sun-wtk
maintainer di72nn
· 3 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The PKGBUILD downloads a prebuilt binary installer (a self-extracting shell script containing a ZIP payload) from a personal Dropbox link rather than from Oracle's official distribution servers. The binary is then executed indirectly: its payload is extracted with `dd` and `unzip`, and the resulting binaries are installed to /opt/sun-wtk and made executable. While a sha256sum is provided, Dropbox is not an official or verifiable Oracle mirror — the file could have been substituted at any time by whoever controls that Dropbox account. The original Oracle download URL for sun-wtk 2.5.2_01 is no longer available, which explains why a third-party mirror was used, but this does not eliminate the supply-chain risk of trusting an arbitrary personal file host for executed binaries. The sha256 checksum provides some integrity assurance, but the chain of custody from Oracle to this Dropbox link is unverifiable. This is a genuine medium-severity supply-chain concern.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:20
source=('sun_java_wireless_toolkit-2.5.2_01-linuxi486.bin.sh::https://www.dropbox.com/s/elxibfgkcxndo3k/sun_java_wireless_toolkit-2.5.2_01-linuxi486.bin.sh?dl=1'
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary installer (a self-extracting shell script containing a ZIP payload) from a personal Dropbox link rather than from Oracle's official distribution servers. The binary is then executed indirectly: its payload is extracted with `dd` and `unzip`, and the resulting binaries are installed to /opt/sun-wtk and made executable. While a sha256sum is provided, Dropbox is not an official or verifiable Oracle mirror — the file could have been substituted at any time by whoever controls that Dropbox account. The original Oracle download URL for sun-wtk 2.5.2_01 is no longer available, which explains why a third-party mirror was used, but this does not eliminate the supply-chain risk of trusting an arbitrary personal file host for executed binaries. The sha256 checksum provides some integrity assurance, but the chain of custody from Oracle to this Dropbox link is unverifiable. This is a genuine medium-severity supply-chain concern.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Dmitriy Bogdanov <di72nn at gmail dot com>
2
# Contributor: Xianwen Chen <xianwen.chen at gmail dot com>
3
# Contributor: Andreas Schönfelder <passtschu at freenet dot de>
4
5
pkgname=sun-wtk
6
pkgver="2.5.2_01"
7
pkgrel=3
8
pkgdesc="Sun Java Wireless Toolkit for CLDC (J2ME, MIDP)."
9
arch=('i686' 'x86_64')
10
url='http://www.oracle.com/technetwork/java/index-jsp-137162.html'
11
license=('custom')
12
depends=('java-runtime')
13
depends_i686=('gcc-libs' 'libxt')
14
depends_x86_64=('lib32-gcc-libs' 'lib32-libxt') # lib32-gcc-libs or gcc-libs?
15
optdepends=('java-environment: to do development')
16
optdepends_x86_64=('bin32-jre7-openjdk: to run `emulator`') # not sure, maybe needed for other executables
17
#makedepends=('zip' 'unzip') # needed for _CUSTOMIZE_CONFIG_PATH
18
provides=('j2me')
19
install='sun-wtk.install'
20
source=('sun_java_wireless_toolkit-2.5.2_01-linuxi486.bin.sh::https://www.dropbox.com/s/elxibfgkcxndo3k/sun_java_wireless_toolkit-2.5.2_01-linuxi486.bin.sh?dl=1'
21
'sun-wtk.install'
22
'sun-wtk.sh'
23
'sun-wtk.csh'
24
'ktoolbar.desktop'
25
'ktoolbar.png'
26
'LICENSE')
27
28
sha256sums=('416ea8c8dc56e3563fc92e89bb9dde243662272bc4c88121d8fc1074044b4bb2'
29
'759b4401b6f3870076702ea3e42a201315c9eb2abf78581accc879ac05e34917'
30
'e317910622eb03d747f2ce89e4b985a11a874446e0a84af09f8f5d1fcec15dd8'
31
'612fd83b88ceb6a0475f7bf773c803d364db8c00c458927b53317131d6358a14'
32
'9fe9d03d544a7ddbcccf079889a23ad1fc5d5dbc3f2d3c53203bc4955bbaf265'
33
'68629d04e2b02ba4938a20bdf86ff879fa3a7cdf864a2819da8df4ba49e42851'
34
'7749af872ba607cae59f7b5a74811c76d3b73dc42120b4473be8a051f779587e')
35
36
# in case you want to compare md5sum of the main blob to the old PKGBUILD value:
37
# http://pkgbuild.com/git/aur-mirror.git/tree/sun-wtk/PKGBUILD
38
#md5sums=('6b70b6e6d426eac121db8a087991589f' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
39
40
41
prepare() {
42
dd bs=1024 if="${srcdir}/sun_java_wireless_toolkit-2.5.2_01-linuxi486.bin.sh" of="${srcdir}/j2mewtk-unix.zip" skip=26 2>/dev/null
43
unzip -oq "${srcdir}/j2mewtk-unix.zip" -d "${srcdir}/"
