paper-velocity

maintainer yuna0x0 · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt JAR from a non-whitelisted but project-related host (papermc.io) with a pinned checksum, and installs management scripts via make; the privileged actions are standard file ownership/permissions setup for a service, not self-updates or setuid binaries.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt JAR from a non-whitelisted but project-related host (papermc.io) with a pinned checksum, and installs management scripts via make; the privileged actions are standard file ownership/permissions setup for a service, not self-updates or setuid binaries.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("velocity.${pkgver}.jar"::"https://fill-data.papermc.io/v1/objects/${_jar_sha256}/velocity-${_pkgver}-${_build}.jar"

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:63 chmod g+s "${pkgdir}${_server_root}"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: yuna0x0 <yuna@yuna0x0.com>
    
      2
    
      3# Based on the 'papermc' AUR package by:
    
      4## Maintainer: Gordian Edenhofer <gordian.edenhofer@gmail.com>
    
      5
    
      6pkgname=paper-velocity
    
      7# curl -s "https://fill.papermc.io/v3/projects/velocity" | python3 -m json.tool
    
      8_pkgver=3.5.0-SNAPSHOT
    
      9# curl -s "https://fill.papermc.io/v3/projects/velocity/versions/${_pkgver}" | python3 -m json.tool
    
      10_build=605
    
      11# curl -s "https://fill.papermc.io/v3/projects/velocity/versions/${_pkgver}/builds/${_build}" | python3 -m json.tool
    
      12_jar_sha256=0ec616020166465dacca3b790d3db2b246f8f7c13b3aaacaae60c825744a66e0
    
      13pkgver="${_pkgver//-/_}+b${_build}"
    
      14pkgrel=1
    
      15_mng_ver=1.0.0
    
      16pkgdesc="The modern, next-generation Minecraft server proxy."
    
      17arch=('any')
    
      18url="https://papermc.io/software/velocity"
    
      19license=('GPL-3.0-or-later')
    
      20depends=('java-runtime-headless>=16' 'tmux' 'sudo' 'bash' 'awk' 'sed')
    
      21optdepends=("netcat: required in order to suspend an idle server")
    
      22conflicts=('paper-velocity-git')
    
      23backup=('etc/conf.d/velocity')
    
      24install="${pkgname}.install"
    
      25source=("velocity.${pkgver}.jar"::"https://fill-data.papermc.io/v1/objects/${_jar_sha256}/velocity-${_pkgver}-${_build}.jar"
    
      26	"velocity-proxy-mgmt-${_mng_ver}.tar.gz"::"https://github.com/yuna0x0/velocity-proxy-mgmt/archive/refs/tags/v${_mng_ver}.tar.gz")
    
      27noextract=("velocity.${pkgver}.jar")
    
      28sha256sums=("${_jar_sha256}"
    
      29            '5b22bc55f350382e5c6e2b88c4a51247316814eb73fe3e9b8a45a265d3619ac8')
    
      30
    
      31_game="velocity"
    
      32_server_root="/srv/velocity"
    
      33
    
      34build() {
    
      35	make -C "${srcdir}/velocity-proxy-mgmt-${_mng_ver}" clean
    
      36
    
      37	make -C "${srcdir}/velocity-proxy-mgmt-${_mng_ver}" \
    
      38		GAME=${_game} \
    
      39		INAME=${_game} \
    
      40		SERVER_ROOT=${_server_root} \
    
      41		GAME_USER=${_game} \
    
      42		MAIN_EXECUTABLE=velocity.jar \
    
      43		SERVER_START_CMD="java -Xms1G -Xmx1G -XX:+UseG1GC -XX:G1HeapRegionSize=4M -XX:+UnlockExperimentalVMOptions -XX:+ParallelRefProcEnabled -XX:+AlwaysPreTouch -XX:MaxInlineLevel=15 -jar ./velocity.jar" \
    
      44		all
    
      45}
    
      46
    
      47package() {
    
      48	make -C "${srcdir}/velocity-proxy-mgmt-${_mng_ver}" \
    
      49		DESTDIR="${pkgdir}" \
    
      50		GAME=${_game} \
    
      51		INAME=${_game} \
    
      52		install
    
      53
    
      54	install -Dm644 ${_game}.${pkgver}.jar     "${pkgdir}/${_server_root}/${_game}.${pkgver}.jar"
    
      55	ln -s "${_game}.${pkgver}.jar" "${pkgdir}${_server_root}/${_game}.jar"
    
      56
    
      57	# Link the log files
    
      58	mkdir -p "${pkgdir}/var/log/"
    
      59	install -dm2755 "${pkgdir}/${_server_root}/logs"
    
      60	ln -s "${_server_root}/logs" "${pkgdir}/var/log/${_game}"
    
      61
    
      62	# Give the group write permissions and set user or group ID on execution
    
      63	chmod g+s "${pkgdir}${_server_root}"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3