nspawn-git

MEDIUM

maintainer Edu4rdSHL 0 votes scanned 2026-10-24 03:39:05.013886

View on AUR

Why flagged

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

PKGBUILD:52 install -Dm644 packaging/systemd/nspawn-api@.socket packaging/systemd/nspawn-api@.service packaging/systemd/nspawn-auto-update.service packaging/systemd/nspawn-auto-update.timer -t "${pkgdir}/usr/lib/systemd/system/"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Eduard Tolosa <tolosaeduard@gmail.com>
    
      2# Contributor: K4YT3X <aur@k4yt3x.com>
    
      3
    
      4pkgname=nspawn-git
    
      5pkgver=1.0.0.r1.gbd2c86c
    
      6pkgrel=1
    
      7pkgdesc='Docker-like management of systemd-nspawn machines: OCI images from a hub, shared layers, a bridge network, driven over D-Bus'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://github.com/nspawn/nspawn'
    
      10license=('MIT' 'Apache-2.0')
    
      11depends=('systemd>=255' 'glibc' 'gcc-libs' 'iproute2' 'nftables')
    
      12makedepends=('git' 'cargo')
    
      13optdepends=('polkit: let users other than root drive nspawn'
    
      14            'mkosi: build images with nspawn build'
    
      15            'iptables-nft: keep the bridge reachable next to the forwarding rules of docker or ufw'
    
      16            'iw: hand a wifi adapter to an app machine with --interface')
    
      17provides=("${pkgname%-git}")
    
      18conflicts=("${pkgname%-git}")
    
      19options=('!lto')
    
      20source=("${pkgname%-git}::git+${url}.git")
    
      21sha256sums=('SKIP')
    
      22
    
      23pkgver() {
    
      24  cd "${pkgname%-git}"
    
      25  git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      26}
    
      27
    
      28prepare() {
    
      29  cd "${pkgname%-git}"
    
      30  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      31}
    
      32
    
      33build() {
    
      34  cd "${pkgname%-git}"
    
      35  cargo build --release --frozen
    
      36}
    
      37
    
      38check() {
    
      39  cd "${pkgname%-git}"
    
      40  cargo test --release --frozen
    
      41}
    
      42
    
      43package() {
    
      44  cd "${pkgname%-git}"
    
      45  install -Dm755 target/release/nspawn "${pkgdir}/usr/bin/nspawn"
    
      46  ./target/release/nspawn completions bash | install -Dm644 /dev/stdin "${pkgdir}/usr/share/bash-completion/completions/nspawn"
    
      47  ./target/release/nspawn completions zsh | install -Dm644 /dev/stdin "${pkgdir}/usr/share/zsh/site-functions/_nspawn"
    
      48  ./target/release/nspawn completions fish | install -Dm644 /dev/stdin "${pkgdir}/usr/share/fish/vendor_completions.d/nspawn.fish"
    
      49  ./target/release/nspawn manpage | install -Dm644 /dev/stdin "${pkgdir}/usr/share/man/man1/nspawn.1"
    
      50  install -Dm644 packaging/systemd/nspawn.service "${pkgdir}/usr/lib/systemd/system/nspawn.service"
    
      51  install -Dm644 packaging/systemd/journald@nspawn.conf "${pkgdir}/usr/lib/systemd/journald@nspawn.conf"
    
      52  install -Dm644 packaging/systemd/nspawn-api@.socket packaging/systemd/nspawn-api@.service packaging/systemd/nspawn-auto-update.service packaging/systemd/nspawn-auto-update.timer -t "${pkgdir}/usr/lib/systemd/system/"
    
      53  install -Dm644 packaging/dbus/org.nspawn.service "${pkgdir}/usr/share/dbus-1/system-services/org.nspawn.service"
    
      54  install -Dm644 packaging/dbus/org.nspawn.conf "${pkgdir}/usr/share/dbus-1/system.d/org.nspawn.conf"
    
      55  install -Dm644 packaging/polkit/org.nspawn.policy "${pkgdir}/usr/share/polkit-1/actions/org.nspawn.policy"
    
      56  install -Dm644 README.md docs/ARCHITECTURE.md docs/DBUS.md packaging/polkit/nspawn-wheel.rules -t "${pkgdir}/usr/share/doc/${pkgname%-git}"
    
      57  install -Dm644 LICENSE LICENSE-MIT LICENSE-APACHE -t "${pkgdir}/usr/share/licenses/${pkgname%-git}/"
    
      58  install -dm755 "${pkgdir}/etc/nspawn"
    
      59  install -dm711 "${pkgdir}/var/lib/nspawn"
    
      60}
    
      61
    
      62

Changes since previous scan

--- PKGBUILD @ 2026-09-29 03:22
+++ PKGBUILD @ 2026-10-24 03:39
@@ -12,7 +12,8 @@
 makedepends=('git' 'cargo')
 optdepends=('polkit: let users other than root drive nspawn'
             'mkosi: build images with nspawn build'
-            'iptables-nft: keep the bridge reachable next to the forwarding rules of docker or ufw')
+            'iptables-nft: keep the bridge reachable next to the forwarding rules of docker or ufw'
+            'iw: hand a wifi adapter to an app machine with --interface')
 provides=("${pkgname%-git}")
 conflicts=("${pkgname%-git}")
 options=('!lto')
@@ -41,19 +42,20 @@
 
 package() {
   cd "${pkgname%-git}"
-
   install -Dm755 target/release/nspawn "${pkgdir}/usr/bin/nspawn"
   ./target/release/nspawn completions bash | install -Dm644 /dev/stdin "${pkgdir}/usr/share/bash-completion/completions/nspawn"
   ./target/release/nspawn completions zsh | install -Dm644 /dev/stdin "${pkgdir}/usr/share/zsh/site-functions/_nspawn"
   ./target/release/nspawn completions fish | install -Dm644 /dev/stdin "${pkgdir}/usr/share/fish/vendor_completions.d/nspawn.fish"
   ./target/release/nspawn manpage | install -Dm644 /dev/stdin "${pkgdir}/usr/share/man/man1/nspawn.1"
   install -Dm644 packaging/systemd/nspawn.service "${pkgdir}/usr/lib/systemd/system/nspawn.service"
+  install -Dm644 packaging/systemd/journald@nspawn.conf "${pkgdir}/usr/lib/systemd/journald@nspawn.conf"
+  install -Dm644 packaging/systemd/nspawn-api@.socket packaging/systemd/nspawn-api@.service packaging/systemd/nspawn-auto-update.service packaging/systemd/nspawn-auto-update.timer -t "${pkgdir}/usr/lib/systemd/system/"
   install -Dm644 packaging/dbus/org.nspawn.service "${pkgdir}/usr/share/dbus-1/system-services/org.nspawn.service"
   install -Dm644 packaging/dbus/org.nspawn.conf "${pkgdir}/usr/share/dbus-1/system.d/org.nspawn.conf"
   install -Dm644 packaging/polkit/org.nspawn.policy "${pkgdir}/usr/share/polkit-1/actions/org.nspawn.policy"
   install -Dm644 README.md docs/ARCHITECTURE.md docs/DBUS.md packaging/polkit/nspawn-wheel.rules -t "${pkgdir}/usr/share/doc/${pkgname%-git}"
   install -Dm644 LICENSE LICENSE-MIT LICENSE-APACHE -t "${pkgdir}/usr/share/licenses/${pkgname%-git}/"
-  install -dm755 "${pkgdir}/etc/nspawn" "${pkgdir}/var/lib/nspawn"
+  install -dm755 "${pkgdir}/etc/nspawn"
   install -dm711 "${pkgdir}/var/lib/nspawn"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 03:39:05	Medium	1
2026-09-29 03:22:52	Clean	0
2026-09-29 01:22:50	Clean	0
2026-09-24 03:41:46	Clean	0
2026-09-23 09:40:25	Clean	0
2026-06-18 16:11:54	Clean	0