sdkman-bin

maintainer rintim · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD sources its main binaries from official GitHub releases (sdkman/sdkman-cli and sdkman/sdkman-cli-native) with pinned SHA256 checksums, which is legitimate. The only concern is the runtime curl call to api.sdkman.io/2/candidates/all during package(), which fetches a list of available SDK candidates (plain text data) and writes it to var/candidates. This is the official SDKMAN API endpoint — the same one the tool itself uses at runtime. The fetched content is pure data (a comma-separated list of candidate names), not executed code or a binary. There is no checksum for this dynamic content, which is sloppy and makes builds non-reproducible, but the data itself is not executed. This is a low-severity packaging quality issue rather than a genuine supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The PKGBUILD sources its main binaries from official GitHub releases (sdkman/sdkman-cli and sdkman/sdkman-cli-native) with pinned SHA256 checksums, which is legitimate. The only concern is the runtime curl call to api.sdkman.io/2/candidates/all during package(), which fetches a list of available SDK candidates (plain text data) and writes it to var/candidates. This is the official SDKMAN API endpoint — the same one the tool itself uses at runtime. The fetched content is pure data (a comma-separated list of candidate names), not executed code or a binary. There is no checksum for this dynamic content, which is sloppy and makes builds non-reproducible, but the data itself is not executed. This is a low-severity packaging quality issue rather than a genuine supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:37 curl -s "https://api.sdkman.io/2/candidates/all" -o "$pkgdir/$_sdkmandir/var/candidates"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: rintim <rintim@foxmail.com>
    
      2
    
      3pkgname=sdkman-bin
    
      4pkgver=5.22.5
    
      5_nativepkgver=0.7.34
    
      6pkgrel=2
    
      7pkgdesc="The Software Development Kit Manager Command Line Interface"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://sdkman.io/"
    
      10license=('Apache-2.0')
    
      11
    
      12depends=("curl")
    
      13provides=("${pkgname%-bin}=$pkgver")
    
      14conflicts=("${pkgname%-bin}")
    
      15
    
      16_githuburl="https://github.com/sdkman/sdkman-cli/"
    
      17_githubnativeurl="https://github.com/sdkman/sdkman-cli-native/"
    
      18
    
      19source_x86_64=("${pkgname%-bin}-$pkgver.zip::$_githuburl/releases/download/$pkgver/sdkman-cli-$pkgver.zip"
    
      20               "${pkgname%-bin}-native-$_nativepkgver.zip::$_githubnativeurl/releases/download/v$_nativepkgver/sdkman-cli-native-$_nativepkgver-$CARCH-unknown-linux-gnu.zip")
    
      21source_aarch64=("${pkgname%-bin}-$pkgver.zip::$_githuburl/releases/download/$pkgver/sdkman-cli-$pkgver.zip"
    
      22                "${pkgname%-bin}-native-$_nativepkgver.zip::$_githubnativeurl/releases/download/v$_nativepkgver/sdkman-cli-native-$_nativepkgver-$CARCH-unknown-linux-gnu.zip")
    
      23
    
      24_zipdir="sdkman-$pkgver"
    
      25_zipnativedir="sdkman-cli-native-$_nativepkgver-$CARCH-unknown-linux-gnu"
    
      26_sdkmandir="/usr/lib/${pkgname%-bin}/libexec"
    
      27
    
      28package() {
    
      29    mkdir -p "$pkgdir/$_sdkmandir"
    
      30    mkdir -p "$pkgdir/$_sdkmandir/tmp"
    
      31    mkdir -p "$pkgdir/$_sdkmandir/ext"
    
      32    mkdir -p "$pkgdir/$_sdkmandir/etc"
    
      33    mkdir -p "$pkgdir/$_sdkmandir/var"
    
      34    mkdir -p "$pkgdir/$_sdkmandir/candidates"
    
      35    mkdir -p "$pkgdir/$_sdkmandir/libexec"
    
      36
    
      37    curl -s "https://api.sdkman.io/2/candidates/all" -o "$pkgdir/$_sdkmandir/var/candidates"
    
      38
    
      39    install -Dm755 "${srcdir}/$_zipdir/bin/sdkman-init.sh" -t "$pkgdir/$_sdkmandir/bin"
    
      40    install -Dm644 "${srcdir}/$_zipdir/contrib/completion/bash/sdk" -t "$pkgdir/$_sdkmandir/contrib/completion/bash"
    
      41    install -Dm755 "${srcdir}/$_zipdir/src"/* -t "$pkgdir/$_sdkmandir/src"
    
      42
    
      43    touch "$pkgdir/$_sdkmandir/etc/config"
    
      44
    
      45    echo "sdkman_auto_answer=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      46    echo "sdkman_auto_complete=true" >> "$pkgdir/$_sdkmandir/etc/config"
    
      47    echo "sdkman_auto_env=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      48    echo "sdkman_beta_channel=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      49    echo "sdkman_colour_enable=true" >> "$pkgdir/$_sdkmandir/etc/config"
    
      50    echo "sdkman_curl_connect_timeout=7" >> "$pkgdir/$_sdkmandir/etc/config"
    
      51    echo "sdkman_curl_max_time=10" >> "$pkgdir/$_sdkmandir/etc/config"
    
      52    echo "sdkman_debug_mode=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      53    echo "sdkman_insecure_ssl=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      54    echo "sdkman_rosetta2_compatible=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      55    echo "sdkman_selfupdate_feature=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      56
    
      57    echo "$pkgver" > "$pkgdir/$_sdkmandir/var/version"
    
      58    echo "$_nativepkgver" > "$pkgdir/$_sdkmandir/var/version_native"
    
      59
    
      60    if [ $CARCH = "x86_64" ]; then
    
      61        echo "linuxx64" >> "$pkgdir/$_sdkmandir/var/platform"
    
      62    elif [ $CARCH = "aarch64" ]; then
    
      63        echo "linuxarm64" >> "$pkgdir/$_sdkmandir/var/platform"
    
      64    fi
    
      65
    
      66    install -Dm755 "${srcdir}/$_zipnativedir/libexec"/* -t "$pkgdir/$_sdkmandir/libexec"
    
      67}
    
      68
    
      69sha256sums_x86_64=('301de44c2455c061c8ac40fae194dd9287251115e34f8d86de68914510eb12c9'
    
      70                   'd268e17a36f6fae542bb38018f2bfadf60689c4c1de0bff2dcfdace0855ddf0a')
    
      71sha256sums_aarch64=('301de44c2455c061c8ac40fae194dd9287251115e34f8d86de68914510eb12c9'
    
      72                    '79b2747107aaeca1c4d3c1fea1178ec34210e43949633771b5c31f08c353ee7b')
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2