44
45
# By default WTK saves some configuration files in ~/j2mewtk/
46
# Usually, you don't need to access it, so it is possible to hack WTK files a bit
47
# so WTK would use ~/.j2mewtk/ ("hidden" because of dot).
48
# If you want to enable such customization, uncomment the following line:
49
#_CUSTOMIZE_CONFIG_PATH=1
50
51
if [ $_CUSTOMIZE_CONFIG_PATH ]; then
52
cd "${srcdir}"
53
54
# \x08 - is the length of the new string
55
REPLACE_PATTERN='s:\x07j2mewtk:\x08\.j2mewtk:'
56
57
unzip -q bin/JadTool.jar com/sun/kvem/environment/KvemHome.class
58
sed -i $REPLACE_PATTERN com/sun/kvem/environment/KvemHome.class
59
zip -qu bin/JadTool.jar com/sun/kvem/environment/KvemHome.class
60
rm -r com
61
62
unzip -q wtklib/kenv.zip com/sun/kvem/environment/KvemHome.class
63
sed -i $REPLACE_PATTERN com/sun/kvem/environment/KvemHome.class
64
zip -qu wtklib/kenv.zip com/sun/kvem/environment/KvemHome.class
65
rm -r com
66
fi
67
}
68
69
package() {
70
install -d "${pkgdir}/opt/sun-wtk"
71
72
# install docs and index.html to /usr/share/doc/sun-wtk ?
73
cp -pr "${srcdir}"/{apps,bin,docs,j2mewtk_template,lib,wtklib,index.html} "${pkgdir}/opt/sun-wtk/"
74
75
find "${pkgdir}/opt/sun-wtk/" -type d -exec chmod 755 {} \;
76
find "${pkgdir}/opt/sun-wtk/" -type f -exec chmod 644 {} \;
77
chmod 755 "${pkgdir}/opt/sun-wtk/bin/"*
78
chmod 644 "${pkgdir}/opt/sun-wtk/bin/"*.jar
79
chmod 644 "${pkgdir}/opt/sun-wtk/bin/"*.so
80
chmod 755 "${pkgdir}/opt/sun-wtk/apps/WMADemo/bridgeAPIExample/"*.sh
81
82
# `WTK_JRE_PATH` or `JAVA_HOME` may be used in runtime.
83
# Fallback order: $WTK_JRE_PATH -> $JAVA_HOME/bin -> /usr/lib/jvm/default/bin
84
vmpath='${WTK_JRE_PATH:-${JAVA_HOME:-/usr/lib/jvm/java-default-runtime/jre}}/bin/'
85
sed -i -e "s@javapathtowtk=.*@javapathtowtk=$vmpath@" \
86
"${pkgdir}/opt/sun-wtk/bin/"{ktoolbar,emulator,prefs,utils,defaultdevice,wscompile,mekeytool,siptool,i18ntool} \
87
"${pkgdir}/opt/sun-wtk/apps/WMADemo/bridgeAPIExample/runBridgeAPIExample.sh"
88
89
install -dm755 "${pkgdir}/etc/profile.d"
90
install -m755 "${srcdir}/sun-wtk."{csh,sh} "${pkgdir}/etc/profile.d/"
91
92
install -Dm644 "${srcdir}/ktoolbar.desktop" "${pkgdir}/usr/share/applications/ktoolbar.desktop"
93
install -Dm644 "${srcdir}/ktoolbar.png" "$pkgdir/usr/share/pixmaps/ktoolbar.png"
94
95
#sed -n 's_\r__; 4,122p; 123q' "${srcdir}/sun_java_wireless_toolkit-2.5.2_01-linuxi486.bin.sh" > LICENSE
96
install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
97
}
98
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |