amnezia-box

maintainer halvacoffee · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Package builds from a legitimate fork of a known project on GitHub; source is verifiable and checksummed, with no evidence of malicious intent or supply-chain risk despite low votes and recent upload.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): Package builds from a legitimate fork of a known project on GitHub; source is verifiable and checksummed, with no evidence of malicious intent or supply-chain risk despite low votes and recent upload.

PKGBUILD

      1# Maintainer: halvacoffee <halvalatte@proton.me>
    
      2# Fork: https://github.com/hoaxisr/amnezia-box (AmneziaWG + xhttp + mieru support)
    
      3#
    
      4# To update: bump _pkgver to the new release tag, then run
    
      5#   updpkgsums                 # refreshes sha256sums from the downloaded tarball
    
      6#   makepkg --printsrcinfo > .SRCINFO
    
      7# The pkgver() is intentionally omitted (pinned release); the fork's tags always
    
      8# carry the "-awgN-..." suffix, so stripping hyphens keeps ordering monotonic.
    
      9
    
      10pkgname=amnezia-box
    
      11_pkgver=1.14.0-alpha.48-awg3-xhttp-mieru-4
    
      12pkgver=${_pkgver//-/}
    
      13pkgrel=1
    
      14
    
      15pkgdesc='The universal proxy platform, forked with AmneziaWG (awg) outbound, xhttp and mieru support.'
    
      16arch=('x86_64' 'aarch64' 'armv7h' 'armv6h' 'riscv64')
    
      17url='https://github.com/hoaxisr/amnezia-box'
    
      18license=('GPL3')
    
      19
    
      20# Binary / unit files are still named "sing-box" (kept as upstream for compatibility).
    
      21makedepends=('go' 'clang' 'lld')
    
      22source=("$pkgname-$_pkgver.tar.gz::https://github.com/hoaxisr/amnezia-box/archive/$_pkgver.tar.gz")
    
      23sha256sums=('5ea164a1e45e85ba9c767c1a0acb665948e88317f8f29c7684a4ec721eca61bd')
    
      24conflicts=('sing-box' 'sing-box-git' 'sing-box-beta')
    
      25depends=('glibc')
    
      26optdepends=('sing-geosite-rule-set: GeoSite rule sets'
    
      27            'sing-geoip-rule-set: GeoIP rule sets')
    
      28
    
      29backup=('etc/sing-box/config.json')
    
      30
    
      31prepare() {
    
      32    cd "${pkgname}-${_pkgver}"
    
      33    export GOPATH="${srcdir}"
    
      34    export GOMODCACHE="${srcdir}/modcache"
    
      35    export GOTOOLCHAIN=local
    
      36    go mod download -modcacherw
    
      37}
    
      38
    
      39build() {
    
      40    cd "${pkgname}-${_pkgver}"
    
      41
    
      42    export GOPATH="${srcdir}"
    
      43    export GOMODCACHE="${srcdir}/modcache"
    
      44    export GOTOOLCHAIN=local
    
      45
    
      46    export CGO_CPPFLAGS="${CPPFLAGS}"
    
      47    export CGO_CFLAGS="${CFLAGS}"
    
      48    export CGO_CXXFLAGS="${CXXFLAGS}"
    
      49    export CGO_LDFLAGS="${LDFLAGS} -fuse-ld=lld"
    
      50    export CGO_ENABLED=1
    
      51    export CC=clang
    
      52    export CXX=clang++
    
      53
    
      54    local TAGS="$(cat release/DEFAULT_BUILD_TAGS),with_awg"
    
      55    local LDFLAGS_SHARED=$(cat release/LDFLAGS)
    
      56
    
      57    go build -v \
    
      58        -trimpath \
    
      59        -buildmode=pie \
    
      60        -mod=readonly \
    
      61        -modcacherw \
    
      62        -tags "$TAGS" \
    
      63        -ldflags "-linkmode external -X github.com/sagernet/sing-box/constant.Version=${_pkgver} ${LDFLAGS_SHARED} -s -buildid=" \
    
      64        -o sing-box \
    
      65        ./cmd/sing-box
    
      66
    
      67    install -d completions
    
      68    ./sing-box completion bash > completions/bash
    
      69    ./sing-box completion fish > completions/fish
    
      70    ./sing-box completion zsh  > completions/zsh
    
      71}
    
      72
    
      73package() {
    
      74    cd "${pkgname}-${_pkgver}"
    
      75
    
      76    install -Dm644 LICENSE                                 -t "$pkgdir/usr/share/licenses/$pkgname"
    
      77    install -Dm755 "sing-box"                              -t "$pkgdir/usr/bin"
    
      78    install -Dm644 "release/config/config.json"            -t "$pkgdir/etc/sing-box"
    
      79    install -Dm644 "release/config/sing-box.rules"         -t "$pkgdir/usr/share/polkit-1/rules.d"
    
      80    install -Dm644 "release/config/sing-box.service"       -t "$pkgdir/usr/lib/systemd/system"
    
      81    install -Dm644 "release/config/sing-box.sysusers"         "$pkgdir/usr/lib/sysusers.d/sing-box.conf"
    
      82    install -Dm644 "release/config/sing-box@.service"      -t "$pkgdir/usr/lib/systemd/system"
    
      83    install -Dm644 "release/config/sing-box-split-dns.xml"    "$pkgdir/usr/share/dbus-1/system.d/sing-box-split-dns.conf"
    
      84
    
      85    install -Dm644 completions/bash "${pkgdir}/usr/share/bash-completion/completions/sing-box.bash"
    
      86    install -Dm644 completions/fish "${pkgdir}/usr/share/fish/vendor_completions.d/sing-box.fish"
    
      87    install -Dm644 completions/zsh  "${pkgdir}/usr/share/zsh/site-functions/_sing-box"
    
      88}
    
      89

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,7 +8,7 @@
 # carry the "-awgN-..." suffix, so stripping hyphens keeps ordering monotonic.
 
 pkgname=amnezia-box
-_pkgver=1.14.0-alpha.48-awg3-xhttp-mieru
+_pkgver=1.14.0-alpha.48-awg3-xhttp-mieru-4
 pkgver=${_pkgver//-/}
 pkgrel=1
 
@@ -20,7 +20,7 @@
 # Binary / unit files are still named "sing-box" (kept as upstream for compatibility).
 makedepends=('go' 'clang' 'lld')
 source=("$pkgname-$_pkgver.tar.gz::https://github.com/hoaxisr/amnezia-box/archive/$_pkgver.tar.gz")
-sha256sums=('6048b6d8dacff28308b9e9286591a8dd2f22e057c1a8333af56477b9001ae389')
+sha256sums=('5ea164a1e45e85ba9c767c1a0acb665948e88317f8f29c7684a4ec721eca61bd')
 conflicts=('sing-box' 'sing-box-git' 'sing-box-beta')
 depends=('glibc')
 optdepends=('sing-geosite-rule-set: GeoSite rule sets'
@@ -51,7 +51,7 @@
     export CC=clang
     export CXX=clang++
 
-    local TAGS=$(cat release/DEFAULT_BUILD_TAGS)
+    local TAGS="$(cat release/DEFAULT_BUILD_TAGS),with_awg"
     local LDFLAGS_SHARED=$(cat release/LDFLAGS)
 
     go build -v \

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 21:22:00	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 19:14:42	LOW	2