papermc

maintainer edh · 27 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The flagged privileged install is part of a standard AUR package setup that installs service files and directories under /srv, which is normal for server applications; it does not perform unauthorized privilege escalation or self-updates, and all downloaded sources are verifiable and used as intended.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged privileged install is part of a standard AUR package setup that installs service files and directories under /srv, which is normal for server applications; it does not perform unauthorized privilege escalation or self-updates, and all downloaded sources are verifiable and used as intended.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:67 chmod g+s "${pkgdir}${_server_root}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gordian Edenhofer <gordian.edenhofer@gmail.com>
    
      2
    
      3pkgname=papermc
    
      4_papermc_api="https://fill.papermc.io/v3"
    
      5_papermc_user_agent="papermc-arch/1.0 (https://aur.archlinux.org/packages/papermc)"
    
      6# curl -sH "User-Agent: ${_papermc_user_agent}" "${_papermc_api}/projects/paper"
    
      7_pkgver=26.2
    
      8# curl -sH "User-Agent: ${_papermc_user_agent}" "${_papermc_api}/projects/paper/versions/${_pkgver}/builds"
    
      9_build=112
    
      10_license_commit=caf76f1
    
      11pkgver="${_pkgver}+b${_build}"
    
      12pkgrel=1
    
      13_mng_ver=1.0.4
    
      14pkgdesc="Next generation of Minecraft server, compatible with Spigot plugins and offering uncompromising performance"
    
      15arch=('any')
    
      16url="https://papermc.io/"
    
      17license=('custom')
    
      18depends=('java-runtime-headless>=16' 'tmux' 'sudo' 'bash' 'awk' 'sed')
    
      19makedepends=('curl' 'jq')
    
      20optdepends=("tar: needed in order to create world backups"
    
      21	"netcat: required in order to suspend an idle server")
    
      22conflicts=('papermc-git')
    
      23backup=('etc/conf.d/papermc')
    
      24install="${pkgname}.install"
    
      25_papermc_url="$(curl -fsSL -H "User-Agent: ${_papermc_user_agent}" "${_papermc_api}/projects/paper/versions/${_pkgver}/builds" | jq -r ".[] | select(.id == ${_build}) | .downloads[\"server:default\"].url")"
    
      26source=("papermc.${pkgver}.jar"::"${_papermc_url}"
    
      27	"LICENSE_${pkgver}.md"::"https://raw.githubusercontent.com/PaperMC/Paper/${_license_commit}/LICENSE.md"
    
      28	"minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz")
    
      29noextract=("papermc.${pkgver}.jar")
    
      30sha512sums=('f2282fc3b59850ed9cfd62be62d45458e07c7680a78bf5b271dbd6aa6029f7e16f5821ae618bf8e397e59fd775a05def230cfdac253f7acd1d7648ba139713e1'
    
      31            '882be11c8e603c3b7afa1004c4e0d89673e509794d9b8766c91e8bbb53e36ed595d0761505455504d9fd4fa7c55b566bed39539e513b59e03ff8a4d1d6ed3cca'
    
      32            'dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556')
    
      33
    
      34_game="papermc"
    
      35_server_root="/srv/papermc"
    
      36
    
      37build() {
    
      38	make -C "${srcdir}/minecraft-server-${_mng_ver}" clean
    
      39
    
      40	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      41		GAME=${_game} \
    
      42		INAME=${_game} \
    
      43		SERVER_ROOT=${_server_root} \
    
      44		BACKUP_PATHS="world" \
    
      45		GAME_USER=${_game} \
    
      46		MAIN_EXECUTABLE=papermc_server.jar \
    
      47		SERVER_START_CMD="java -Xms512M -Xmx1024M -jar ./papermc_server.jar nogui" \
    
      48		all
    
      49}
    
      50
    
      51package() {
    
      52	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      53		DESTDIR="${pkgdir}" \
    
      54		GAME=${_game} \
    
      55		INAME=${_game} \
    
      56		install
    
      57
    
      58	install -Dm644 ${_game}.${pkgver}.jar     "${pkgdir}/${_server_root}/${_game}.${pkgver}.jar"
    
