quilt-server

maintainer ImperatorStorm · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from GitHub and a JAR from Quilt's official Maven repository, both plausible project-owned hosts; the JAR is used to install the server and is not executed directly, representing a normal build process for this type of software.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from GitHub and a JAR from Quilt's official Maven repository, both plausible project-owned hosts; the JAR is used to install the server and is not executed directly, representing a normal build process for this type of software.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:49 "quilt-installer-${_quilt_ver}.jar"::"https://maven.quiltmc.org/repository/release/org/quiltmc/quilt-installer/${_quilt_ver}/quilt-installer-${_quilt_ver}.jar")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Imperator Storm <ImperatorStorm11@protonmail.com>
    
      2
    
      3# Based on the `fabric-server` AUR package by:
    
      4# Maintainer: lgm <lgm dot aur at outlook dot com>
    
      5# Contributor: Ndoskrnl <lollipop.studio.cn@gmail.com>
    
      6# Contributor: flying <flyinghat42@gmail.com>
    
      7
    
      8# Based on the `forge-server` AUR package by:
    
      9# Contributor: Nitroretro <nitroretro@protonmail.com>
    
      10
    
      11# Based on the `minecraft-server` AUR package by:
    
      12## Maintainer: Gordian Edenhofer <gordian.edenhofer@gmail.com>
    
      13## Contributor: Philip Abernethy <chais.z3r0@gmail.com>
    
      14## Contributor: sowieso <sowieso@dukun.de>
    
      15
    
      16pkgver=26.2+0.15.0+0.30.0+1.0.4
    
      17pkgrel=1
    
      18_ver=${pkgver//\+/_}
    
      19
    
      20IFS="-" read -ra _ver_temp <<< "$_ver"
    
      21IFS="_" read -ra _pkgver_temp <<< "${_ver_temp[0]}"
    
      22
    
      23# the minecraft version
    
      24_minecraft_ver=${_pkgver_temp[0]}
    
      25
    
      26# the version of the installer
    
      27_quilt_ver=${_pkgver_temp[1]}
    
      28
    
      29# the version of the loader to install
    
      30_quilt_loader_ver=${_pkgver_temp[2]}
    
      31
    
      32_mng_ver=${_pkgver_temp[3]}
    
      33
    
      34_pkgver=${_ver_temp[0]//_/-}
    
      35
    
      36pkgname="quilt-server"
    
      37_quilt_name="quilt"
    
      38epoch=1
    
      39pkgdesc="Minecraft Quilt server unit files, script, and jar"
    
      40arch=("any")
    
      41url="https://quiltmc.org"
    
      42license=("Apache-2.0")
    
      43depends=("java-runtime-headless>=26" "tmux" "sudo" "bash" "awk" "sed" "tar")
    
      44optdepends=("netcat: required in order to suspend an idle server")
    
      45backup=("etc/conf.d/${_quilt_name}")
    
      46install="quilt-server.install"
    
      47options=(emptydirs)
    
      48source=("minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz"
    
      49		"quilt-installer-${_quilt_ver}.jar"::"https://maven.quiltmc.org/repository/release/org/quiltmc/quilt-installer/${_quilt_ver}/quilt-installer-${_quilt_ver}.jar")
    
      50noextract=("quilt-${_pkgver}.jar")
    
      51sha256sums=('55a9063d77e6fbb79b6e120c4a3faf78a129cc36b8874a895cc2261c3735130c'
    
      52            'f0c6e04e7f3b932d801b9e783ae17c960ff3cadc0f0109d6cc9be5240e99d455')
    
      53
    
      54prepare() {
    
      55	java -Duser.home="${srcdir}" -jar "quilt-installer-${_quilt_ver}.jar" install server ${_minecraft_ver} ${_quilt_loader_ver} --download-server
    
      56}
    
      57
    
      58_game="quilt"
    
      59_server_root="${pkgdir}/srv/${_quilt_name}"
    
      60build() {
    
      61	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      62		GAME=${_game} \
    
      63		INAME=${_game}d \
    
      64		SERVER_ROOT=${_server_root} \
    
      65		BACKUP_PATHS="world world_nether world_the_end" \
    
      66		GAME_USER=${_game} \
    
      67		MAIN_EXECUTABLE=quilt-server-launch.jar \
    
      68		SERVER_START_CMD="java -Xms512M -Xmx1024M -jar './\$\${MAIN_EXECUTABLE}' --nogui" \
    
      69		clean
    
      70	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      71		GAME=${_game} \
    
      72		INAME=${_game}d \
    
      73		SERVER_ROOT=${_server_root} \
    
      74		BACKUP_PATHS="world world_nether world_the_end" \
    
      75		GAME_USER=${_game} \
    
      76		MAIN_EXECUTABLE=quilt-server-launch.jar \
    
      77		SERVER_START_CMD="java -Xms512M -Xmx1024M -jar './\$\${MAIN_EXECUTABLE}' --nogui" \
    
      78		all
    
      79}
    
      80
    
      81package() {
    
      82	_server_root="${pkgdir}/srv/${_quilt_name}"
    
