patrjprof
LOW
maintainer pat
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt JARs and a start script from the maintainer's personal Maven repository, but these are the project's official release artifacts; the checksums are verified, and the worst case of a swapped source would be supply-chain compromise, not inherent malice, so it is a low-severity risk typical for AUR packages.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt JARs and a start script from the maintainer's personal Maven repository, but these are the project's official release artifacts; the checksums are verified, and the worst case of a swapped source would be supply-chain compromise, not inherent malice, so it is a low-severity risk typical for AUR packages.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
source=("patr-java-profiler-start-${_pkgver}.sh::https://nexuspat.hechler.de/repository/maven-releases/de/hechler/patrick/profiler/patr-java-profiler/${_pkgver}/patr-java-profiler-${_pkgver}.start-script"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Patrick Hechler <patrjprof.aur@ph.anderemails.de>
2
pkgname=patrjprof
3
pkgver=1.7.3.r417
4
_pkgver="$(echo "${pkgver}" | sed -E 's/[.]r[0-9]+$//')"
5
pkgrel=1
6
pkgdesc="A Free Java profiler written in Java"
7
arch=('any')
8
url="https://git.rwth-aachen.de/patrick_laszlo.hechler/patr-java-profiler"
9
license=('AGPL-3.0-or-later')
10
groups=()
11
depends=('java-runtime-headless>=8')
12
makedepends=()
13
optdepends=('java-runtime>=8: graphical user interface'
14
'java-runtime-headless>=16: support for socket files for server/client communication'
15
'java-runtime-headless>=24: profile constructors with the new class-file API'
16
)
17
provides=()
18
conflicts=()
19
replaces=()
20
backup=()
21
options=()
22
install=
23
changelog=
24
25
source=("patr-java-profiler-start-${_pkgver}.sh::https://nexuspat.hechler.de/repository/maven-releases/de/hechler/patrick/profiler/patr-java-profiler/${_pkgver}/patr-java-profiler-${_pkgver}.start-script"
26
"patr-java-profiler-agent-${_pkgver}.jar::https://nexuspat.hechler.de/repository/maven-releases/de/hechler/patrick/profiler/patr-java-profiler-agent/${_pkgver}/patr-java-profiler-agent-${_pkgver}.jar"
27
"patr-java-profiler-bootstrap-${_pkgver}.jar::https://nexuspat.hechler.de/repository/maven-releases/de/hechler/patrick/profiler/patr-java-profiler-bootstrap/${_pkgver}/patr-java-profiler-bootstrap-${_pkgver}.jar"
28
"patr-java-profiler-client-${_pkgver}.jar::https://nexuspat.hechler.de/repository/maven-releases/de/hechler/patrick/profiler/patr-java-profiler-client/${_pkgver}/patr-java-profiler-client-${_pkgver}.jar"
29
"patr-java-profiler-server-${_pkgver}.jar::https://nexuspat.hechler.de/repository/maven-releases/de/hechler/patrick/profiler/patr-java-profiler-server/${_pkgver}/patr-java-profiler-server-${_pkgver}.jar"
30
"patr-java-profiler-test-${_pkgver}.jar::https://nexuspat.hechler.de/repository/maven-releases/de/hechler/patrick/profiler/patr-java-profiler-test/${_pkgver}/patr-java-profiler-test-${_pkgver}.jar"
31
)
32
noextract=("${source[@]%%::*}")
33
sha512sums=('cdef6de2254f01d4398b2fcd8f9c43ca5aa1cac5d44d66595f0c0d7cdcab5082dea7fd323548df46dde468b5f307cc44a267927ed103324b2e0f41df99ab0bc4'
34
'5b7650ef10a05a6f9ba977c1e9ea8956d00ee4edf1dbdc94caf5f69086c69c56378257caa0cc6340146121771e5e631883baa8dbb1a4b0bd8cc5d25307e48064'
35
