sdkman-bin

MEDIUM

maintainer rintim 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a file from api.sdkman.io during build time which is not listed in source=(), creating a supply-chain risk as the downloaded content is not verified and could be tampered with.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:37 curl -s "https://api.sdkman.io/2/candidates/all" -o "$pkgdir/$_sdkmandir/var/candidates"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a file from api.sdkman.io during build time which is not listed in source=(), creating a supply-chain risk as the downloaded content is not verified and could be tampered with.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: rintim <rintim@foxmail.com>
    
      2
    
      3pkgname=sdkman-bin
    
      4pkgver=5.22.5
    
      5_nativepkgver=0.7.35
    
      6pkgrel=3
    
      7pkgdesc="The Software Development Kit Manager Command Line Interface"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://sdkman.io/"
    
      10license=('Apache-2.0')
    
      11
    
      12depends=("curl")
    
      13provides=("${pkgname%-bin}=$pkgver")
    
      14conflicts=("${pkgname%-bin}")
    
      15
    
      16_githuburl="https://github.com/sdkman/sdkman-cli/"
    
      17_githubnativeurl="https://github.com/sdkman/sdkman-cli-native/"
    
      18
    
      19source_x86_64=("${pkgname%-bin}-$pkgver.zip::$_githuburl/releases/download/$pkgver/sdkman-cli-$pkgver.zip"
    
      20               "${pkgname%-bin}-native-$_nativepkgver.zip::$_githubnativeurl/releases/download/v$_nativepkgver/sdkman-cli-native-$_nativepkgver-$CARCH-unknown-linux-gnu.zip")
    
      21source_aarch64=("${pkgname%-bin}-$pkgver.zip::$_githuburl/releases/download/$pkgver/sdkman-cli-$pkgver.zip"
    
      22                "${pkgname%-bin}-native-$_nativepkgver.zip::$_githubnativeurl/releases/download/v$_nativepkgver/sdkman-cli-native-$_nativepkgver-$CARCH-unknown-linux-gnu.zip")
    
      23
    
      24_zipdir="sdkman-$pkgver"
    
      25_zipnativedir="sdkman-cli-native-$_nativepkgver-$CARCH-unknown-linux-gnu"
    
      26_sdkmandir="/usr/lib/${pkgname%-bin}/libexec"
    
      27
    
      28package() {
    
      29    mkdir -p "$pkgdir/$_sdkmandir"
    
      30    mkdir -p "$pkgdir/$_sdkmandir/tmp"
    
      31    mkdir -p "$pkgdir/$_sdkmandir/ext"
    
      32    mkdir -p "$pkgdir/$_sdkmandir/etc"
    
      33    mkdir -p "$pkgdir/$_sdkmandir/var"
    
      34    mkdir -p "$pkgdir/$_sdkmandir/candidates"
    
      35    mkdir -p "$pkgdir/$_sdkmandir/libexec"
    
      36
    
      37    curl -s "https://api.sdkman.io/2/candidates/all" -o "$pkgdir/$_sdkmandir/var/candidates"
    
      38
    
      39    install -Dm755 "${srcdir}/$_zipdir/bin/sdkman-init.sh" -t "$pkgdir/$_sdkmandir/bin"
    
      40    install -Dm644 "${srcdir}/$_zipdir/contrib/completion/bash/sdk" -t "$pkgdir/$_sdkmandir/contrib/completion/bash"
    
      41    install -Dm755 "${srcdir}/$_zipdir/src"/* -t "$pkgdir/$_sdkmandir/src"
    
      42
    
      43    touch "$pkgdir/$_sdkmandir/etc/config"
    
      44
    
      45    echo "sdkman_auto_answer=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      46    echo "sdkman_auto_complete=true" >> "$pkgdir/$_sdkmandir/etc/config"
    
      47    echo "sdkman_auto_env=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      48    echo "sdkman_beta_channel=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      49    echo "sdkman_colour_enable=true" >> "$pkgdir/$_sdkmandir/etc/config"
    
      50    echo "sdkman_curl_connect_timeout=7" >> "$pkgdir/$_sdkmandir/etc/config"
    
      51    echo "sdkman_curl_max_time=10" >> "$pkgdir/$_sdkmandir/etc/config"
    
      52    echo "sdkman_debug_mode=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      53    echo "sdkman_insecure_ssl=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      54    echo "sdkman_rosetta2_compatible=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      55    echo "sdkman_selfupdate_feature=false" >> "$pkgdir/$_sdkmandir/etc/config"
    
      56
    
      57    echo "$pkgver" > "$pkgdir/$_sdkmandir/var/version"
    
      58    echo "$_nativepkgver" > "$pkgdir/$_sdkmandir/var/version_native"
    
      59
    
      60    if [ $CARCH = "x86_64" ]; then
    
      61        echo "linuxx64" >> "$pkgdir/$_sdkmandir/var/platform"
    
      62    elif [ $CARCH = "aarch64" ]; then
    
      63        echo "linuxarm64" >> "$pkgdir/$_sdkmandir/var/platform"
    
      64    fi
    
      65
    
      66    install -Dm755 "${srcdir}/$_zipnativedir/libexec"/* -t "$pkgdir/$_sdkmandir/libexec"
    
      67}
    
      68
    
      69sha256sums_x86_64=('301de44c2455c061c8ac40fae194dd9287251115e34f8d86de68914510eb12c9'
    
      70                   'd5130a98a6bfbda78dbfe50515996c40f53fce99c5d62748a80ca901d81163b3')
    
      71sha256sums_aarch64=('301de44c2455c061c8ac40fae194dd9287251115e34f8d86de68914510eb12c9'
    
      72                    '5f8645c47e06ddf34f8925fe799f1d87c382689893dca839145051a30c462fa5')
    
      73

Changes since previous scan

--- PKGBUILD @ 2026-09-05 00:16
+++ PKGBUILD @ 2026-09-17 00:27
@@ -2,8 +2,8 @@
 
 pkgname=sdkman-bin
 pkgver=5.22.5
-_nativepkgver=0.7.34
-pkgrel=2
+_nativepkgver=0.7.35
+pkgrel=3
 pkgdesc="The Software Development Kit Manager Command Line Interface"
 arch=('x86_64' 'aarch64')
 url="https://sdkman.io/"
@@ -67,7 +67,7 @@
 }
 
 sha256sums_x86_64=('301de44c2455c061c8ac40fae194dd9287251115e34f8d86de68914510eb12c9'
-                   'd268e17a36f6fae542bb38018f2bfadf60689c4c1de0bff2dcfdace0855ddf0a')
+                   'd5130a98a6bfbda78dbfe50515996c40f53fce99c5d62748a80ca901d81163b3')
 sha256sums_aarch64=('301de44c2455c061c8ac40fae194dd9287251115e34f8d86de68914510eb12c9'
-                    '79b2747107aaeca1c4d3c1fea1178ec34210e43949633771b5c31f08c353ee7b')
+                    '5f8645c47e06ddf34f8925fe799f1d87c382689893dca839145051a30c462fa5')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 16:00:23	Medium	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2