nspawn

MEDIUM

maintainer Edu4rdSHL 1 votes scanned 2026-10-21 11:31:16.199359

View on AUR

Why flagged

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

PKGBUILD:46 install -Dm644 packaging/systemd/nspawn-api@.socket packaging/systemd/nspawn-api@.service packaging/systemd/nspawn-auto-update.service packaging/systemd/nspawn-auto-update.timer -t "${pkgdir}/usr/lib/systemd/system/"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Eduard Tolosa <tolosaeduard@gmail.com>
    
      2# Contributor: K4YT3X <aur@k4yt3x.com>
    
      3
    
      4pkgname=nspawn
    
      5pkgver=2.0.1
    
      6pkgrel=1
    
      7pkgdesc='Docker-like management of systemd-nspawn machines: OCI images from a hub, shared layers, a bridge network, driven over D-Bus'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://github.com/nspawn/nspawn'
    
      10license=('MIT' 'Apache-2.0')
    
      11depends=('systemd>=255' 'glibc' 'gcc-libs' 'iproute2' 'nftables')
    
      12makedepends=('cargo')
    
      13options=('!lto')
    
      14optdepends=('polkit: let users other than root drive nspawn'
    
      15            'mkosi: build images with nspawn build'
    
      16            'iptables-nft: keep the bridge reachable next to the forwarding rules of docker or ufw'
    
      17            'iw: hand a wifi adapter to an app machine with --interface')
    
      18source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/${pkgver}.tar.gz")
    
      19sha256sums=('f415f573404728392dc97a3b18798cd9f2181efae3ebdd9871efc29c8630c444')
    
      20
    
      21prepare() {
    
      22  cd "${pkgname}-${pkgver}"
    
      23  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      24}
    
      25
    
      26build() {
    
      27  cd "${pkgname}-${pkgver}"
    
      28  cargo build --release --frozen
    
      29}
    
      30
    
      31check() {
    
      32  cd "${pkgname}-${pkgver}"
    
      33  cargo test --release --frozen
    
      34}
    
      35
    
      36package() {
    
      37  cd "${pkgname}-${pkgver}"
    
      38
    
      39  install -Dm755 target/release/nspawn "${pkgdir}/usr/bin/nspawn"
    
      40  ./target/release/nspawn completions bash | install -Dm644 /dev/stdin "${pkgdir}/usr/share/bash-completion/completions/nspawn"
    
      41  ./target/release/nspawn completions zsh | install -Dm644 /dev/stdin "${pkgdir}/usr/share/zsh/site-functions/_nspawn"
    
      42  ./target/release/nspawn completions fish | install -Dm644 /dev/stdin "${pkgdir}/usr/share/fish/vendor_completions.d/nspawn.fish"
    
      43  ./target/release/nspawn manpage | install -Dm644 /dev/stdin "${pkgdir}/usr/share/man/man1/nspawn.1"
    
      44  install -Dm644 packaging/systemd/nspawn.service "${pkgdir}/usr/lib/systemd/system/nspawn.service"
    
      45  install -Dm644 packaging/systemd/journald@nspawn.conf "${pkgdir}/usr/lib/systemd/journald@nspawn.conf"
    
      46  install -Dm644 packaging/systemd/nspawn-api@.socket packaging/systemd/nspawn-api@.service packaging/systemd/nspawn-auto-update.service packaging/systemd/nspawn-auto-update.timer -t "${pkgdir}/usr/lib/systemd/system/"
    
      47  install -Dm644 packaging/dbus/org.nspawn.service "${pkgdir}/usr/share/dbus-1/system-services/org.nspawn.service"
    
      48  install -Dm644 packaging/dbus/org.nspawn.conf "${pkgdir}/usr/share/dbus-1/system.d/org.nspawn.conf"
    
      49  install -Dm644 packaging/polkit/org.nspawn.policy "${pkgdir}/usr/share/polkit-1/actions/org.nspawn.policy"
    
      50  install -Dm644 README.md docs/ARCHITECTURE.md docs/DBUS.md packaging/polkit/nspawn-wheel.rules -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      51  install -Dm644 LICENSE LICENSE-MIT LICENSE-APACHE -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      52  install -dm755 "${pkgdir}/etc/nspawn"
    