      83
    
      84	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      85		DESTDIR="${pkgdir}" \
    
      86		GAME=${_game} \
    
      87		INAME=${_game}d \
    
      88		install
    
      89
    
      90	# Install Quilt
    
      91	install -Dm644 "server/quilt-server-launch.jar" "${_server_root}/quilt-server-launch.jar"
    
      92
    
      93	# Install Minecraft Server
    
      94	install -Dm644 "server/server.jar" "${_server_root}/server.jar"
    
      95
    
      96	# install the libraries subfolder
    
      97	# 1 create the emptyfolder structure 
    
      98	install -dm755 "libraries" "${_server_root}/libraries"
    
      99	
    
      100	cp -r "server/libraries/" "./"
    
      101	for dir in $(find "libraries" -type d); do
    
      102		echo "${_server_root}/${dir}"
    
      103		install -d --mode 755 "$dir" "${_server_root}/${dir}"
    
      104	done
    
      105	# 2 install all files
    
      106	for file in $(find "libraries" -type f); do
    
      107	echo "${_server_root}/${file}"
    
      108		install -D --mode 755 "$file" "${_server_root}/${file}"
    
      109	done
    
      110
    
      111	# Link log files
    
      112	mkdir -p "${pkgdir}/var/log/"
    
      113	install -dm2755 "${_server_root}/logs"
    
      114	ln -s "/srv/${_quilt_name}/logs" "${pkgdir}/var/log/${_quilt_name}"
    
      115
    
      116	# Give the group write permissions and set user or group ID on execution
    
      117	chmod g+ws "${_server_root}"
    
      118}
    
      119

Changes since previous scan

--- PKGBUILD @ 2026-07-24 00:02
+++ PKGBUILD @ 2026-08-03 00:08
@@ -13,11 +13,9 @@
 ## Contributor: Philip Abernethy <chais.z3r0@gmail.com>
 ## Contributor: sowieso <sowieso@dukun.de>
 
-_ver="26.1.2_0.12.1_0.29.2-1" # <mcver_installerver_loaderver-pkgrelease>
-# installer ver can be gotten at https://meta.quiltmc.org/v3/versions/installer
-# loader ver can be gotten at https://meta.quiltmc.org/v3/versions/loader
-# stay on stable loader+installer releases for the time being.
-# unless things break.
+pkgver=26.2+0.15.0+0.30.0+1.0.4
+pkgrel=1
+_ver=${pkgver//\+/_}
 
 IFS="-" read -ra _ver_temp <<< "$_ver"
 IFS="_" read -ra _pkgver_temp <<< "${_ver_temp[0]}"
@@ -31,19 +29,18 @@
 # the version of the loader to install
 _quilt_loader_ver=${_pkgver_temp[2]}
 
-_mng_ver=1.0.4
+_mng_ver=${_pkgver_temp[3]}
 
 _pkgver=${_ver_temp[0]//_/-}
 
 pkgname="quilt-server"
 _quilt_name="quilt"
-pkgver=${_ver_temp[0]}
-pkgrel=${_ver_temp[1]}
+epoch=1
 pkgdesc="Minecraft Quilt server unit files, script, and jar"
 arch=("any")
 url="https://quiltmc.org"
 license=("Apache-2.0")
-depends=("java-runtime-headless>=25" "tmux" "sudo" "bash" "awk" "sed" "tar")
+depends=("java-runtime-headless>=26" "tmux" "sudo" "bash" "awk" "sed" "tar")
 optdepends=("netcat: required in order to suspend an idle server")
 backup=("etc/conf.d/${_quilt_name}")
 install="quilt-server.install"
@@ -52,7 +49,7 @@
 		"quilt-installer-${_quilt_ver}.jar"::"https://maven.quiltmc.org/repository/release/org/quiltmc/quilt-installer/${_quilt_ver}/quilt-installer-${_quilt_ver}.jar")
 noextract=("quilt-${_pkgver}.jar")
 sha256sums=('55a9063d77e6fbb79b6e120c4a3faf78a129cc36b8874a895cc2261c3735130c'
-            '8b716edc692a2fa1fb78dbc2f432643be1bc6c867e5605f36f691f44257120ca')
+            'f0c6e04e7f3b932d801b9e783ae17c960ff3cadc0f0109d6cc9be5240e99d455')
 
 prepare() {
 	java -Duser.home="${srcdir}" -jar "quilt-installer-${_quilt_ver}.jar" install server ${_minecraft_ver} ${_quilt_loader_ver} --download-server

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 05:27:22	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2