Review Results

Comment

The change is limited to updating .SRCINFO metadata for a new Oracle JDK 8 point release and the package homepage. The source URL remains HTTPS and points to the expected Oracle/Adobe-hosted tarball for the new version, with corresponding checksum updates. No new build steps, scripts, patches, or privilege-related artifacts are introduced by this diff, so there is no evident security regression in the reviewed change.

@@ -1,8 +1,8 @@
 pkgbase = jdk8
 	pkgdesc = Oracle Java 8 Development Kit LTS
-	pkgver = 8u491
+	pkgver = 8u501
 	pkgrel = 1
-	url = https://www.oracle.com/technetwork/java/javase/downloads/index.html
+	url = https://www.oracle.com/java/technologies/javase/javase8u211-later-archive-downloads.html
 	install = jdk8.install
 	arch = x86_64
 	license = custom:Oracle

Comment

The change only updates the upstream JDK tarball URL from 8u491 to 8u501 and refreshes the corresponding checksums in .SRCINFO. The source remains an HTTPS download from the same Adobe-hosted location, with no new sources, scripts, build steps, or packaging logic introduced. I do not see any integrity or execution red flags in this metadata-only update.

@@ -41,19 +41,19 @@ pkgbase = jdk8
 	backup = etc/java-jdk8/psfont.properties.ja
 	backup = etc/java-jdk8/psfontj2d.properties
 	backup = etc/java-jdk8/sound.properties
-	source = https://cfdownload.adobe.com/pub/adobe/coldfusion/java/java8/java8u491/jdk/jdk-8u491-linux-x64.tar.gz
+	source = https://cfdownload.adobe.com/pub/adobe/coldfusion/java/java8/java8u501/jdk/jdk-8u501-linux-x64.tar.gz
 	source = jconsole-jdk8.desktop
 	source = jmc-jdk8.desktop
 	source = jvisualvm-jdk8.desktop
 	source = policytool-jdk8.desktop
 	source = readme.sh
-	md5sums = 64e1da87a154fb4cfb100714ee0d25fd
+	md5sums = 18897422ff699decd46afd5890ae9297
 	md5sums = 8a66f50efdc867ffd6a27168bc93b210
 	md5sums = 1cbde70639abd98db4bace284dbf2bc4
 	md5sums = f0b39865361437f3778ecbe6ffbc0a06
 	md5sums = 89704501aff8efe859c31968d8d168e6
 	md5sums = 46d719bf4872333ad6d138b050f1ad2d
-	sha256sums = 29b93a849cc47f62b38a504853bd472cea20bb04a1b1a512eb6c16be9a6a6d98
+	sha256sums = 4d0dc644547d3bb218a31c6c240f407d795233cef95857a24fd729a869df9b61
 	sha256sums = 65282603bd0804d162f3f7da47bc7f3c91373e87504297d6a6fd6f2f8a1ec4ee
 	sha256sums = 8f865b52946a9ab98556c56306c7e70ae7aa432b4d005c70df0bba9d2c3111b1
 	sha256sums = 144e6651fcea08d95f3148d3a8ad17deb93fec4dd9236d37d27d7c648230b870

Comment

The change only bumps the Oracle JDK 8 update metadata from 8u491 to 8u501 and updates the Oracle archive URL. I do not see any added build-time execution, external downloads outside the existing source mechanism, privilege escalation, or packaging changes. The source remains an Oracle HTTPS archive page, and the version/hash update is consistent with a normal upstream refresh. No new persistence or install-script behavior is introduced in the provided diff.

@@ -26,13 +26,14 @@ pkgname="${_pkgname}${_major}"
 #_minor='401'; _build='b10'; _hash='4d245f941845490c91360409ecffb3b4'
 #_minor='431'; _build='b10'; _hash='0d8f12bc927a4e2c9f8568ca567db4ee'
 #_minor='441'; _build='b07'; _hash='7ed26d28139143f38c58992680c214a5'
-_minor='491'; _build='b10'; _hash='f7fe8e644f724108bdb54139381e29a7'
+#_minor='491'; _build='b10'; _hash='f7fe8e644f724108bdb54139381e29a7'
+_minor='501'; _build='b08'; _hash='ba687cb3cbb24342adc8fdf890b993dc'
 pkgver="${_major}u${_minor}"
 pkgrel='1'
 pkgdesc="Oracle Java ${_major} Development Kit"
 pkgdesc+=' LTS'
 arch=('x86_64')
-url='https://www.oracle.com/technetwork/java/javase/downloads/index.html'
+url='https://www.oracle.com/java/technologies/javase/javase8u211-later-archive-downloads.html'
 license=('custom:Oracle')
 depends=('ca-certificates-java' 'hicolor-icon-theme' 'java-runtime-common' 'nss' 'xdg-utils')
 depends+=('java-environment-common')

Comment

The change only updates the recorded checksums for one source file in PKGBUILD. I did not see any new sources, build steps, network fetches, privilege changes, or packaging logic changes in the provided hunk. Assuming the new checksums correspond to an expected upstream source refresh, this is low risk and does not by itself indicate a security issue.

@@ -111,13 +112,13 @@ unset _srcfil
 unset XDG_DOWNLOAD_DIR
 fi
 
-md5sums=('64e1da87a154fb4cfb100714ee0d25fd'
+md5sums=('18897422ff699decd46afd5890ae9297'
          '8a66f50efdc867ffd6a27168bc93b210'
          '1cbde70639abd98db4bace284dbf2bc4'
          'f0b39865361437f3778ecbe6ffbc0a06'
          '89704501aff8efe859c31968d8d168e6'
          '46d719bf4872333ad6d138b050f1ad2d')
-sha256sums=('29b93a849cc47f62b38a504853bd472cea20bb04a1b1a512eb6c16be9a6a6d98'
+sha256sums=('4d0dc644547d3bb218a31c6c240f407d795233cef95857a24fd729a869df9b61'
             '65282603bd0804d162f3f7da47bc7f3c91373e87504297d6a6fd6f2f8a1ec4ee'
             '8f865b52946a9ab98556c56306c7e70ae7aa432b4d005c70df0bba9d2c3111b1'
             '144e6651fcea08d95f3148d3a8ad17deb93fec4dd9236d37d27d7c648230b870'

Comment

The change is a narrow shell-safety tweak in PKGBUILD: replacing manual `set -u` / `set +u` toggling with `local -; set -u` inside `prepare()` and `package()`. This only affects shell option scoping and does not introduce new sources, commands, network access, privilege changes, or packaging behavior. I see no security impact from this diff hunk alone.

@@ -152,15 +153,14 @@ if ! :; then
 fi
 
 prepare() {
-  set -u
+  local -; set -u
   cd "${_pkgname}1.${_major}.0_${_minor}"
   chmod 644 lib/amd64/*.so
   chmod 644 jre/lib/amd64/*.so
-  set +u
 }
 
 package() {
-  set -u
+  local -; set -u
   cd "${_pkgname}1.${_major}.0_${_minor}"
 
   set +u; msg2 'Creating directory structure...'; set -u

Comment

The change is a one-line removal of `set +u` inside a shell function in PKGBUILD. This does not introduce new commands, network access, privilege escalation, persistence, or packaging changes; it only alters shell error-handling state after a `sed` insertion into a policy file. Based on the provided diff alone, there is no security impact visible.

@@ -272,6 +272,5 @@ fi
   local _line
   _line="$(awk '/permission/{a=NR}; END{print a}' "${pkgdir}/etc/java-${_jname}/security/java.policy")"
   sed -e "${_line} a ${_text}" -i "${pkgdir}/etc/java-${_jname}/security/java.policy"
-  set +u
 }
 set +u