sdkman-bin

MEDIUM

maintainer rintim 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a file at build time from an untrusted host (api.sdkman.io) not listed in source=(), which could allow a supply-chain attack if the domain were compromised or redirected.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:37 curl -s "https://api.sdkman.io/2/candidates/all" -o "$pkgdir/$_sdkmandir/var/candidates"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a file at build time from an untrusted host (api.sdkman.io) not listed in source=(), which could allow a supply-chain attack if the domain were compromised or redirected.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: rintim <rintim@foxmail.com>
    
      2
    
      3pkgname=sdkman-bin
    
      4pkgver=5.23.2
    
      5_nativepkgver=0.7.35
    
      6pkgrel=1
    
      7pkgdesc="The Software Development Kit Manager Command Line Interface"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://sdkman.io/"
    
      10license=('Apache-2.0')
    
      11
    
      12depends=("curl")
    
      13provides=("${pkgname%-bin}=$pkgver")
    
      14conflicts=("${pkgname%-bin}")
    
      15
    
      16_githuburl="https://github.com/sdkman/sdkman-cli/"
    
      17_githubnativeurl="https://github.com/sdkman/sdkman-cli-native/"
    
      18
    
      19source_x86_64=("${pkgname%-bin}-$pkgver.zip::$_githuburl/releases/download/$pkgver/sdkman-cli-$pkgver.zip"
    
      20               "${pkgname%-bin}-native-$_nativepkgver.zip::$_githubnativeurl/releases/download/v$_nativepkgver/sdkman-cli-native-$_nativepkgver-$CARCH-unknown-linux-gnu.zip")
    
      21source_aarch64=("${pkgname%-bin}-$pkgver.zip::$_githuburl/releases/download/$pkgver/sdkman-cli-$pkgver.zip"
    
      22                "${pkgname%-bin}-native-$_nativepkgver.zip::$_githubnativeurl/releases/download/v$_nativepkgver/sdkman-cli-native-$_nativepkgver-$CARCH-unknown-linux-gnu.zip")
    
      23
    
      24_zipdir="sdkman-$pkgver"
    
      25_zipnativedir="sdkman-cli-native-$_nativepkgver-$CARCH-unknown-linux-gnu"
    
      26_sdkmandir="/usr/lib/${pkgname%-bin}/libexec"
    
      27
    
      28package() {
    
      29    mkdir -p "$pkgdir/$_sdkmandir"
    
      30    mkdir -p "$pkgdir/$_sdkmandir/tmp"
    
      31    mkdir -p "$pkgdir/$_sdkmandir/ext"
    
      32    mkdir -p "$pkgdir/$_sdkmandir/etc"
    
      33    mkdir -p "$pkgdir/$_sdkmandir/var"
    
      34    mkdir -p "$pkgdir/$_sdkmandir/candidates"
    
      35    mkdir -p "$pkgdir/$_sdkmandir/libexec"
    
      36
    
      37    curl -s "https://api.sdkman.io/2/candidates/all" -o "$pkgdir/$_sdkmandir/var/candidates"
    
      38
    
      39    install -Dm755 "${srcdir}/$_zipdir/bin/sdkman-init.sh" -t "$pkgdir/$_sdkmandir/bin"
    
      40    install -Dm644 "${srcdir}/$_zipdir/contrib/completion/bash/sdk" -t "$pkgdir/$_sdkmandir/contrib/completion/bash"
    
      41    install -Dm755 "${srcdir}/$_zipdir/src"/* -t "$pkgdir/$_sdkmandir/src"
    
      42
    
      43    touch "$pkgdir/$_sdkmandir/etc/config"
    
      44
    
      45    echo "sdkman_auto_answer=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      46    echo "sdkman_auto_complete=true" >> "$pkgdir/$_sdkmandir/etc/config"
    
      47    echo "sdkman_auto_env=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      48    echo "sdkman_beta_channel=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      49    echo "sdkman_colour_enable=true" >> "$pkgdir/$_sdkmandir/etc/config"
    
      50    echo "sdkman_curl_connect_timeout=7" >> "$pkgdir/$_sdkmandir/etc/config"
    
      51    echo "sdkman_curl_max_time=10" >> "$pkgdir/$_sdkmandir/etc/config"
    
      52    echo "sdkman_debug_mode=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      53    echo "sdkman_insecure_ssl=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      54    echo "sdkman_rosetta2_compatible=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      55    echo "sdkman_selfupdate_feature=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      56
    
      57    echo "$pkgver" > "$pkgdir/$_sdkmandir/var/version"
    
      58    echo "$_nativepkgver" > "$pkgdir/$_sdkmandir/var/version_native"
    
      59
    
      60    if [ $CARCH = "x86_64" ]; then
    
      61        echo "linuxx64" >> "$pkgdir/$_sdkmandir/var/platform"
    
      62    elif [ $CARCH = "aarch64" ]; then
    
      63        echo "linuxarm64" >> "$pkgdir/$_sdkmandir/var/platform"
    
      64    fi
    
      65
    
      66    install -Dm755 "${srcdir}/$_zipnativedir/libexec"/* -t "$pkgdir/$_sdkmandir/libexec"
    
      67}
    
      68
    
      69sha256sums_x86_64=('d5ab363da944ad803b42470f73dd1b7beabad7d7b18f9eb2252ed485aabefbb5'
    
      70                   'd5130a98a6bfbda78dbfe50515996c40f53fce99c5d62748a80ca901d81163b3')
    
      71sha256sums_aarch64=('d5ab363da944ad803b42470f73dd1b7beabad7d7b18f9eb2252ed485aabefbb5'
    
      72                    '5f8645c47e06ddf34f8925fe799f1d87c382689893dca839145051a30c462fa5')
    
      73

Changes since previous scan

--- PKGBUILD @ 2026-10-20 00:10
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,9 +1,9 @@
 # Maintainer: rintim <rintim@foxmail.com>
 
 pkgname=sdkman-bin
-pkgver=5.22.5
+pkgver=5.23.2
 _nativepkgver=0.7.35
-pkgrel=3
+pkgrel=1
 pkgdesc="The Software Development Kit Manager Command Line Interface"
 arch=('x86_64' 'aarch64')
 url="https://sdkman.io/"
@@ -66,8 +66,8 @@
     install -Dm755 "${srcdir}/$_zipnativedir/libexec"/* -t "$pkgdir/$_sdkmandir/libexec"
 }
 
-sha256sums_x86_64=('301de44c2455c061c8ac40fae194dd9287251115e34f8d86de68914510eb12c9'
+sha256sums_x86_64=('d5ab363da944ad803b42470f73dd1b7beabad7d7b18f9eb2252ed485aabefbb5'
                    'd5130a98a6bfbda78dbfe50515996c40f53fce99c5d62748a80ca901d81163b3')
-sha256sums_aarch64=('301de44c2455c061c8ac40fae194dd9287251115e34f8d86de68914510eb12c9'
+sha256sums_aarch64=('d5ab363da944ad803b42470f73dd1b7beabad7d7b18f9eb2252ed485aabefbb5'
                     '5f8645c47e06ddf34f8925fe799f1d87c382689893dca839145051a30c462fa5')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 13:28:00	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2