lightbox-git

LOW

maintainer asce4s 0 votes scanned 2026-10-18 09:25:03.798113

View on AUR

Why flagged

Builds from the maintainer's own GitHub repo using standard Rust/cargo toolchain; the flagged 'privileged install' is a false positive (line 48 is just a rustup toolchain install with --no-self-update, not a sudoers/setuid operation); low votes and recent upload are normal for a new AUR package, no actual malicious behaviour present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Builds from the maintainer's own GitHub repo using standard Rust/cargo toolchain; the flagged 'privileged install' is a false positive (line 48 is just a rustup toolchain install with --no-self-update, not a sudoers/setuid operation); low votes and recent upload are normal for a new AUR package, no actual malicious behaviour present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:48 rustup toolchain install "${toolchain}" --profile minimal --no-self-update

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Supun Sasanka <asce4s@gmail.com>
    
      2pkgname=lightbox-git
    
      3pkgver=r79.8cbf9b4
    
      4pkgrel=2
    
      5pkgdesc="Local-first photo manager and non-destructive editor"
    
      6arch=('x86_64')
    
      7url="https://github.com/asce4s/lightbox"
    
      8license=('MIT')
    
      9depends=(
    
      10  'gcc-libs'
    
      11  'fontconfig'
    
      12  'freetype2'
    
      13  'libxkbcommon'
    
      14  'libxkbcommon-x11'
    
      15  'wayland'
    
      16  'libxcb'
    
      17  'libx11'
    
      18  'vulkan-icd-loader'
    
      19  'hicolor-icon-theme'
    
      20)
    
      21makedepends=(
    
      22  'rustup'
    
      23  'clang'
    
      24  'git'
    
      25  'pkgconf'
    
      26  'vulkan-headers'
    
      27)
    
      28optdepends=('ffmpeg: video thumbnails and metadata')
    
      29provides=('lightbox')
    
      30conflicts=('lightbox')
    
      31options=('!lto')
    
      32source=("${pkgname}::git+${url}.git")
    
      33sha256sums=('SKIP')
    
      34
    
      35_toolchain() {
    
      36  awk -F'"' '/^channel / { print $2 }' rust-toolchain.toml
    
      37}
    
      38
    
      39pkgver() {
    
      40  cd "${pkgname}"
    
      41  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      42}
    
      43
    
      44prepare() {
    
      45  cd "${pkgname}"
    
      46  local toolchain
    
      47  toolchain="$(_toolchain)"
    
      48  rustup toolchain install "${toolchain}" --profile minimal --no-self-update
    
      49  rustup run "${toolchain}" cargo fetch --locked --target "$(rustup run "${toolchain}" rustc -vV | sed -n 's/host: //p')"
    
      50}
    
      51
    
      52build() {
    
      53  cd "${pkgname}"
    
      54  export CARGO_TARGET_DIR=target
    
      55  rustup run "$(_toolchain)" cargo build --frozen --release -p lightbox -p lb-cli
    
      56}
    
      57
    
      58package() {
    
      59  cd "${pkgname}"
    
      60  install -Dm755 target/release/lightbox "${pkgdir}/usr/bin/lightbox"
    
      61  install -Dm755 target/release/lightbox-cli "${pkgdir}/usr/bin/lightbox-cli"
    
      62  install -Dm644 assets/icon.svg "${pkgdir}/usr/share/icons/hicolor/scalable/apps/lightbox.svg"
    
      63  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      64  install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/lightbox.desktop" <<'EOF'
    
      65[Desktop Entry]
    
      66Type=Application
    
      67Name=Lightbox
    
      68Comment=Photo manager
    
      69Exec=lightbox
    
      70Icon=lightbox
    
      71Categories=Graphics;Photography;Viewer;
    
      72Terminal=false
    
      73EOF
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 09:25:03	Low	3
2026-10-18 09:21:55	Medium	2