'80427d2a22a96c6fd0a66f717820e3be22cc6e48a2a15a0f2e309bd4378e32d01c9d44dbaa92e37dad9f3bc613fc1fe6763633651a6ae8613c7ab95065faf2df'
36
'fa50a4745a2309a61c4551a659bccd21351140068649df075b66b27514f400f61d332f1bf0d2e7fdc68cb2a9f49dbf8c65617ad287b99746ffb814fafecd2b10'
37
'27eb5b220f8bb02b2a69852386e097a6795a2dec90d0b2b1c9efcb5099badb4fdf09f38206314be9ffb6ecdd4fa842ecb788add54cd6967beaa480e116053362'
38
'62ee6d4325f0642e2de45817b78b8aebfb821094f41f549f29d75ea531f2b5299afb1f2f9f7b2a06439ba9ff329bc7b1ed0e3e6beee9088234ac660cb60f98a8'
39
)
40
41
build() {
42
cd "$srcdir"
43
44
chmod +x "./patr-java-profiler-start-${_pkgver}.sh"
45
}
46
47
check() {
48
cd "$srcdir"
49
50
export JAVA=java
51
52
export AGENT_JAR="patr-java-profiler-agent-${_pkgver}.jar"
53
export BOOTSTRAP_JAR="patr-java-profiler-bootstrap-${_pkgver}.jar"
54
export SERVER_JAR="patr-java-profiler-server-${_pkgver}.jar"
55
export CLIENT_JAR="patr-java-profiler-client-${_pkgver}.jar"
56
57
if test -f patr-java-profiler-output.data; then
58
rm patr-java-profiler-output.data
59
fi
60
echo 'start test'
61
"./patr-java-profiler-start-${_pkgver}.sh" --no-server --no-client --no-defaults -cp \
62
"patr-java-profiler-test-${_pkgver}.jar" de.hechler.patrick.profiler.test.PHPTestMain 11
63
echo 'validate test'
64
"./patr-java-profiler-start-${_pkgver}.sh" --only-client --validate patr-java-profiler-output.data
65
echo 'finished test'
66
}
67
68
package() {
69
cd "$srcdir"
70
71
# copy original files
72
mkdir -p "$pkgdir"/usr/share/java/patrjprof
73
74
cp -T "patr-java-profiler-agent-${_pkgver}.jar" \
75
"$pkgdir"/usr/share/java/patrjprof/patr-java-profiler-agent-${_pkgver}.jar
76
77
cp -T "patr-java-profiler-bootstrap-${_pkgver}.jar" \
78
"$pkgdir"/usr/share/java/patrjprof/patr-java-profiler-bootstrap-${_pkgver}.jar
79
80
cp -T "patr-java-profiler-server-${_pkgver}.jar" \
81
"$pkgdir"/usr/share/java/patrjprof/patr-java-profiler-server-${_pkgver}.jar
82
83
cp -T "patr-java-profiler-client-${_pkgver}.jar" \
84
"$pkgdir"/usr/share/java/patrjprof/patr-java-profiler-client-${_pkgver}.jar
85
86
ln -sT patr-java-profiler-agent-${_pkgver}.jar "$pkgdir"/usr/share/java/patrjprof/patr-java-profiler-agent.jar
87
ln -sT patr-java-profiler-bootstrap-${_pkgver}.jar "$pkgdir"/usr/share/java/patrjprof/patr-java-profiler-bootstrap.jar
88
ln -sT patr-java-profiler-server-${_pkgver}.jar "$pkgdir"/usr/share/java/patrjprof/patr-java-profiler-server.jar
89
ln -sT patr-java-profiler-client-${_pkgver}.jar "$pkgdir"/usr/share/java/patrjprof/patr-java-profiler-client.jar
90
91
# create script which starts the profiler
92
mkdir -p "$pkgdir"/usr/bin
93
echo '#!/bin/sh' > "$pkgdir"/usr/bin/patrjprof
94
# do not change the SPDX license Identifier
95
head -1 "patr-java-profiler-start-${_pkgver}.sh" >> "$pkgdir"/usr/bin/patrjprof
96
echo -n "
97
# set the values needed for the script
98
AGENT_JAR=/usr/share/java/patrjprof/patr-java-profiler-agent-${_pkgver}.jar
99
BOOTSTRAP_JAR=/usr/share/java/patrjprof/patr-java-profiler-bootstrap-${_pkgver}.jar
100
SERVER_JAR=/usr/share/java/patrjprof/patr-java-profiler-server-${_pkgver}.jar
101
CLIENT_JAR=/usr/share/java/patrjprof/patr-java-profiler-client-${_pkgver}.jar
102
103
# helper script from git
104
" >> "$pkgdir"/usr/bin/patrjprof
105
tail +2 "patr-java-profiler-start-${_pkgver}.sh" >> "$pkgdir"/usr/bin/patrjprof
106
chmod +x "$pkgdir"/usr/bin/patrjprof
107
}
108
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |