zulu-17-bin

LOW

maintainer linesofcodes 10 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package downloads prebuilt Zulu JDK binaries from Azul's official CDN (cdn.azul.com), which is the legitimate source for these builds; despite the static analyzer flag for a non-standard host, this is a normal and expected source for the software, and the downloads are verified via sha256sums.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Zulu JDK binaries from Azul's official CDN (cdn.azul.com), which is the legitimate source for these builds; despite the static analyzer flag for a non-standard host, this is a normal and expected source for the software, and the downloads are verified via sha256sums.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source_aarch64=("https://cdn.azul.com/zulu/bin/zulu${_zulu_build}-jdk${pkgver}-linux_aarch64.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1_java_ver=17
    
      2_jdkname="zulu-${_java_ver}"
    
      3_zulu_build="${_java_ver}.68.203-ca"
    
      4pkgname="${_jdkname}-bin"
    
      5pkgver="${_java_ver}.0.20.1"
    
      6pkgrel=1
    
      7pkgdesc='Azul Zulu builds of OpenJDK are open source, TCK-tested and certified builds of OpenJDK.'
    
      8arch=('aarch64' 'i686' 'x86_64')
    
      9url='https://www.azul.com/downloads/'
    
      10license=('custom')
    
      11depends=(
    
      12  'java-environment-common>=3'
    
      13  'java-runtime-common>=3'
    
      14  'ca-certificates-utils'
    
      15)
    
      16provides=(
    
      17  "java-environment=$_java_ver"
    
      18  "java-environment-openjdk=$_java_ver"
    
      19  "java-runtime-headless=$_java_ver"
    
      20  "java-runtime-headless-openjdk=$_java_ver"
    
      21  "java-runtime=$_java_ver"
    
      22  "java-runtime-openjdk=$_java_ver"
    
      23)
    
      24install="$pkgname.install"
    
      25options=(!strip !debug)
    
      26source_aarch64=("https://cdn.azul.com/zulu/bin/zulu${_zulu_build}-jdk${pkgver}-linux_aarch64.tar.gz")
    
      27source_i686=("https://cdn.azul.com/zulu/bin/zulu${_zulu_build}-jdk${pkgver}-linux_i686.tar.gz")
    
      28source_x86_64=("https://cdn.azul.com/zulu/bin/zulu${_zulu_build}-jdk${pkgver}-linux_x64.tar.gz")
    
      29sha256sums_aarch64=('aa10cb26f73fb1b50dcd72a51851f7eedaf75cb5c18760e521884f96c98defd2')
    
      30sha256sums_i686=('827e3c6cf115189cc2aa440f7805ecea24bbc70e41d45010b93f27555f235c36')
    
      31sha256sums_x86_64=('4ef843383724c7cee278b90aabe41c9ae172a3b2584ab0e086857bb536ef060f')
    
      32
    
      33_jvmdir="/usr/lib/jvm/${_jdkname}"
    
      34
    
      35package() {
    
      36  if [ "${CARCH}" = "aarch64" ]; then
    
      37    cd "$srcdir/zulu${_zulu_build}-jdk${pkgver}-linux_aarch64"
    
      38  elif [ "${CARCH}" = "i686" ]; then
    
      39    cd "$srcdir/zulu${_zulu_build}-jdk${pkgver}-linux_i686"
    
      40  else
    
      41    cd "$srcdir/zulu${_zulu_build}-jdk${pkgver}-linux_x64"
    
      42  fi
    
      43
    
      44  install -dm 755 "${pkgdir}/${_jvmdir}"
    
      45  cp -a . "${pkgdir}/${_jvmdir}/"
    
      46
    
      47  # based on java-openjdk package_jdk-openjdk
    
      48  # https://github.com/archlinux/svntogit-packages/blob/3f6aa8ddd98f728a9b0701288a933d16f0e8bbaf/trunk/PKGBUILD
    
      49
    
      50  # Conf
    
      51  install -dm 755 "${pkgdir}/etc"
    
      52  cp -r conf "${pkgdir}/etc/${_jdkname}"
    
      53  rm -r "${pkgdir}/${_jvmdir}/conf"
    
      54  ln -s "/etc/${_jdkname}" "${pkgdir}/${_jvmdir}/conf"
    
      55
    
      56  # Legal
    
      57  install -dm 755 "${pkgdir}/usr/share/licenses"
    
      58  cp -r legal "${pkgdir}/usr/share/licenses/${_jdkname}"
    
      59  rm -r "${pkgdir}/${_jvmdir}/legal"
    
      60  ln -s "/usr/share/licenses/${_jdkname}" "${pkgdir}/${_jvmdir}/legal"
    
      61
    
      62  # Man pages
    
      63  for f in bin/*; do
    
      64    f=$(basename "${f}")
    
      65    _man=man/man1/"${f}.1"
    
      66    test -f "${_man}" && install -Dm 644 "${_man}" "${pkgdir}/usr/share/man/man1/${f}-${_jdkname}.1"
    
      67  done
    
      68  rm -r "${pkgdir}/${_jvmdir}/man"
    
      69  ln -s /usr/share/man "${pkgdir}/${_jvmdir}/man"
    
      70
    
      71  # Link JKS keystore from ca-certificates-utils
    
      72  rm -f "${pkgdir}/${_jvmdir}/lib/security/cacerts"
    
      73  ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}/${_jvmdir}/lib/security/cacerts"
    
      74}
    
      75

Changes since previous scan

--- PKGBUILD @ 2026-09-22 00:15
+++ PKGBUILD @ 2026-10-06 00:13
@@ -1,8 +1,8 @@
 _java_ver=17
 _jdkname="zulu-${_java_ver}"
-_zulu_build="${_java_ver}.68.17-ca"
+_zulu_build="${_java_ver}.68.203-ca"
 pkgname="${_jdkname}-bin"
-pkgver="${_java_ver}.0.20"
+pkgver="${_java_ver}.0.20.1"
 pkgrel=1
 pkgdesc='Azul Zulu builds of OpenJDK are open source, TCK-tested and certified builds of OpenJDK.'
 arch=('aarch64' 'i686' 'x86_64')
@@ -26,9 +26,9 @@
 source_aarch64=("https://cdn.azul.com/zulu/bin/zulu${_zulu_build}-jdk${pkgver}-linux_aarch64.tar.gz")
 source_i686=("https://cdn.azul.com/zulu/bin/zulu${_zulu_build}-jdk${pkgver}-linux_i686.tar.gz")
 source_x86_64=("https://cdn.azul.com/zulu/bin/zulu${_zulu_build}-jdk${pkgver}-linux_x64.tar.gz")
-sha256sums_aarch64=('46f1dc7678760d37d38699c5a5a34dea8ed451dcdf6d27890a7b61f025e7ff60')
-sha256sums_i686=('fc51a5a4551c697a56324bf63052e76302d9491407a6bbf48a43f57a1e4f2e88')
-sha256sums_x86_64=('32c5efedf69f4a95635ea2923f6a6ee90ce6ca83df0bd43ba55dd662d5af429a')
+sha256sums_aarch64=('aa10cb26f73fb1b50dcd72a51851f7eedaf75cb5c18760e521884f96c98defd2')
+sha256sums_i686=('827e3c6cf115189cc2aa440f7805ecea24bbc70e41d45010b93f27555f235c36')
+sha256sums_x86_64=('4ef843383724c7cee278b90aabe41c9ae172a3b2584ab0e086857bb536ef060f')
 
 _jvmdir="/usr/lib/jvm/${_jdkname}"
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 19:39:10	Medium	1
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2