antimony-sandbox
maintainer kkernick
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package creates dedicated system users and sets setuid (suid) bits on binaries, which is a privileged operation that can elevate risk if those binaries are compromised.
Triggered rules
MEDIUM
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
.install:16
chmod ug+s /usr/bin/antimony -
.install:17
chmod ug+s /usr/share/antimony/utilities/antimony-lockdown
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package creates dedicated system users and sets setuid (suid) bits on binaries, which is a privileged operation that can elevate risk if those binaries are compromised.
PKGBUILD
1
# Maintainer: kkernick <kkernick at protonmail dot com>
2
pkgname=antimony-sandbox
3
pkgdesc="Sandbox Applications"
4
pkgver=5.2.1
5
pkgrel=1
6
7
install=antimony.install
8
license=("Unlicense")
9
url="https://github.com/kkernick/antimony"
10
source=("git+$url#tag=$pkgver")
11
b2sums=("SKIP")
12
depends=(glibc bubblewrap libseccomp xdg-dbus-proxy sqlite dbus)
13
makedepends=(git cargo pkgconf zstd gzip)
14
arch=("any")
15
16
prepare() {
17
cd $srcdir/antimony
18
export RUSTUP_TOOLCHAIN=stable
19
cargo fetch --target "$(rustc -vV | sed -n 's/host: //p')"
20
}
21
22
build() {
23
cd $srcdir/antimony
24
export RUSTUP_TOOLCHAIN=stable
25
export CARGO_TARGET_DIR=target
26
cargo build --frozen --release --workspace
27
}
28
29
check() {
30
cd $srcdir/antimony
31
export RUSTUP_TOOLCHAIN=stable
32
export CARGO_TARGET_DIR=target
33
cargo test
34
}
35
36
package() {
37
cd $srcdir/antimony
38
install -Dm755 "target/release/antimony" "$pkgdir/usr/bin/antimony"
39
40
for binary in antimony-monitor antimony-spawn antimony-dumper antimony-open antimony-tracer antimony-notify; do
41
install -Dm755 "target/release/$binary" "$pkgdir/usr/share/antimony/utilities/$binary"
42
done
43
44
for profile in $(ls config/profiles); do
45
install -Dm644 "config/profiles/$profile" "$pkgdir/usr/share/antimony/config/profiles/$profile"
46
done
47
48
for feature in $(ls config/features); do
49
install -Dm644 "config/features/$feature" "$pkgdir/usr/share/antimony/config/features/$feature"
50
done
51
52
install -Dm644 "config/default.toml" "$pkgdir/usr/share/antimony/config/profiles/default.toml"
53
install -Dm644 "config/profile.toml" "$pkgdir/usr/share/antimony/config/profile.toml"
54
install -Dm644 "config/feature.toml" "$pkgdir/usr/share/antimony/config/feature.toml"
55
56
install -Dm644 "config/config.toml" "$pkgdir/etc/antimony.toml"
57
install -Dm644 "config/config.d/base.toml" "$pkgdir/etc/antimony.d/base.toml"
58
59
60
# Build the shell completions
61
target/release/antimony_generator
62
install -Dm644 "generated/antimony.bash" "$pkgdir/usr/share/bash-completion/antimony"
63
install -Dm644 "generated/antimony.fish" "$pkgdir/usr/share/fish/vendor_completions.d/antimony.fish"
64
install -Dm644 "generated/_antimony" "$pkgdir/usr/share/zsh/site-functions/_antimony"
65
install -Dm644 "generated/antimony.1.gz" "$pkgdir/usr/share/man/man1/antimony.1.gz"
66
install -Dm644 "generated/antimony-edit.1.gz" "$pkgdir/usr/share/man/man1/antimony-edit.1.gz"
67
install -Dm644 "generated/antimony-export.1.gz" "$pkgdir/usr/share/man/man1/antimony-export.1.gz"
68