      59	ln -s "${_game}.${pkgver}.jar" "${pkgdir}${_server_root}/${_game}_server.jar"
    
      60
    
      61	# Link the log files
    
      62	mkdir -p "${pkgdir}/var/log/"
    
      63	install -dm2755 "${pkgdir}/${_server_root}/logs"
    
      64	ln -s "${_server_root}/logs" "${pkgdir}/var/log/${_game}"
    
      65
    
      66	# Give the group write permissions and set user or group ID on execution
    
      67	chmod g+s "${pkgdir}${_server_root}"
    
      68
    
      69	install -D ./LICENSE_${pkgver}.md "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      70}
    
      71

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,11 +1,13 @@
 # Maintainer: Gordian Edenhofer <gordian.edenhofer@gmail.com>
 
 pkgname=papermc
-# curl -X GET "https://api.papermc.io/v2/projects/paper" -H  "accept: application/json"
-_pkgver=1.21.11
-# curl -X GET "https://api.papermc.io/v2/projects/paper/versions/${_pkgver}" -H  "accept: application/json"
-_build=69
-_license_commit=080a72f2
+_papermc_api="https://fill.papermc.io/v3"
+_papermc_user_agent="papermc-arch/1.0 (https://aur.archlinux.org/packages/papermc)"
+# curl -sH "User-Agent: ${_papermc_user_agent}" "${_papermc_api}/projects/paper"
+_pkgver=26.2
+# curl -sH "User-Agent: ${_papermc_user_agent}" "${_papermc_api}/projects/paper/versions/${_pkgver}/builds"
+_build=112
+_license_commit=caf76f1
 pkgver="${_pkgver}+b${_build}"
 pkgrel=1
 _mng_ver=1.0.4
@@ -14,17 +16,19 @@
 url="https://papermc.io/"
 license=('custom')
 depends=('java-runtime-headless>=16' 'tmux' 'sudo' 'bash' 'awk' 'sed')
+makedepends=('curl' 'jq')
 optdepends=("tar: needed in order to create world backups"
 	"netcat: required in order to suspend an idle server")
 conflicts=('papermc-git')
 backup=('etc/conf.d/papermc')
 install="${pkgname}.install"
-source=("papermc.${pkgver}.jar"::"https://api.papermc.io/v2/projects/paper/versions/${_pkgver}/builds/${_build}/downloads/paper-${_pkgver}-${_build}.jar"
+_papermc_url="$(curl -fsSL -H "User-Agent: ${_papermc_user_agent}" "${_papermc_api}/projects/paper/versions/${_pkgver}/builds" | jq -r ".[] | select(.id == ${_build}) | .downloads[\"server:default\"].url")"
+source=("papermc.${pkgver}.jar"::"${_papermc_url}"
 	"LICENSE_${pkgver}.md"::"https://raw.githubusercontent.com/PaperMC/Paper/${_license_commit}/LICENSE.md"
 	"minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz")
 noextract=("papermc.${pkgver}.jar")
-sha512sums=('005d95c5c7f552c4d20b7a600f7d25e9605aa48e43f81f57560c7748e058bbe4d3b1db36751dd9a68316ba02d84a927bda6da716dddba2ccbeb368027df57e7d'
-            '97f099424d41066328451904b1c878b12e4113ec714df652d014acded862fa6c8bab4986a014a6e843cee1cd950fcf40533d4d2d76d9bf9ff82ae04fc087c91e'
+sha512sums=('f2282fc3b59850ed9cfd62be62d45458e07c7680a78bf5b271dbd6aa6029f7e16f5821ae618bf8e397e59fd775a05def230cfdac253f7acd1d7648ba139713e1'
+            '882be11c8e603c3b7afa1004c4e0d89673e509794d9b8766c91e8bbb53e36ed595d0761505455504d9fd4fa7c55b566bed39539e513b59e03ff8a4d1d6ed3cca'
             'dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556')
 
 _game="papermc"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 23:31:34	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1