zulu-25-bin
LOW
maintainer rutorai
0 votes
scanned 2026-10-20 00:10:31.152894
Why flagged
The package downloads a prebuilt OpenJDK binary from Azul's official CDN, which is a legitimate source for Zulu builds; while the host is not on a standard whitelist, it is plausibly the project's own infrastructure, and the checksum is provided, reducing supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt OpenJDK binary from Azul's official CDN, which is a legitimate source for Zulu builds; while the host is not on a standard whitelist, it is plausibly the project's own infrastructure, and the checksum is provided, reducing supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
source_x86_64=("https://cdn.azul.com/zulu/bin/zulu${_zulu_build}-jdk${pkgver}-linux_x64.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
_java_ver=25
2
_jdkname="zulu-${_java_ver}"
3
_zulu_build="${_java_ver}.36.205-ca"
4
pkgname="${_jdkname}-bin"
5
pkgver="${_java_ver}.0.4.1"
6
pkgrel=1
7
pkgdesc='Azul Zulu builds of OpenJDK are open source, TCK-tested and certified builds of OpenJDK.'
8
arch=('x86_64')
9
url='https://www.azul.com/downloads/'
10
license=('custom')
11
depends=(
12
'java-environment-common>=3'
13
'java-runtime-common>=3'
14
'ca-certificates-utils'
15
)
16
provides=(
17
"java-environment=$_java_ver"
18
"java-environment-openjdk=$_java_ver"
19
"java-runtime-headless=$_java_ver"
20
"java-runtime-headless-openjdk=$_java_ver"
21
"java-runtime=$_java_ver"
22
"java-runtime-openjdk=$_java_ver"
23
)
24
install="$pkgname.install"
25
source_x86_64=("https://cdn.azul.com/zulu/bin/zulu${_zulu_build}-jdk${pkgver}-linux_x64.tar.gz")
26
sha256sums_x86_64=('e11d92589de8fd55616a843e0298ba72348848bd49b675088e930b67538497cb')
27
28
_jvmdir="/usr/lib/jvm/${_jdkname}"
29
30
package() {
31
if [ "${CARCH}" = "aarch64" ]; then
32
cd "$srcdir/zulu${_zulu_build}-jdk${pkgver}-linux_aarch64"
33
else
34
cd "$srcdir/zulu${_zulu_build}-jdk${pkgver}-linux_x64"
35
fi
36
37
install -dm 755 "${pkgdir}/${_jvmdir}"
38
cp -a . "${pkgdir}/${_jvmdir}/"
39
40
# based on java-openjdk package_jdk-openjdk
41
# https://github.com/archlinux/svntogit-packages/blob/3f6aa8ddd98f728a9b0701288a933d16f0e8bbaf/trunk/PKGBUILD
42
43
# Conf
44
install -dm 755 "${pkgdir}/etc"
45
cp -r conf "${pkgdir}/etc/${_jdkname}"
46
rm -r "${pkgdir}/${_jvmdir}/conf"
47
ln -s "/etc/${_jdkname}" "${pkgdir}/${_jvmdir}/conf"
48
49
# Legal
50
install -dm 755 "${pkgdir}/usr/share/licenses"
51
cp -r legal "${pkgdir}/usr/share/licenses/${_jdkname}"
52
rm -r "${pkgdir}/${_jvmdir}/legal"
53
ln -s "/usr/share/licenses/${_jdkname}" "${pkgdir}/${_jvmdir}/legal"
54
55
# Man pages
56
for f in bin/*; do
57
f=$(basename "${f}")
58
_man=man/man1/"${f}.1"
59
test -f "${_man}" && install -Dm 644 "${_man}" "${pkgdir}/usr/share/man/man1/${f}-${_jdkname}.1"
60
done
61
rm -r "${pkgdir}/${_jvmdir}/man"
62
ln -s /usr/share/man "${pkgdir}/${_jvmdir}/man"
63
64
# Link JKS keystore from ca-certificates-utils
65
rm -f "${pkgdir}/${_jvmdir}/lib/security/cacerts"
66
ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}/${_jvmdir}/lib/security/cacerts"
67
}
68
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |