libvirt-sandbox

LOW

maintainer dreieck 6 votes scanned 2026-11-06 00:21:40.447623

View on AUR

Why flagged

The source is a tarball from libvirt.org, the project's official host, which is not on the whitelist but is plausibly legitimate; building from official project sources is normal AUR packaging behavior and poses low risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from libvirt.org, the project's official host, which is not on the whitelist but is plausibly legitimate; building from official project sources is normal AUR packaging behavior and poses low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 https://libvirt.org/sources/sandbox/$pkgname-$pkgver.tar.gz{,.asc}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  dreieck (https://aur.archlinux.org/account/dreieck)
    
      2# Contributor: Stephanie Wilde-Hobbs
    
      3# Contributor: Radostin Stoyanov
    
      4pkgname=libvirt-sandbox
    
      5pkgver=0.8.0
    
      6pkgrel=7
    
      7pkgdesc="An application sandbox toolkit"
    
      8arch=('i686' 'x86_64')
    
      9url="http://sandbox.libvirt.org/"
    
      10license=('LGPL-2.1-or-later')
    
      11depends=(
    
      12  'libvirt-glib'
    
      13  'libselinux'
    
      14  'libcap-ng'
    
      15  'cpio'
    
      16)
    
      17makedepends=(
    
      18  'gobject-introspection'
    
      19  'intltool'
    
      20  # 'pod2man'  # According to https://aur.archlinux.org/packages/libvirt-sandbox#comment-1081670, this is not needed.
    
      21  'rpcsvc-proto'
    
      22  'zlib-static' # Needs 'libz.a' static library for '--with-zlib'.
    
      23)
    
      24optdepends=('dhclient: for sandbox network configuration using DHCP')
    
      25source=(
    
      26    https://libvirt.org/sources/sandbox/$pkgname-$pkgver.tar.gz{,.asc}
    
      27    '0001-builder-Use-prefix-to-identify-lib-path.patch'
    
      28    '0002-Use-boot-vmlinuz-linux-as-default-kernel-path.patch'
    
      29)
    
      30
    
      31md5sums=('c8b4393ec3ea78cd77af826e478f34f9'
    
      32         'd714f9f47f4322d5e702694f0b9f2c19'
    
      33         'f1b8ba0a173499b6fbe5ea24d542047b'
    
      34         'd854d27d11b2d6cf8184667cae920839'
    
      35)
    
      36
    
      37validpgpkeys=('DAF3A6FDB26B62912D0E8E3FBE86EBB415104FDF')
    
      38# Daniel P. Berrange <dan@berrange.com>
    
      39
    
      40prepare() {
    
      41  cd "$srcdir/$pkgname-$pkgver"
    
      42  patch -Np1 -i "${srcdir}/0001-builder-Use-prefix-to-identify-lib-path.patch"
    
      43  patch -Np1 -i "${srcdir}/0002-Use-boot-vmlinuz-linux-as-default-kernel-path.patch"
    
      44  sed -i 's/as_fn_error $? "static LZMA is required/###/' 'configure' # See https://aur.archlinux.org/packages/libvirt-sandbox#comment-927182.
    
      45}
    
      46
    
      47build() {
    
      48  cd "$srcdir/$pkgname-$pkgver"
    
      49
    
      50  # This disable showing all warning
    
      51  export CFLAGS+=" -w"
    
      52  export CXXFLAGS+=" -w"
    
      53
    
      54  # --without-lzma: LZMA would need 'xz-static' ('liblzma.a') as make dependency, but having this leads to linking error 'libvirt-sandbox-init-qemu.c:(.text.startup+0x250): undefined reference to `lzma_stream_decoder'', so leaving it disabled.
    
      55  ./configure \
    
      56      --prefix=/usr \
    
      57      --libexecdir=/usr/lib/$pkgname \
    
      58      --sysconfdir=/etc \
    
      59      --enable-shared \
    
      60      --disable-static \
    
      61      --disable-werror \
    
      62      --disable-gtk-doc \
    
      63      --enable-gtk-doc-html \
    
      64      --disable-gtk-doc-pdf \
    
      65      --enable-introspection \
    
      66      --with-zlib \
    
      67      --without-lzma \
    
      68      --with-capng
    
      69  make
    
      70}
    
      71
    
      72check() {
    
      73  cd "$srcdir/$pkgname-$pkgver"
    
      74
    
      75  make -k check
    
      76}
    
      77
    
      78package() {
    
      79  cd "$srcdir/$pkgname-$pkgver"
    
      80
    
      81  make DESTDIR="$pkgdir/" install
    
      82}
    
      83
    
      84# vim:set ts=2 sw=2 et:
    
      85

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 00:21:40	Low	2
2026-11-05 00:01:40	Low	2
2026-11-04 00:25:23	Low	2
2026-11-03 00:01:00	Low	2
2026-11-02 00:26:00	Low	2
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2