spring-tools-for-eclipse
LOW
maintainer Musikolo
26 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source is a prebuilt tarball from spring.io's CDN, which is the official project host;虽非标准白名单域名 but plausibly legitimate, and the checksum is verified, reducing supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt tarball from spring.io's CDN, which is the official project host;虽非标准白名单域名 but plausibly legitimate, and the checksum is verified, reducing supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
"https://cdn.spring.io/spring-tools/release/dist/${_pkgver_release}/${_eclipse_pkgver_short}/${pkgname}-${_pkgver_release}-${_eclipse_pkgver}-linux.gtk.${arch}.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Current maintainer: Musikolo <musikolo {at} hotmail [dot] com>
2
# Previous maintainer: Joseph Post <joe [at] jcpst [dot] com>
3
# Previous maintainer: Andrew Paugh <andrew [dot] paugh [at] gmail [dot] com>
4
# Updates by maintainer: Chris Fordham <chris [at] fordham [hyphon] nagy [dot] id [dot] au>
5
# Original maintainer: Marcin
6
7
pkgname=spring-tools-for-eclipse
8
pkgver=5.4.0
9
_pkgver_release=$pkgver.RELEASE
10
_eclipse_pkgver=e4.41.0
11
_eclipse_pkgver_short=e4.41
12
pkgrel=1
13
pkgdesc="Spring Tools, aka Spring Tool Suite (STS), is the next generation of Spring tooling for Eclipse IDE."
14
arch=('x86_64')
15
url="https://spring.io/tools#eclipse"
16
depends=('unzip' 'java-runtime>=21')
17
provides=('spring-tool-suite')
18
conflicts=('spring-tool-suite')
19
install=${pkgname}.install
20
license=("EPL/1.1")
21
options=("!debug")
22
source=(
23
"https://cdn.spring.io/spring-tools/release/dist/${_pkgver_release}/${_eclipse_pkgver_short}/${pkgname}-${_pkgver_release}-${_eclipse_pkgver}-linux.gtk.${arch}.tar.gz"
24
"${pkgname}.desktop"
25
"spring-tools-for-eclipse.install"
26
)
27
sha256sums=('10d9ed3473132585dbe26da47b0f53a9e926eff929908cfd1200407c17bb55cc'
28
'1e2e23447e1d616480a790f36807ee64630a4ad71345834633e4e8f6e9bba066'
29
'99655c1631a60d8f3358488bf66b442dc8bb4abfae98681a49248399dfe10cd0')
30
31
package() {
32
# Install eclipse to version-agnostic st4e dirirectory
33
install -m755 -d "${pkgdir}/opt"
34
mv "${srcdir}/sts-${_pkgver_release}" "${pkgdir}/opt/st4e"
35
36
# Install misc
37
install -d ${pkgdir}/usr/bin ${pkgdir}/usr/share/applications
38
install -m644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/"
39
ln -s "/opt/st4e/SpringToolsForEclipse" ${pkgdir}/usr/bin/SpringToolsForEclipse
40
41
# Install icon
42
install -m755 -d "${pkgdir}/usr/share/icons/hicolor/scalable/apps"
43
ln -s "/opt/st4e/icon.xpm" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname}.xpm"
44
}
45
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |