openjiuwen-sandbox
LOW
maintainer orphaned
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
Builds from a tagged git source on gitcode.com (plausibly the project's own forge), installs Python wheels built from that source; the non-whitelisted host and SKIP'd checksums are the only concerns, but no prebuilt binaries are downloaded from unrelated hosts and no obfuscated/exfiltration code is present.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Builds from a tagged git source on gitcode.com (plausibly the project's own forge), installs Python wheels built from that source; the non-whitelisted host and SKIP'd checksums are the only concerns, but no prebuilt binaries are downloaded from unrelated hosts and no obfuscated/exfiltration code is present.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:28
source=("git+https://gitcode.com/openJiuwen/agent-studio.git#tag=v${pkgver}")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: enihcam <enihcam@noreply.gitcode.com>
2
pkgname=openjiuwen-sandbox
3
pkgver=0.1.8
4
pkgrel=1
5
pkgdesc="OpenJiuwen sandbox + gateway: code-execution sandbox server and gateway proxy"
6
arch=('x86_64')
7
url="https://gitcode.com/openJiuwen/agent-studio"
8
license=('Apache-2.0')
9
depends=(
10
'python>=3.11.4'
11
'python-fastapi>=0.124.0'
12
'uvicorn>=0.38.0'
13
'python-httpx>=0.28.0'
14
'python-yaml'
15
'python-dotenv'
16
'python-libseccomp-git'
17
)
18
makedepends=(
19
'python-build'
20
'python-installer'
21
'python-wheel'
22
'python-setuptools'
23
)
24
optdepends=(
25
'openjiuwen-server: backend that consumes this sandbox via CODE_SANDBOX_URL'
26
)
27
_srcdir_repo=agent-studio
28
source=("git+https://gitcode.com/openJiuwen/agent-studio.git#tag=v${pkgver}")
29
source+=("openjiuwen-sandbox.service")
30
source+=("openjiuwen-sandbox-gateway.service")
31
source+=("openjiuwen-sandbox.sysusers")
32
source+=("openjiuwen-sandbox.tmpfiles")
33
sha256sums=('SKIP')
34
sha256sums+=('SKIP')
35
sha256sums+=('SKIP')
36
sha256sums+=('SKIP')
37
sha256sums+=('SKIP')
38
39
build() {
40
local srcdir_top="${srcdir}/${_srcdir_repo:-agent-studio}"
41
42
cd "${srcdir_top}/sandbox_server/sandbox"
43
python -m build --wheel --no-isolation
44
45
cd "${srcdir_top}/sandbox_server/gateway"
46
python -m build --wheel --no-isolation
47
}
48
49
package() {
50
local srcdir_top="${srcdir}/${_srcdir_repo:-agent-studio}"
51
52
# Install both wheels into separate staging dirs, then merge. Using separate
53
# dirs avoids installer failing with FileExistsError if a previous failed
54
# build left stale files at ${srcdir}/staging (makepkg does not auto-clean
55
# its workdir between runs without -C).
56
local staging_s="${srcdir}/staging-sandbox"
57
local staging_g="${srcdir}/staging-gateway"
58
rm -rf "${staging_s}" "${staging_g}"
59
install -dm755 "${staging_s}" "${staging_g}"
60
python -m installer --destdir="${staging_s}" --compile-bytecode=1 \
61
"${srcdir_top}/sandbox_server/sandbox/dist/"*.whl
62
python -m installer --destdir="${staging_g}" --compile-bytecode=1 \
63
"${srcdir_top}/sandbox_server/gateway/dist/"*.whl
64
65
# Merge into one staging tree for the move into /opt
66
local staging="${srcdir}/staging"
67
rm -rf "${staging}"
68
install -dm755 "${staging}"
69
cp -a "${staging_s}/." "${staging}/"
70
cp -a "${staging_g}/." "${staging}/"
71
72
# Lay out /opt/openjiuwen-sandbox
73
install -dm755 "${pkgdir}/opt/openjiuwen-sandbox/lib"
74
cp -a "${staging}/usr/lib/python3"*/site-packages/. \
75
"${pkgdir}/opt/openjiuwen-sandbox/lib/"
76
77
# Runtime / state dirs
78
install -dm750 "${pkgdir}/var/lib/openjiuwen-sandbox"
79
install -dm755 "${pkgdir}/var/log/openjiuwen-sandbox"
80
81
# Licenses
82
install -Dm644 "${srcdir_top}/LICENSE" \
83
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
84
85
# Systemd units (two services in one package)
86
install -Dm644 "${srcdir}/openjiuwen-sandbox.service" \
87
"${pkgdir}/usr/lib/systemd/system/openjiuwen-sandbox.service"
88
install -Dm644 "${srcdir}/openjiuwen-sandbox-gateway.service" \
89
"${pkgdir}/usr/lib/systemd/system/openjiuwen-sandbox-gateway.service"
90
91
install -Dm644 "${srcdir}/openjiuwen-sandbox.sysusers" \
92
"${pkgdir}/usr/lib/sysusers.d/openjiuwen-sandbox.conf"
93
install -Dm644 "${srcdir}/openjiuwen-sandbox.tmpfiles" \
94
"${pkgdir}/usr/lib/tmpfiles.d/openjiuwen-sandbox.conf"
95
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |