makepkg-jail-local
LOW
maintainer gee
0 votes
scanned 2026-11-01 10:00:05.946014
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
pkgname=makepkg-jail-local
2
pkgver=0.1.0
3
pkgrel=1
4
pkgdesc='Local bubblewrap makepkg sandbox with AppArmor and a restricted paru adapter'
5
arch=('x86_64')
6
license=('GPL-3.0-or-later')
7
depends=(
8
'apparmor'
9
'bash'
10
'bubblewrap'
11
'coreutils'
12
'gnupg'
13
'pacman'
14
'util-linux'
15
)
16
17
makedepends=(
18
'python'
19
'python-libseccomp'
20
)
21
22
optdepends=(
23
'base-devel: standard Arch package build tools'
24
'paru: use the paru-makepkg-jail adapter'
25
)
26
27
install=makepkg-jail-local.install
28
29
backup=(
30
'etc/apparmor.d/makepkg-jail-build'
31
)
32
33
options=(
34
'!debug'
35
'!strip'
36
)
37
38
source=(
39
'makepkg-jail'
40
'paru-makepkg-jail'
41
'gen-seccomp.py'
42
'bwrap.profile'
43
'build.profile'
44
)
45
46
# Local development placeholders. Replace with real hashes before
47
# distributing the package, or use updpkgsums before building.
48
sha256sums=('e0983451afca465cceaaba384b1765ec969a8df1b8abeba9c7fc9ad69bb87d35'
49
'ab7166fce9de9085ec89bdcb4747493f28a3dfb094d701b205751e954b020582'
50
'ecf24a3118060612c6a38c26a038acbe6a7e5c8531bcb65837ec7d17e3d8ecbf'
51
'5b33033b0e1190d6b77666e6b76b858c1b4f5df854ffb2bc8e83f2a3c3f80e32'
52
'44a4836379763312e7a81e8b9100230d60c6dbdb90fce1a2ac965fcf8d8a01a3')
53
54
prepare() {
55
cd "$srcdir"
56
57
# Patch only the build copy, leaving the source script untouched.
58
# Accept either the original per-user path or an already-patched
59
# system path, so repeated preparation is safe.
60
python - <<'PY'
61
from pathlib import Path
62
63
path = Path("makepkg-jail")
64
text = path.read_text()
65
66
old = 'filter="$data/seccomp.bpf"'
67
new = 'filter="/usr/lib/makepkg-jail/seccomp.bpf"'
68
69
if text.count(old) == 1 and text.count(new) == 0:
70
path.write_text(text.replace(old, new))
71
elif text.count(old) == 0 and text.count(new) == 1:
72
pass
73
else:
74
raise SystemExit(
75
"Unexpected seccomp path configuration in makepkg-jail; refusing to patch."
76
)
77
PY
78
}
79
80
build() {
81
cd "$srcdir"
82
83
# The generator must fail if a required filter rule cannot be added.
84
python gen-seccomp.py seccomp.bpf
85
}
86
87
check() {
88
cd "$srcdir"
89
90
bash -n makepkg-jail
91
bash -n paru-makepkg-jail
92
test -s seccomp.bpf
93
94
# Syntax-check both profiles without loading them into the kernel
95
# or reading/writing the parser cache.
96
apparmor_parser -Q -T -o /dev/null build.profile
97
apparmor_parser -Q -T -o /dev/null bwrap.profile
98
}
99
100
package() {
101
cd "$srcdir"
102
103
install -Dm755 makepkg-jail \
104
"$pkgdir/usr/bin/makepkg-jail"
105
106
install -Dm755 paru-makepkg-jail \
107
"$pkgdir/usr/bin/paru-makepkg-jail"
108
109
install -Dm644 seccomp.bpf \
110
"$pkgdir/usr/lib/makepkg-jail/seccomp.bpf"
111
112
# Retain the generator as readable source; it is not run at runtime.
113
install -Dm644 gen-seccomp.py \
114
"$pkgdir/usr/share/makepkg-jail/gen-seccomp.py"
115
116
# Package-owned build policy, installed in the standard location.
117
install -Dm644 build.profile \
118
"$pkgdir/etc/apparmor.d/makepkg-jail-build"
119
120
# The global bwrap policy remains administrator-managed.
121
install -Dm644 bwrap.profile \
122
"$pkgdir/usr/share/makepkg-jail/profiles/usr.bin.bwrap"
123
}
124
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 10:00:05 | Low | 1 |