paper-velocity

LOW

maintainer yuna0x0 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package builds and installs a management script from a trusted GitHub repository and a prebuilt JAR from PaperMC's official object storage; the JAR's checksum is verified, and the install creates proper symlinks and permissions for a Minecraft proxy service without executing untrusted remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds and installs a management script from a trusted GitHub repository and a prebuilt JAR from PaperMC's official object storage; the JAR's checksum is verified, and the install creates proper symlinks and permissions for a Minecraft proxy service without executing untrusted remote code.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("velocity.${pkgver}.jar"::"https://fill-data.papermc.io/v1/objects/${_jar_sha256}/velocity-${_pkgver}-${_build}.jar"

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:63 chmod g+s "${pkgdir}${_server_root}"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: yuna0x0 <yuna@yuna0x0.com>
    
      2
    
      3# Based on the 'papermc' AUR package by:
    
      4## Maintainer: Gordian Edenhofer <gordian.edenhofer@gmail.com>
    
      5
    
      6pkgname=paper-velocity
    
      7# curl -s "https://fill.papermc.io/v3/projects/velocity" | python3 -m json.tool
    
      8_pkgver=4.1.0-SNAPSHOT
    
      9# curl -s "https://fill.papermc.io/v3/projects/velocity/versions/${_pkgver}" | python3 -m json.tool
    
      10_build=16
    
      11# curl -s "https://fill.papermc.io/v3/projects/velocity/versions/${_pkgver}/builds/${_build}" | python3 -m json.tool
    
      12_jar_sha256=aebade8be3b15d7c3c61514a50ce857cbf78ee87bd32e8d16d2352c6ca3e472f
    
      13pkgver="${_pkgver//-/_}+b${_build}"
    
      14pkgrel=1
    
      15_mng_ver=1.0.0
    
      16pkgdesc="The modern, next-generation Minecraft server proxy."
    
      17arch=('any')
    
      18url="https://papermc.io/software/velocity"
    
      19license=('GPL-3.0-or-later')
    
      20depends=('java-runtime-headless>=25' 'tmux' 'sudo' 'bash' 'awk' 'sed')
    
      21optdepends=("netcat: required in order to suspend an idle server")
    
      22conflicts=('paper-velocity-git')
    
      23backup=('etc/conf.d/velocity')
    
      24install="${pkgname}.install"
    
      25source=("velocity.${pkgver}.jar"::"https://fill-data.papermc.io/v1/objects/${_jar_sha256}/velocity-${_pkgver}-${_build}.jar"
    
      26	"velocity-proxy-mgmt-${_mng_ver}.tar.gz"::"https://github.com/yuna0x0/velocity-proxy-mgmt/archive/refs/tags/v${_mng_ver}.tar.gz")
    
      27noextract=("velocity.${pkgver}.jar")
    
      28sha256sums=("${_jar_sha256}"
    
      29            '5b22bc55f350382e5c6e2b88c4a51247316814eb73fe3e9b8a45a265d3619ac8')
    
      30
    
      31_game="velocity"
    
      32_server_root="/srv/velocity"
    
      33
    
      34build() {
    
      35	make -C "${srcdir}/velocity-proxy-mgmt-${_mng_ver}" clean
    
      36
    
      37	make -C "${srcdir}/velocity-proxy-mgmt-${_mng_ver}" \
    
      38		GAME=${_game} \
    
      39		INAME=${_game} \
    
      40		SERVER_ROOT=${_server_root} \
    
      41		GAME_USER=${_game} \
    
      42		MAIN_EXECUTABLE=velocity.jar \
    
      43		SERVER_START_CMD="java -Xms1G -Xmx1G -XX:+UseG1GC -XX:G1HeapRegionSize=4M -XX:+UnlockExperimentalVMOptions -XX:+ParallelRefProcEnabled -XX:+AlwaysPreTouch -XX:MaxInlineLevel=15 -jar ./velocity.jar" \
    
      44		all
    
      45}
    
      46
    
      47package() {
    
      48	make -C "${srcdir}/velocity-proxy-mgmt-${_mng_ver}" \
    
      49		DESTDIR="${pkgdir}" \
    
      50		GAME=${_game} \
    
      51		INAME=${_game} \
    
      52		install
    
      53
    
      54	install -Dm644 ${_game}.${pkgver}.jar     "${pkgdir}/${_server_root}/${_game}.${pkgver}.jar"
    
      55	ln -s "${_game}.${pkgver}.jar" "${pkgdir}${_server_root}/${_game}.jar"
    
      56
    
      57	# Link the log files
    
      58	mkdir -p "${pkgdir}/var/log/"
    
      59	install -dm2755 "${pkgdir}/${_server_root}/logs"
    
      60	ln -s "${_server_root}/logs" "${pkgdir}/var/log/${_game}"
    
      61
    
      62	# Give the group write permissions and set user or group ID on execution
    
      63	chmod g+s "${pkgdir}${_server_root}"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 00:19:22	Low	3
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 00:19:57	Low	3
2026-08-30 00:04:14	Low	3
2026-08-29 00:29:17	Low	3