spigot

MEDIUM

maintainer edh 29 votes scanned 2026-09-16 01:20:46.343777

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("BuildTools-${_pkgver}+b${_build}.jar::https://hub.spigotmc.org/jenkins/job/BuildTools/${_build}/artifact/target/BuildTools.jar"

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:63 chmod g+s "${pkgdir}${_server_root}"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Gordian Edenhofer <gordian.edenhofer@gmail.com>
    
      2# Submitter: Schala Zeal <schalaalexiazeal@gmail.com>
    
      3
    
      4pkgname=spigot
    
      5_pkgver=26.3
    
      6_build=201
    
      7pkgver="${_pkgver}+b${_build}"
    
      8pkgrel=1
    
      9_mng_ver=1.0.4
    
      10pkgdesc="High performance Minecraft server implementation"
    
      11arch=('any')
    
      12url="https://www.spigotmc.org/"
    
      13license=("LGPL")
    
      14depends=("java-runtime-headless>=17" 'tmux' 'sudo' 'fontconfig' 'bash' 'awk' 'sed')
    
      15optdepends=("tar: needed in order to create world backups"
    
      16	"netcat: required in order to suspend an idle server")
    
      17makedepends=("java-environment>=17" 'git')
    
      18provides=("minecraft-server=${_pkgver%_*}" "bukkit=${_pkgver%_*}" "craftbukkit=${_pkgver%_*}")
    
      19conflicts=("bukkit" "craftbukkit" "spigot-patcher")
    
      20backup=("etc/conf.d/${pkgname}")
    
      21install="${pkgname}.install"
    
      22source=("BuildTools-${_pkgver}+b${_build}.jar::https://hub.spigotmc.org/jenkins/job/BuildTools/${_build}/artifact/target/BuildTools.jar"
    
      23	"minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz")
    
      24sha512sums=('f12e5a99b199dec121f0ff3870093ee0695290156c0c5929d54b4ec861840589f2f860257e424b2dcfce6581ec9ec8849fa0b1783382fa0d84a7d57d090b34d5'
    
      25            'dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556')
    
      26
    
      27_game="spigot"
    
      28_server_root="/srv/craftbukkit"
    
      29
    
      30build() {
    
      31	export MAVEN_OPTS="-Xmx2g"
    
      32	java -jar "BuildTools-${_pkgver}+b${_build}.jar" --rev "${_pkgver}"
    
      33
    
      34	make -C "${srcdir}/minecraft-server-${_mng_ver}" clean
    
      35
    
      36	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      37		GAME=${_game} \
    
      38		INAME=${_game} \
    
      39		SERVER_ROOT=${_server_root} \
    
      40		BACKUP_PATHS="world world_nether world_the_end" \
    
      41		GAME_USER=craftbukkit \
    
      42		MAIN_EXECUTABLE=spigot.jar \
    
      43		SERVER_START_CMD="java -Xms512M -Xmx1024M -jar ./spigot.jar nogui" \
    
      44		all
    
      45}
    
      46
    
      47package() {
    
      48	make -C "${srcdir}/minecraft-server-${_mng_ver}" \
    
      49		DESTDIR="${pkgdir}" \
    
      50		GAME=${_game} \
    
      51		INAME=${_game} \
    
      52		install
    
      53
    
      54	install -Dm644 "${_game}-${_pkgver}.jar" "${pkgdir}${_server_root}/${_game}.${_pkgver}.jar"
    
      55	ln -s "${_game}.${_pkgver}.jar" "${pkgdir}${_server_root}/${_game}.jar"
    
      56
    
      57	# Link the log files
    
      58	mkdir -p "${pkgdir}/var/log/"
    
      59	install -dm2775 "${pkgdir}/${_server_root}/logs"
    
      60	ln -s "${_server_root}/logs" "${pkgdir}/var/log/${_game}"
    
      61
    
      62	# Give the group write permissions and set user or group ID on execution
    
      63	chmod g+s "${pkgdir}${_server_root}"
    
      64
    
      65	# Make plugins folder ready for drag and drop
    
      66	install -dm2775 "${pkgdir}/${_server_root}/plugins"
    
      67}
    
      68

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-09-16 01:20
@@ -2,8 +2,8 @@
 # Submitter: Schala Zeal <schalaalexiazeal@gmail.com>
 
 pkgname=spigot
-_pkgver=1.21.11
-_build=197
+_pkgver=26.3
+_build=201
 pkgver="${_pkgver}+b${_build}"
 pkgrel=1
 _mng_ver=1.0.4
@@ -21,7 +21,7 @@
 install="${pkgname}.install"
 source=("BuildTools-${_pkgver}+b${_build}.jar::https://hub.spigotmc.org/jenkins/job/BuildTools/${_build}/artifact/target/BuildTools.jar"
 	"minecraft-server-${_mng_ver}.tar.gz"::"https://github.com/Edenhofer/minecraft-server/archive/refs/tags/v${_mng_ver}.tar.gz")
-sha512sums=('d74067111afeab4ea4539f30ab6e906a38327293cb87fb9b9bedcf967c8dd6e8b32b0c445a9e14f3fb20f665d0e832ee8a2c1185ae666dceefed54461e2527e4'
+sha512sums=('f12e5a99b199dec121f0ff3870093ee0695290156c0c5929d54b4ec861840589f2f860257e424b2dcfce6581ec9ec8849fa0b1783382fa0d84a7d57d090b34d5'
             'dd4d68ca061c97a1e3cb5c0bb68439f7d8d45b15092344f3c4dbd4f7f39fef433d566670ad440970061007d93055183b570c7bf98f09c111ecdf8ab0f208f556')
 
 _game="spigot"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-16 01:20:46	Medium	2
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1