      53  install -dm711 "${pkgdir}/var/lib/nspawn"
    
      54}
    
      55
    
      56

Changes since previous scan

--- PKGBUILD @ 2026-10-05 23:40
+++ PKGBUILD @ 2026-10-21 11:31
@@ -2,7 +2,7 @@
 # Contributor: K4YT3X <aur@k4yt3x.com>
 
 pkgname=nspawn
-pkgver=1.9.1
+pkgver=2.0.1
 pkgrel=1
 pkgdesc='Docker-like management of systemd-nspawn machines: OCI images from a hub, shared layers, a bridge network, driven over D-Bus'
 arch=('x86_64' 'aarch64')
@@ -13,9 +13,10 @@
 options=('!lto')
 optdepends=('polkit: let users other than root drive nspawn'
             'mkosi: build images with nspawn build'
-            'iptables-nft: keep the bridge reachable next to the forwarding rules of docker or ufw')
+            'iptables-nft: keep the bridge reachable next to the forwarding rules of docker or ufw'
+            'iw: hand a wifi adapter to an app machine with --interface')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/${pkgver}.tar.gz")
-sha256sums=('a82e97d72738031d0d72403cecb12bae0a116eb7c260a8712d0238ee1c81391e')
+sha256sums=('f415f573404728392dc97a3b18798cd9f2181efae3ebdd9871efc29c8630c444')
 
 prepare() {
   cd "${pkgname}-${pkgver}"
@@ -42,10 +43,11 @@
   ./target/release/nspawn manpage | install -Dm644 /dev/stdin "${pkgdir}/usr/share/man/man1/nspawn.1"
   install -Dm644 packaging/systemd/nspawn.service "${pkgdir}/usr/lib/systemd/system/nspawn.service"
   install -Dm644 packaging/systemd/journald@nspawn.conf "${pkgdir}/usr/lib/systemd/journald@nspawn.conf"
+  install -Dm644 packaging/systemd/nspawn-api@.socket packaging/systemd/nspawn-api@.service packaging/systemd/nspawn-auto-update.service packaging/systemd/nspawn-auto-update.timer -t "${pkgdir}/usr/lib/systemd/system/"
   install -Dm644 packaging/dbus/org.nspawn.service "${pkgdir}/usr/share/dbus-1/system-services/org.nspawn.service"
   install -Dm644 packaging/dbus/org.nspawn.conf "${pkgdir}/usr/share/dbus-1/system.d/org.nspawn.conf"
   install -Dm644 packaging/polkit/org.nspawn.policy "${pkgdir}/usr/share/polkit-1/actions/org.nspawn.policy"
-  install -Dm644 README.md docs/USAGE.md docs/ARCHITECTURE.md docs/DBUS.md packaging/polkit/nspawn-wheel.rules -t "${pkgdir}/usr/share/doc/${pkgname}"
+  install -Dm644 README.md docs/ARCHITECTURE.md docs/DBUS.md packaging/polkit/nspawn-wheel.rules -t "${pkgdir}/usr/share/doc/${pkgname}"
   install -Dm644 LICENSE LICENSE-MIT LICENSE-APACHE -t "${pkgdir}/usr/share/licenses/${pkgname}/"
   install -dm755 "${pkgdir}/etc/nspawn"
   install -dm711 "${pkgdir}/var/lib/nspawn"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 11:31:16	Medium	1
2026-10-05 23:40:58	Clean	0
2026-09-29 03:22:52	Clean	0
2026-09-29 01:22:50	Clean	0
2026-09-28 23:22:18	Clean	0
2026-09-27 23:19:54	Clean	0
2026-09-27 11:18:17	Clean	0
2026-09-27 05:16:52	Clean	0
2026-09-26 19:15:27	Clean	0
2026-09-26 17:15:25	Clean	0
2026-09-26 09:14:41	Clean	0
2026-09-25 23:13:47	Clean	0
2026-09-25 19:13:08	Clean	0
2026-09-25 05:10:30	Clean	0
2026-09-24 17:43:55	Clean	0
2026-09-24 03:41:46	Clean	0
2026-09-23 09:40:25	Clean	0
2026-06-19 22:34:54	Clean	0