amnezia-box-git

maintainer halvacoffee · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged Package builds from a forked Git repository with a SKIP'd checksum, but compiles source code from a plausible project-owned source; no remote code execution or malicious payload observed, typical for a development AUR package.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package builds from a forked Git repository with a SKIP'd checksum, but compiles source code from a plausible project-owned source; no remote code execution or malicious payload observed, typical for a development AUR package.

PKGBUILD

1# Maintainer: halvacoffee <halvalatte@proton.me>
2# Fork: https://github.com/hoaxisr/amnezia-box (AmneziaWG + xhttp + mieru support)
3#
4# This is the development package: it builds from the tip of the awg-1.14 branch
5# (latest commit), not a tagged release. pkgver() derives a monotonic version from
6# the latest tag + commit count + short hash, so AUR rebuilds sort correctly.
7#
8# To update the tracked branch, change _branch below and regenerate .SRCINFO.
9
10pkgname=amnezia-box-git
11_branch=awg-1.14
12pkgver=1.14.0alpha.48awg3xhttpmieru.r2546.930d9b79
13pkgrel=1
14
15pkgdesc='The universal proxy platform, forked with AmneziaWG (awg) outbound, xhttp and mieru support. Development build from latest commit.'
16arch=('x86_64' 'aarch64' 'armv7h' 'armv6h' 'riscv64')
17url='https://github.com/hoaxisr/amnezia-box'
18license=('GPL3')
19
20# Binary / unit files are still named "sing-box" (kept as upstream for compatibility).
21makedepends=('git' 'go' 'clang' 'lld')
22source=("$pkgname::git+https://github.com/hoaxisr/amnezia-box.git#branch=$_branch")
23sha256sums=('SKIP')
24conflicts=('sing-box' 'sing-box-git' 'sing-box-beta' 'amnezia-box')
25depends=('glibc')
26optdepends=('sing-geosite-rule-set: GeoSite rule sets'
27 'sing-geoip-rule-set: GeoIP rule sets')
28
29backup=('etc/sing-box/config.json')
30
31pkgver() {
32 cd "$pkgname"
33 local tag
34 tag=$(git describe --tags --abbrev=0 2>/dev/null | tr -d '-')
35 printf '%s.r%s.%s' "$tag" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
36}
37
38prepare() {
39 cd "$pkgname"
40 export GOPATH="${srcdir}"
41 export GOMODCACHE="${srcdir}/modcache"
42 export GOTOOLCHAIN=local
43 go mod download -modcacherw
44}
45
46build() {
47 cd "$pkgname"
48
49 export GOPATH="${srcdir}"
50 export GOMODCACHE="${srcdir}/modcache"
51 export GOTOOLCHAIN=local
52
53 export CGO_CPPFLAGS="${CPPFLAGS}"
54 export CGO_CFLAGS="${CFLAGS}"
55 export CGO_CXXFLAGS="${CXXFLAGS}"
56 export CGO_LDFLAGS="${LDFLAGS} -fuse-ld=lld"
57 export CGO_ENABLED=1
58 export CC=clang
59 export CXX=clang++
60
61 local TAGS="$(cat release/DEFAULT_BUILD_TAGS),with_awg"
62 local LDFLAGS_SHARED=$(cat release/LDFLAGS)
63 local GITVER
64 GITVER=$(git describe --tags --always 2>/dev/null)
65
66 go build -v \
67 -trimpath \
68 -buildmode=pie \
69 -mod=readonly \
70 -modcacherw \
71 -tags "$TAGS" \
72 -ldflags "-linkmode external -X github.com/sagernet/sing-box/constant.Version=${GITVER} ${LDFLAGS_SHARED} -s -buildid=" \
73 -o sing-box \
74 ./cmd/sing-box
75
76 install -d completions
77 ./sing-box completion bash > completions/bash
78 ./sing-box completion fish > completions/fish
79 ./sing-box completion zsh > completions/zsh
80}
81
82package() {
83 cd "$pkgname"
84
85 install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
86 install -Dm755 "sing-box" -t "$pkgdir/usr/bin"
87 install -Dm644 "release/config/config.json" -t "$pkgdir/etc/sing-box"
88 install -Dm644 "release/config/sing-box.rules" -t "$pkgdir/usr/share/polkit-1/rules.d"
89 install -Dm644 "release/config/sing-box.service" -t "$pkgdir/usr/lib/systemd/system"
90 install -Dm644 "release/config/sing-box.sysusers" "$pkgdir/usr/lib/sysusers.d/sing-box.conf"
91 install -Dm644 "release/config/sing-box@.service" -t "$pkgdir/usr/lib/systemd/system"
92 install -Dm644 "release/config/sing-box-split-dns.xml" "$pkgdir/usr/share/dbus-1/system.d/sing-box-split-dns.conf"
93
94 install -Dm644 completions/bash "${pkgdir}/usr/share/bash-completion/completions/sing-box.bash"
95 install -Dm644 completions/fish "${pkgdir}/usr/share/fish/vendor_completions.d/sing-box.fish"
96 install -Dm644 completions/zsh "${pkgdir}/usr/share/zsh/site-functions/_sing-box"
97}
98

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -58,7 +58,7 @@
export CC=clang
export CXX=clang++
- local TAGS=$(cat release/DEFAULT_BUILD_TAGS)
+ local TAGS="$(cat release/DEFAULT_BUILD_TAGS),with_awg"
local LDFLAGS_SHARED=$(cat release/LDFLAGS)
local GITVER
GITVER=$(git describe --tags --always 2>/dev/null)

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 21:22:00 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 19:14:42 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion