libvirt-sandbox

MEDIUM

maintainer dreieck 6 votes scanned 2026-09-22 15:38:25.654840

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 https://libvirt.org/sources/sandbox/$pkgname-$pkgver.tar.gz{,.asc}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  dreieck (https://aur.archlinux.org/account/dreieck)
    
      2# Contributor: Stephanie Wilde-Hobbs
    
      3# Contributor: Radostin Stoyanov
    
      4pkgname=libvirt-sandbox
    
      5pkgver=0.8.0
    
      6pkgrel=7
    
      7pkgdesc="An application sandbox toolkit"
    
      8arch=('i686' 'x86_64')
    
      9url="http://sandbox.libvirt.org/"
    
      10license=('LGPL-2.1-or-later')
    
      11depends=(
    
      12  'libvirt-glib'
    
      13  'libselinux'
    
      14  'libcap-ng'
    
      15  'cpio'
    
      16)
    
      17makedepends=(
    
      18  'gobject-introspection'
    
      19  'intltool'
    
      20  # 'pod2man'  # According to https://aur.archlinux.org/packages/libvirt-sandbox#comment-1081670, this is not needed.
    
      21  'rpcsvc-proto'
    
      22  'zlib-static' # Needs 'libz.a' static library for '--with-zlib'.
    
      23)
    
      24optdepends=('dhclient: for sandbox network configuration using DHCP')
    
      25source=(
    
      26    https://libvirt.org/sources/sandbox/$pkgname-$pkgver.tar.gz{,.asc}
    
      27    '0001-builder-Use-prefix-to-identify-lib-path.patch'
    
      28    '0002-Use-boot-vmlinuz-linux-as-default-kernel-path.patch'
    
      29)
    
      30
    
      31md5sums=('c8b4393ec3ea78cd77af826e478f34f9'
    
      32         'd714f9f47f4322d5e702694f0b9f2c19'
    
      33         'f1b8ba0a173499b6fbe5ea24d542047b'
    
      34         'd854d27d11b2d6cf8184667cae920839'
    
      35)
    
      36
    
      37validpgpkeys=('DAF3A6FDB26B62912D0E8E3FBE86EBB415104FDF')
    
      38# Daniel P. Berrange <dan@berrange.com>
    
      39
    
      40prepare() {
    
      41  cd "$srcdir/$pkgname-$pkgver"
    
      42  patch -Np1 -i "${srcdir}/0001-builder-Use-prefix-to-identify-lib-path.patch"
    
      43  patch -Np1 -i "${srcdir}/0002-Use-boot-vmlinuz-linux-as-default-kernel-path.patch"
    
      44  sed -i 's/as_fn_error $? "static LZMA is required/###/' 'configure' # See https://aur.archlinux.org/packages/libvirt-sandbox#comment-927182.
    
      45}
    
      46
    
      47build() {
    
      48  cd "$srcdir/$pkgname-$pkgver"
    
      49
    
      50  # This disable showing all warning
    
      51  export CFLAGS+=" -w"
    
      52  export CXXFLAGS+=" -w"
    
      53
    
      54  # --without-lzma: LZMA would need 'xz-static' ('liblzma.a') as make dependency, but having this leads to linking error 'libvirt-sandbox-init-qemu.c:(.text.startup+0x250): undefined reference to `lzma_stream_decoder'', so leaving it disabled.
    
      55  ./configure \
    
      56      --prefix=/usr \
    
      57      --libexecdir=/usr/lib/$pkgname \
    
      58      --sysconfdir=/etc \
    
      59      --enable-shared \
    
      60      --disable-static \
    
      61      --disable-werror \
    
      62      --disable-gtk-doc \
    
      63      --enable-gtk-doc-html \
    
      64      --disable-gtk-doc-pdf \
    
      65      --enable-introspection \
    
      66      --with-zlib \
    
      67      --without-lzma \
    
      68      --with-capng
    
      69  make
    
      70}
    
      71
    
      72check() {
    
      73  cd "$srcdir/$pkgname-$pkgver"
    
      74
    
      75  make -k check
    
      76}
    
      77
    
      78package() {
    
      79  cd "$srcdir/$pkgname-$pkgver"
    
      80
    
      81  make DESTDIR="$pkgdir/" install
    
      82}
    
      83
    
      84# vim:set ts=2 sw=2 et:
    
      85

Changes since previous scan

--- PKGBUILD @ 2026-06-20 00:18
+++ PKGBUILD @ 2026-09-22 15:38
@@ -3,16 +3,27 @@
 # Contributor: Radostin Stoyanov
 pkgname=libvirt-sandbox
 pkgver=0.8.0
-pkgrel=6
+pkgrel=7
 pkgdesc="An application sandbox toolkit"
 arch=('i686' 'x86_64')
 url="http://sandbox.libvirt.org/"
-license=('LGPL')
-depends=('libvirt-glib' 'libselinux' 'libcap-ng' 'cpio')
-makedepends=('gobject-introspection' 'intltool' 'pod2man' 'rpcsvc-proto')
+license=('LGPL-2.1-or-later')
+depends=(
+  'libvirt-glib'
+  'libselinux'
+  'libcap-ng'
+  'cpio'
+)
+makedepends=(
+  'gobject-introspection'
+  'intltool'
+  # 'pod2man'  # According to https://aur.archlinux.org/packages/libvirt-sandbox#comment-1081670, this is not needed.
+  'rpcsvc-proto'
+  'zlib-static' # Needs 'libz.a' static library for '--with-zlib'.
+)
 optdepends=('dhclient: for sandbox network configuration using DHCP')
 source=(
-    http://libvirt.org/sources/sandbox/$pkgname-$pkgver.tar.gz{,.asc}
+    https://libvirt.org/sources/sandbox/$pkgname-$pkgver.tar.gz{,.asc}
     '0001-builder-Use-prefix-to-identify-lib-path.patch'
     '0002-Use-boot-vmlinuz-linux-as-default-kernel-path.patch'
 )
@@ -36,32 +47,17 @@
 build() {
   cd "$srcdir/$pkgname-$pkgver"
 
-  ## Silence warnings that are due to old codebase.
-  _no_cc_warnings=(
-    #'address'
-    #'attribute-warning'
-    'deprecated-declarations'
-    #'format-security'
-    #'strict-aliasing'
-    'unused-result'
-  )
-  _CFLAGSAPPEND=''
-  for _no_cc_warn in "${_no_cc_warnings[@]}"; do
-    _CFLAGSAPPEND+=" -Wno-error=${_no_cc_warn} -Wno-${_no_cc_warn}"
-  done
-  CFLAGS+=" ${_CFLAGSAPPEND}"
-  CXXFLAGS+=" ${_CFLAGSAPPEND}"
-  export CFLAGS
-  export CXXFLAGS
+  # This disable showing all warning
+  export CFLAGS+=" -w"
+  export CXXFLAGS+=" -w"
 
-  # --without-lzma is needed to work around '/usr/bin/ld: cannot find -llzma: No such file or directory'. If anyone has an idea how to fix it, please report to the Maintainer of this `PKGBUILD`. See also .
-
+  # --without-lzma: LZMA would need 'xz-static' ('liblzma.a') as make dependency, but having this leads to linking error 'libvirt-sandbox-init-qemu.c:(.text.startup+0x250): undefined reference to `lzma_stream_decoder'', so leaving it disabled.
   ./configure \
       --prefix=/usr \
       --libexecdir=/usr/lib/$pkgname \
       --sysconfdir=/etc \
       --enable-shared \
-      --enable-static \
+      --disable-static \
       --disable-werror \
       --disable-gtk-doc \
       --enable-gtk-doc-html \

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 15:38:25	Medium	1
2026-06-20 00:18:46	Medium	1
2026-06-19 23:51:18	Clean	2
2026-06-19 19:07:35	Low	2
2026-06-18 16:11:54	Medium	1