papermc

LOW

maintainer edh 27 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The flagged privileged install is part of a standard AUR package setup that installs service files and directories under /srv, which is normal for server applications; it does not perform unauthorized privilege escalation or self-updates, and all downloaded sources are verifiable and used as intended.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged privileged install is part of a standard AUR package setup that installs service files and directories under /srv, which is normal for server applications; it does not perform unauthorized privilege escalation or self-updates, and all downloaded sources are verifiable and used as intended.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:67 chmod g+s "${pkgdir}${_server_root}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gordian Edenhofer <gordian.edenhofer@gmail.com>
    
      2
    
      3pkgname=papermc
    
      4_papermc_api="https://fill.papermc.io/v3"
    
      5_papermc_user_agent="papermc-arch/1.0 (https://aur.archlinux.org/packages/papermc)"
    
      6# curl -sH "User-Agent: ${_papermc_user_agent}" "${_papermc_api}/projects/paper"
    
      7_pkgver=26.2
    
      8# curl -sH "User-Agent: ${_papermc_user_agent}" "${_papermc_api}/projects/paper/versions/${_pkgver}/builds"
    
      9_build=112
    
      10_license_commit=caf76f1
    
      11pkgver="${_pkgver}+b${_build}"
    
      12pkgrel=1
    
      13_mng_ver=1.0.4
    
      14pkgdesc="Next generation of Minecraft server, compatible with Spigot plugins and offering uncompromising performance"
    
      15arch=('any')
    
      16url="https://papermc.io/"
    
      17license=('custom')
    
      18depends=('java-runtime-headless>=16' 'tmux' 'sudo' 'bash' 'awk' 'sed')
    
      19makedepends=('curl' 'jq')
    
      20optdepends=("tar: needed in order to create world backups"
    
      21	"netcat: required in order to suspend an idle server")
    
      22conflicts=('papermc-git')
    
      23backup=('etc/conf.d/papermc')
    
      24install="${pkgname}.install"
    
      25_papermc_url="$(curl -fsSL -H "User-Agent: ${_papermc_user_agent}" "${_papermc_api}/projects/paper/versions/${_pkgver}/builds" | jq -r ".[] | select(.id == ${_build}) | .downloads[\"server:default\"].url")"
    
      26source=("papermc.${pkgver}.jar"::"${_papermc_url}"
    
      27	"LICENSE_${pkgver}.md"::"https://raw.githubusercontent.com/PaperMC/Paper/${_license_commit}/LICENSE.md"
    
      28	"minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz")
    
      29noextract=("papermc.${pkgver}.jar")
    
      30sha512sums=('f2282fc3b59850ed9cfd62be62d45458e07c7680a78bf5b271dbd6aa6029f7e16f5821ae618bf8e397e59fd775a05def230cfdac253f7acd1d7648ba139713e1'
    
      31            '882be11c8e603c3b7afa1004c4e0d89673e509794d9b8766c91e8bbb53e36ed595d0761505455504d9fd4fa7c55b566bed39539e513b59e03ff8a4d1d6ed3cca'
    
      32            'dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556')
    
      33
    
      34_game="papermc"
    
      35_server_root="/srv/papermc"
    
      36
    
      37build() {
    
      38	make -C "${srcdir}/minecraft-server-${_mng_ver}" clean
    
      39
    
      40	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      41		GAME=${_game} \
    
      42		INAME=${_game} \
    
      43		SERVER_ROOT=${_server_root} \
    
      44		BACKUP_PATHS="world" \
    
      45		GAME_USER=${_game} \
    
      46		MAIN_EXECUTABLE=papermc_server.jar \
    
      47		SERVER_START_CMD="java -Xms512M -Xmx1024M -jar ./papermc_server.jar nogui" \
    
      48		all
    
      49}
    
      50
    
      51package() {
    
      52	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      53		DESTDIR="${pkgdir}" \
    
      54		GAME=${_game} \
    
      55		INAME=${_game} \
    
      56		install
    
      57
    
      58	install -Dm644 ${_game}.${pkgver}.jar     "${pkgdir}/${_server_root}/${_game}.${pkgver}.jar"
    
      59	ln -s "${_game}.${pkgver}.jar" "${pkgdir}${_server_root}/${_game}_server.jar"
    
      60
    
      61	# Link the log files
    
      62	mkdir -p "${pkgdir}/var/log/"
    
      63	install -dm2755 "${pkgdir}/${_server_root}/logs"
    
      64	ln -s "${_server_root}/logs" "${pkgdir}/var/log/${_game}"
    
      65
    
      66	# Give the group write permissions and set user or group ID on execution
    
      67	chmod g+s "${pkgdir}${_server_root}"
    
      68
    
      69	install -D ./LICENSE_${pkgver}.md "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2