install -Dm644 "generated/antimony-help.1.gz" "$pkgdir/usr/share/man/man1/antimony-help.1.gz"
69
install -Dm644 "generated/antimony-import.1.gz" "$pkgdir/usr/share/man/man1/antimony-import.1.gz"
70
install -Dm644 "generated/antimony-info.1.gz" "$pkgdir/usr/share/man/man1/antimony-info.1.gz"
71
install -Dm644 "generated/antimony-integrate.1.gz" "$pkgdir/usr/share/man/man1/antimony-integrate.1.gz"
72
install -Dm644 "generated/antimony-package.1.gz" "$pkgdir/usr/share/man/man1/antimony-package.1.gz"
73
install -Dm644 "generated/antimony-refresh.1.gz" "$pkgdir/usr/share/man/man1/antimony-refresh.1.gz"
74
install -Dm644 "generated/antimony-remove.1.gz" "$pkgdir/usr/share/man/man1/antimony-remove.1.gz"
75
install -Dm644 "generated/antimony-run.1.gz" "$pkgdir/usr/share/man/man1/antimony-run.1.gz"
76
}
77
Changes since previous scan
--- PKGBUILD @ 2026-07-20 00:19+++ PKGBUILD @ 2026-08-03 00:08@@ -1,7 +1,7 @@ # Maintainer: kkernick <kkernick at protonmail dot com> pkgname=antimony-sandbox pkgdesc="Sandbox Applications"-pkgver=5.2.0+pkgver=5.2.1 pkgrel=1 install=antimony.install@@ -10,7 +10,7 @@ source=("git+$url#tag=$pkgver") b2sums=("SKIP") depends=(glibc bubblewrap libseccomp xdg-dbus-proxy sqlite dbus)-makedepends=(git cargo pkgconf zstd)+makedepends=(git cargo pkgconf zstd gzip) arch=("any") prepare() {@@ -58,9 +58,20 @@ # Build the shell completions- target/release/antimony_completions- install -Dm644 "completions/antimony.bash" "$pkgdir/usr/share/bash-completion/antimony"- install -Dm644 "completions/antimony.fish" "$pkgdir/usr/share/fish/vendor_completions.d/antimony.fish"- install -Dm644 "completions/_antimony" "$pkgdir/usr/share/zsh/site-functions/_antimony"+ target/release/antimony_generator+ install -Dm644 "generated/antimony.bash" "$pkgdir/usr/share/bash-completion/antimony"+ install -Dm644 "generated/antimony.fish" "$pkgdir/usr/share/fish/vendor_completions.d/antimony.fish"+ install -Dm644 "generated/_antimony" "$pkgdir/usr/share/zsh/site-functions/_antimony"+ install -Dm644 "generated/antimony.1.gz" "$pkgdir/usr/share/man/man1/antimony.1.gz"+ install -Dm644 "generated/antimony-edit.1.gz" "$pkgdir/usr/share/man/man1/antimony-edit.1.gz"+ install -Dm644 "generated/antimony-export.1.gz" "$pkgdir/usr/share/man/man1/antimony-export.1.gz"+ install -Dm644 "generated/antimony-help.1.gz" "$pkgdir/usr/share/man/man1/antimony-help.1.gz"+ install -Dm644 "generated/antimony-import.1.gz" "$pkgdir/usr/share/man/man1/antimony-import.1.gz"+ install -Dm644 "generated/antimony-info.1.gz" "$pkgdir/usr/share/man/man1/antimony-info.1.gz"+ install -Dm644 "generated/antimony-integrate.1.gz" "$pkgdir/usr/share/man/man1/antimony-integrate.1.gz"+ install -Dm644 "generated/antimony-package.1.gz" "$pkgdir/usr/share/man/man1/antimony-package.1.gz"+ install -Dm644 "generated/antimony-refresh.1.gz" "$pkgdir/usr/share/man/man1/antimony-refresh.1.gz"+ install -Dm644 "generated/antimony-remove.1.gz" "$pkgdir/usr/share/man/man1/antimony-remove.1.gz"+ install -Dm644 "generated/antimony-run.1.gz" "$pkgdir/usr/share/man/man1/antimony-run.1.gz" } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 05:12:56 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 01:56:03 | MEDIUM | 2 |
| 2026-07-04 00:27:25 | CLEAN | 0 |
| 2026-07-03 05:10:23 | MEDIUM | 2 |