aurcache-sandbox

LOW

maintainer gyscos 0 votes scanned 2026-09-07 19:15:19.836787

View on AUR

Why flagged

Package builds from a source tarball hosted on the author's GitHub, which is normal for AUR packages; the only concern is a SKIP'd checksum and low votes, but the build process is transparent and uses standard Rust/cargo practices without executing untrusted remote code.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package builds from a source tarball hosted on the author's GitHub, which is normal for AUR packages; the only concern is a SKIP'd checksum and low votes, but the build process is transparent and uses standard Rust/cargo practices without executing untrusted remote code.

PKGBUILD

      1# Maintainer: Lukas Heiligenbrunner <lukas.heiligenbrunner@gmail.com>
    
      2#
    
      3# The Landlock confiner, packaged on its own because both the server and the
    
      4# worker need it and pacman refuses to install two packages that ship the same
    
      5# path -- identical contents are no exemption. A shared dependency is the
    
      6# idiomatic answer to one file two packages need.
    
      7#
    
      8# It confines the places AURCache executes a PKGBUILD: the server sources one
    
      9# to parse it, and makechrootpkg runs two hooks outside the chroot.
    
      10
    
      11pkgname=aurcache-sandbox
    
      12pkgver=0.5.0
    
      13pkgrel=1
    
      14pkgdesc="Landlock sandbox used by AURCache to confine PKGBUILD execution"
    
      15arch=(x86_64 aarch64 armv7h)
    
      16url="https://github.com/Lukas-Heiligenbrunner/AURCache"
    
      17license=(GPL-3.0-or-later)
    
      18depends=(gcc-libs)
    
      19makedepends=(cargo git)
    
      20# See the aurcache-worker PKGBUILD: !lto is load-bearing for the vendored C in
    
      21# aws-lc-sys and ring, and !strip because cargo does the stripping.
    
      22options=(!strip !lto !debug)
    
      23source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      24sha256sums=('SKIP')
    
      25
    
      26_srcdir="AURCache-$pkgver"
    
      27
    
      28prepare() {
    
      29    cd "$_srcdir/backend"
    
      30    export RUSTUP_TOOLCHAIN=stable
    
      31    cargo fetch --locked
    
      32}
    
      33
    
      34build() {
    
      35    source "$srcdir/$_srcdir/packaging/common.sh"
    
      36    cd "$_srcdir/backend"
    
      37    _aurcache_cargo_build -p aurcache-sandbox
    
      38}
    
      39
    
      40check() {
    
      41    source "$srcdir/$_srcdir/packaging/common.sh"
    
      42    cd "$_srcdir/backend"
    
      43    _aurcache_cargo_check
    
      44}
    
      45
    
      46package() {
    
      47    source "$srcdir/$_srcdir/packaging/common.sh"
    
      48    cd "$_srcdir"
    
      49    packaging/install-files.sh sandbox "$pkgdir" "$PWD" "backend/$(_aurcache_release_dir)"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-07 19:15:19	Low	2