/etc/openjdk-liberica"
    
      50  cp -r conf "${pkgdir}/etc/openjdk-liberica/${pkgname}"
    
      51  rm -r "${pkgdir}${_jvmdir}/conf"
    
      52  ln -s /etc/openjdk-liberica/${pkgname} "${pkgdir}${_jvmdir}/conf"
    
      53
    
      54  # Legal
    
      55  install -dm 755 "${pkgdir}/usr/share/licenses"
    
      56  cp -r legal "${pkgdir}/usr/share/licenses/${pkgname}"
    
      57  rm -r "${pkgdir}${_jvmdir}/legal"
    
      58  ln -s /usr/share/licenses/${pkgname} "${pkgdir}${_jvmdir}/legal"
    
      59
    
      60  # Man pages
    
      61  for f in bin/*; do
    
      62    f=$(basename "${f}")
    
      63    _man=man/man1/"${f}.1"
    
      64    test -f "${_man}" && install -Dm 644 "${_man}" "${pkgdir}/usr/share/man/man1/${f}-bell${_javaver}.1"
    
      65  done
    
      66  rm -r "${pkgdir}${_jvmdir}/man"
    
      67  ln -s /usr/share/man "${pkgdir}${_jvmdir}/man"
    
      68
    
      69  # Link JKS keystore from ca-certificates-utils
    
      70  rm -f "${pkgdir}${_jvmdir}/lib/security/cacerts"
    
      71  ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/lib/security/cacerts"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2