spigot

LOW

maintainer edh 29 votes scanned 2026-10-31 00:07:41.364992

View on AUR

Why flagged

The package builds Spigot from source using official Jenkins and GitHub repositories, and the only privileged action is setting group permissions for the server directory, which is a normal requirement for Minecraft servers and not inherently malicious.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds Spigot from source using official Jenkins and GitHub repositories, and the only privileged action is setting group permissions for the server directory, which is a normal requirement for Minecraft servers and not inherently malicious.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("BuildTools-${_pkgver}+b${_build}.jar::https://hub.spigotmc.org/jenkins/job/BuildTools/${_build}/artifact/target/BuildTools.jar"

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:63 chmod g+s "${pkgdir}${_server_root}"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Gordian Edenhofer <gordian.edenhofer@gmail.com>
    
      2# Submitter: Schala Zeal <schalaalexiazeal@gmail.com>
    
      3
    
      4pkgname=spigot
    
      5_pkgver=26.3
    
      6_build=201
    
      7pkgver="${_pkgver}+b${_build}"
    
      8pkgrel=1
    
      9_mng_ver=1.0.4
    
      10pkgdesc="High performance Minecraft server implementation"
    
      11arch=('any')
    
      12url="https://www.spigotmc.org/"
    
      13license=("LGPL")
    
      14depends=("java-runtime-headless>=17" 'tmux' 'sudo' 'fontconfig' 'bash' 'awk' 'sed')
    
      15optdepends=("tar: needed in order to create world backups"
    
      16	"netcat: required in order to suspend an idle server")
    
      17makedepends=("java-environment>=17" 'git')
    
      18provides=("minecraft-server=${_pkgver%_*}" "bukkit=${_pkgver%_*}" "craftbukkit=${_pkgver%_*}")
    
      19conflicts=("bukkit" "craftbukkit" "spigot-patcher")
    
      20backup=("etc/conf.d/${pkgname}")
    
      21install="${pkgname}.install"
    
      22source=("BuildTools-${_pkgver}+b${_build}.jar::https://hub.spigotmc.org/jenkins/job/BuildTools/${_build}/artifact/target/BuildTools.jar"
    
      23	"minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz")
    
      24sha512sums=('f12e5a99b199dec121f0ff3870093ee0695290156c0c5929d54b4ec861840589f2f860257e424b2dcfce6581ec9ec8849fa0b1783382fa0d84a7d57d090b34d5'
    
      25            'dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556')
    
      26
    
      27_game="spigot"
    
      28_server_root="/srv/craftbukkit"
    
      29
    
      30build() {
    
      31	export MAVEN_OPTS="-Xmx2g"
    
      32	java -jar "BuildTools-${_pkgver}+b${_build}.jar" --rev "${_pkgver}"
    
      33
    
      34	make -C "${srcdir}/minecraft-server-${_mng_ver}" clean
    
      35
    
      36	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      37		GAME=${_game} \
    
      38		INAME=${_game} \
    
      39		SERVER_ROOT=${_server_root} \
    
      40		BACKUP_PATHS="world world_nether world_the_end" \
    
      41		GAME_USER=craftbukkit \
    
      42		MAIN_EXECUTABLE=spigot.jar \
    
      43		SERVER_START_CMD="java -Xms512M -Xmx1024M -jar ./spigot.jar nogui" \
    
      44		all
    
      45}
    
      46
    
      47package() {
    
      48	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      49		DESTDIR="${pkgdir}" \
    
      50		GAME=${_game} \
    
      51		INAME=${_game} \
    
      52		install
    
      53
    
      54	install -Dm644 "${_game}-${_pkgver}.jar" "${pkgdir}${_server_root}/${_game}.${_pkgver}.jar"
    
      55	ln -s "${_game}.${_pkgver}.jar" "${pkgdir}${_server_root}/${_game}.jar"
    
      56
    
      57	# Link the log files
    
      58	mkdir -p "${pkgdir}/var/log/"
    
      59	install -dm2775 "${pkgdir}/${_server_root}/logs"
    
      60	ln -s "${_server_root}/logs" "${pkgdir}/var/log/${_game}"
    
      61
    
      62	# Give the group write permissions and set user or group ID on execution
    
      63	chmod g+s "${pkgdir}${_server_root}"
    
      64
    
      65	# Make plugins folder ready for drag and drop
    
      66	install -dm2775 "${pkgdir}/${_server_root}/plugins"
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-31 00:07:41	Low	3
2026-10-30 00:29:30	Low	3
2026-10-29 00:13:55	Low	3
2026-10-28 00:06:54	Low	3
2026-10-27 00:23:28	Low	3
2026-10-26 00:12:40	Low	3
2026-10-25 00:20:48	Low	3
2026-10-24 00:14:55	Low	3
2026-10-23 00:02:19	Low	3
2026-10-22 00:13:10	Low	3
2026-10-21 00:12:50	Low	3
2026-10-20 00:10:31	Low	3
2026-10-19 00:03:55	Low	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 00:23:45	Low	3
2026-10-12 00:18:51	Low	3