antimony-sandbox
MEDIUM
maintainer kkernick
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package creates dedicated system users and sets setuid (suid) bits on binaries, which is a privileged operation that can elevate risk if those binaries are compromised.
Triggered rules
Medium
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
.install:16
chmod ug+s /usr/bin/antimony -
.install:17
chmod ug+s /usr/share/antimony/utilities/antimony-lockdown
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package creates dedicated system users and sets setuid (suid) bits on binaries, which is a privileged operation that can elevate risk if those binaries are compromised.
PKGBUILD
1
# Maintainer: kkernick <kkernick at protonmail dot com>
2
pkgname=antimony-sandbox
3
pkgdesc="Sandbox Applications"
4
pkgver=5.2.1
5
pkgrel=1
6
7
install=antimony.install
8
license=("Unlicense")
9
url="https://github.com/kkernick/antimony"
10
source=("git+$url#tag=$pkgver")
11
b2sums=("SKIP")
12
depends=(glibc bubblewrap libseccomp xdg-dbus-proxy sqlite dbus)
13
makedepends=(git cargo pkgconf zstd gzip)
14
arch=("any")
15
16
prepare() {
17
cd $srcdir/antimony
18
export RUSTUP_TOOLCHAIN=stable
19
cargo fetch --target "$(rustc -vV | sed -n 's/host: //p')"
20
}
21
22
build() {
23
cd $srcdir/antimony
24
export RUSTUP_TOOLCHAIN=stable
25
export CARGO_TARGET_DIR=target
26
cargo build --frozen --release --workspace
27
}
28
29
check() {
30
cd $srcdir/antimony
31
export RUSTUP_TOOLCHAIN=stable
32
export CARGO_TARGET_DIR=target
33
cargo test
34
}
35
36
package() {
37
cd $srcdir/antimony
38
install -Dm755 "target/release/antimony" "$pkgdir/usr/bin/antimony"
39
40
for binary in antimony-monitor antimony-spawn antimony-dumper antimony-open antimony-tracer antimony-notify; do
41
install -Dm755 "target/release/$binary" "$pkgdir/usr/share/antimony/utilities/$binary"
42
done
43
44
for profile in $(ls config/profiles); do
45
install -Dm644 "config/profiles/$profile" "$pkgdir/usr/share/antimony/config/profiles/$profile"
46
done
47
48
for feature in $(ls config/features); do
49
install -Dm644 "config/features/$feature" "$pkgdir/usr/share/antimony/config/features/$feature"
50
done
51
52
install -Dm644 "config/default.toml" "$pkgdir/usr/share/antimony/config/profiles/default.toml"
53
install -Dm644 "config/profile.toml" "$pkgdir/usr/share/antimony/config/profile.toml"
54
install -Dm644 "config/feature.toml" "$pkgdir/usr/share/antimony/config/feature.toml"
55
56
install -Dm644 "config/config.toml" "$pkgdir/etc/antimony.toml"
57
install -Dm644 "config/config.d/base.toml" "$pkgdir/etc/antimony.d/base.toml"
58
59
60
# Build the shell completions
61
target/release/antimony_generator
62
install -Dm644 "generated/antimony.bash" "$pkgdir/usr/share/bash-completion/antimony"
63
install -Dm644 "generated/antimony.fish" "$pkgdir/usr/share/fish/vendor_completions.d/antimony.fish"
64
install -Dm644 "generated/_antimony" "$pkgdir/usr/share/zsh/site-functions/_antimony"
65
install -Dm644 "generated/antimony.1.gz" "$pkgdir/usr/share/man/man1/antimony.1.gz"
66
install -Dm644 "generated/antimony-edit.1.gz" "$pkgdir/usr/share/man/man1/antimony-edit.1.gz"
67
install -Dm644 "generated/antimony-export.1.gz" "$pkgdir/usr/share/man/man1/antimony-export.1.gz"
68
install -Dm644 "generated/antimony-help.1.gz" "$pkgdir/usr/share/man/man1/antimony-help.1.gz"
69
install -Dm644 "generated/antimony-import.1.gz" "$pkgdir/usr/share/man/man1/antimony-import.1.gz"
70
install -Dm644 "generated/antimony-info.1.gz" "$pkgdir/usr/share/man/man1/antimony-info.1.gz"
71
install -Dm644 "generated/antimony-integrate.1.gz" "$pkgdir/usr/share/man/man1/antimony-integrate.1.gz"
72
install -Dm644 "generated/antimony-package.1.gz" "$pkgdir/usr/share/man/man1/antimony-package.1.gz"
73
install -Dm644 "generated/antimony-refresh.1.gz" "$pkgdir/usr/share/man/man1/antimony-refresh.1.gz"
74
install -Dm644 "generated/antimony-remove.1.gz" "$pkgdir/usr/share/man/man1/antimony-remove.1.gz"
75
install -Dm644 "generated/antimony-run.1.gz" "$pkgdir/usr/share/man/man1/antimony-run.1.gz"
76
}
77
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |