amber-package-manager
maintainer Anysets
· 1 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package builds from source hosted on a non-whitelisted but plausibly project-related host (gitlink.org.cn), and the build process is transparent; the installed files are scripts and binaries built from that source, with no evidence of remote code execution or obfuscated payloads.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on a non-whitelisted but plausibly project-related host (gitlink.org.cn), and the build process is transparent; the installed files are scripts and binaries built from that source, with no evidence of remote code execution or obfuscated payloads.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=("$pkgname-$pkgver-1.tar.gz::https://cdn09022024.gitlink.org.cn/api/v1/repos/shenmo7192/amber-pm/archive/${pkgver}.tar.gz") -
PKGBUILD:22
source_aarch64=("https://gitee.com/amber-ce/amber-pm/releases/download/1.2.3/ace-env-arm64.tar.xz")
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: xmp360 <1666451428@qq.com>
2
# Maintainer: Anysets <anysets@qq.com>
3
# Maintainer: shenmo <shenmo@spark-app.store>
4
5
pkgname=amber-package-manager
6
pkgver=1.3.4.0
7
pkgrel=3
8
pkgdesc="bwrap wrapper for install and running debs inside a Amber-PM container"
9
arch=('x86_64' 'aarch64')
10
url="https://gitee.com/amber-ce/amber-pm/"
11
license=('AGPL-3.0')
12
depends=('bubblewrap' 'flatpak' 'polkit' 'systemd' 'procps-ng' 'coreutils' 'fuse-overlayfs')
13
optdepends=('dpkg: Enable amber-pm-convert (A tool to convert Debian packages to Amber-PM packages)')
14
conflicts=('ace-host-integration')
15
# provides=('amber-package-manager')
16
17
# source=("$pkgname-$pkgver.tar.gz::https://gitee.com/amber-ce/amber-pm/repository/archive/${pkgver}.tar.gz")
18
source=("$pkgname-$pkgver-1.tar.gz::https://cdn09022024.gitlink.org.cn/api/v1/repos/shenmo7192/amber-pm/archive/${pkgver}.tar.gz")
19
# https://www.gitlink.org.cn/shenmo7192/amber-pm/releases/download/1.3.4.0/apm_1.3.4.0_amd64.deb
20
21
# source_aarch64=("https://gitee.com/amber-ce/amber-pm/releases/download/1.2.3/ace-env-arm64.tar.xz")
22
source_aarch64=("https://gitee.com/amber-ce/amber-pm/releases/download/1.2.3/ace-env-arm64.tar.xz")
23
24
sha256sums=('99e6302fd1a17857f797d6ac0df1f1cd4788406760c30338d0a297967de4b9f7')
25
sha256sums_aarch64=('b99a96854f8fcba405d46b8a749b07edf584e6119f8bf9b131dfcaaa9b4ad552')
26
27
install=amber-package-manager.install
28
build() {
29
if [[ "$CARCH" == "aarch64" ]]; then
30
# cp -f "$srcdir/ace-env-arm64.tar.xz" "$srcdir/amber-pm-${pkgver}/src/var/lib/apm/apm/files/ace-env.tar.xz"
31
cp -f "$srcdir/ace-env-arm64.tar.xz" "$srcdir/amber-pm/src/var/lib/apm/apm/files/ace-env.tar.xz"
32
fi
33
34
# cd "$srcdir/amber-pm-${pkgver}"
35
# bash build.sh "$srcdir/amber-pm-${pkgver}/src"
36
cd "$srcdir/amber-pm"
37
bash build.sh "$srcdir/amber-pm/src"
38
}
39
package() {
40
41
# cd "$srcdir/amber-pm-${pkgver}/src"
42
cd "$srcdir/amber-pm/src"
43
44
install -d "$pkgdir/var/lib/apm"
45
cp -a etc "$pkgdir/"
46
cp -a usr "$pkgdir/"
47
cp -a var "$pkgdir/"
48
49
# rm -rf "${pkgdir}/usr/share/fish"
50
51
# cd "$pkgdir/"
52
# chmod 755 -R .
53
54
55
find "$pkgdir" -type d -exec chmod 755 {} \;
56
57
find "$pkgdir/etc/profile.d" -name "*.sh" -exec chmod 755 {} \;
58
find "$pkgdir/etc/X11/Xsession.d" -name "*" -exec chmod 755 {} \;
59
find "$pkgdir/usr/bin" -type f -exec chmod 755 {} \;
60
find "$pkgdir/var/lib/apm/apm/files/bin" -type f -exec chmod 755 {} \;
61
find "$pkgdir/var/lib/apm/apm/files/amber-ce-tools/bin-override" -type f -exec chmod 755 {} \;
62
63
find "$pkgdir/usr/lib/systemd" -name "*.service" -exec chmod 644 {} \;
64
find "$pkgdir/usr/lib/systemd/user-environment-generators" -type f -exec chmod 755 {} \;
65
66
if [ -d "$pkgdir/usr/share/bash-completion/completions" ]; then
67
chmod 644 "$pkgdir/usr/share/bash-completion/completions/"*
68
fi
69
}
70
Changes since previous scan
--- PKGBUILD @ 2026-07-24 00:02+++ PKGBUILD @ 2026-08-03 00:08@@ -4,7 +4,7 @@ pkgname=amber-package-manager pkgver=1.3.4.0-pkgrel=2+pkgrel=3 pkgdesc="bwrap wrapper for install and running debs inside a Amber-PM container" arch=('x86_64' 'aarch64') url="https://gitee.com/amber-ce/amber-pm/"@@ -15,7 +15,7 @@ # provides=('amber-package-manager') # source=("$pkgname-$pkgver.tar.gz::https://gitee.com/amber-ce/amber-pm/repository/archive/${pkgver}.tar.gz")-source=("$pkgname-$pkgver.tar.gz::https://cdn09022024.gitlink.org.cn/api/v1/repos/shenmo7192/amber-pm/archive/${pkgver}.tar.gz")+source=("$pkgname-$pkgver-1.tar.gz::https://cdn09022024.gitlink.org.cn/api/v1/repos/shenmo7192/amber-pm/archive/${pkgver}.tar.gz") # https://www.gitlink.org.cn/shenmo7192/amber-pm/releases/download/1.3.4.0/apm_1.3.4.0_amd64.deb # source_aarch64=("https://gitee.com/amber-ce/amber-pm/releases/download/1.2.3/ace-env-arm64.tar.xz")Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 15:27:57 | MEDIUM | 1 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 05:19:42 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 15:58:03 | MEDIUM | 1 |
| 2026-07-18 00:14:48 | LOW | 2 |