zulu-8-jdk-fx

LOW

maintainer KSSJW 0 votes scanned 2026-10-17 13:19:51.964758

View on AUR

Why flagged

Downloads a prebuilt JDK binary from cdn.azul.com, which is Azul's own official CDN for Zulu JDK distributions; checksums are provided and non-SKIP'd, making this a legitimate vendor binary package with no obfuscation or exfiltration concerns.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): Downloads a prebuilt JDK binary from cdn.azul.com, which is Azul's own official CDN for Zulu JDK distributions; checksums are provided and non-SKIP'd, making this a legitimate vendor binary package with no obfuscation or exfiltration concerns.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:37 source_x86_64=("https://cdn.azul.com/zulu/bin/zulu${_zuluver}-ca-fx-jdk${_jdkver}-linux_x64.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1pkgname=zulu-8-jdk-fx
    
      2pkgver=8.96.0.205
    
      3pkgrel=1
    
      4pkgdesc='Azul Zulu JDK 8 with JavaFX'
    
      5arch=(
    
      6    'x86_64'
    
      7    'i686'
    
      8    'aarch64'
    
      9)
    
      10url='https://www.azul.com/downloads'
    
      11license=('custom')
    
      12
    
      13_jvm='java-8-zulu-fx'
    
      14_javaver=8
    
      15_zuluver=8.96.0.205
    
      16_jdkver=8.0.504
    
      17_sha256_x86_64='c5dcd67eac70e56154e06fa1dca88d27b5a66114835303155f3388e130bb430a'
    
      18_sha256_i686='510631f9071876cc2f50bcbc629e5c865d4abd0ec470c6d516cb66c129feb79d'
    
      19_sha256_aarch64='0b65b52711f00c616224d41742ace7e3a160042cb94c349272abee7b8dc4c814'
    
      20
    
      21depends=(
    
      22    'java-runtime-common'
    
      23    'java-environment-common'
    
      24)
    
      25provides=(
    
      26    "java-environment=${_javaver}"
    
      27    "java-environment-openjdk=${_javaver}"
    
      28    "java-runtime=${_javaver}"
    
      29    "java-runtime-openjdk=${_javaver}"
    
      30    "java-runtime-headless=${_javaver}"
    
      31    "java-runtime-headless-openjdk=${_javaver}"
    
      32    "java-openjfx=${_javaver}"
    
      33)
    
      34install="${pkgname}.install"
    
      35options=('!strip')
    
      36
    
      37source_x86_64=("https://cdn.azul.com/zulu/bin/zulu${_zuluver}-ca-fx-jdk${_jdkver}-linux_x64.tar.gz")
    
      38sha256sums_x86_64=("${_sha256_x86_64}")
    
      39source_i686=("https://cdn.azul.com/zulu/bin/zulu${_zuluver}-ca-fx-jdk${_jdkver}-linux_i686.tar.gz")
    
      40sha256sums_i686=("${_sha256_i686}")
    
      41source_aarch64=("https://cdn.azul.com/zulu/bin/zulu${_zuluver}-ca-fx-jdk${_jdkver}-linux_aarch64.tar.gz")
    
      42sha256sums_aarch64=("${_sha256_aarch64}")
    
      43
    
      44case "$CARCH" in
    
      45    x86_64)
    
      46        _filename="zulu${_zuluver}-ca-fx-jdk${_jdkver}-linux_x64"
    
      47        ;;
    
      48    i686)
    
      49        _filename="zulu${_zuluver}-ca-fx-jdk${_jdkver}-linux_i686"
    
      50        ;;
    
      51    aarch64)
    
      52        _filename="zulu${_zuluver}-ca-fx-jdk${_jdkver}-linux_aarch64"
    
      53        ;;
    
      54    *)
    
      55        printf 'Unsupported architecture: %s\n' "$CARCH" >&2
    
      56        exit 1
    
      57        ;;
    
      58esac
    
      59
    
      60package() {
    
      61    local install_dir="${pkgdir}/usr/lib/jvm/${_jvm}"
    
      62    local license_dir="${pkgdir}/usr/share/licenses/${pkgname}"
    
      63    local man_dir="${pkgdir}/usr/share/man/man1"
    
      64
    
      65    install -d "${install_dir}"
    
      66    cp -a "${srcdir}/${_filename}/." "${install_dir}/"
    
      67
    
      68    install -d "${license_dir}"
    
      69    mkdir "${license_dir}/jre"
    
      70    mv "${install_dir}/jre/ASSEMBLY_EXCEPTION" "${license_dir}/jre/"
    
      71    mv "${install_dir}/jre/LICENSE" "${license_dir}/jre/"
    
      72    mv "${install_dir}/ASSEMBLY_EXCEPTION" "${license_dir}/"
    
      73    mv "${install_dir}/DISCLAIMER" "${license_dir}/"
    
      74    mv "${install_dir}/LICENSE" "${license_dir}/"
    
      75    mv "${install_dir}/OPENJFX_LICENSE" "${license_dir}/"
    
      76
    
      77    install -d "${man_dir}"
    
      78
    
      79    for man_page in "${install_dir}"/man/man1/*.1; do
    
      80        local man_name="${man_page##*/}"
    
      81        mv "${man_page}" "${man_dir}/${man_name%.1}-zulu${_javaver}.1"
    
      82    done
    
      83
    
      84    rm -r "${install_dir}/man"
    
      85    ln -s "/usr/share/man" "${install_dir}/man"
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 13:19:51	Low	3
2026-10-17 13:18:05	Medium	2