wip

build.go

@@ -175,15 +175,32 @@ func BuildCmd() *cli.Command {
 				return err
 			}
 
-			builder, cleanup, err := build.NewMainBuilder(
+			installer, installerClose, err := build.GetSafeInstaller()
+			if err != nil {
+				return err
+			}
+			defer installerClose()
+
+			if err := utils.ExitIfCantSetNoNewPrivs(); err != nil {
+				return err
+			}
+
+			scripter, scripterClose, err := build.GetSafeScriptExecutor()
+			if err != nil {
+				return err
+			}
+			defer scripterClose()
+
+			builder, err := build.NewMainBuilder(
 				deps.Cfg,
 				deps.Manager,
 				deps.Repos,
+				scripter,
+				installer,
 			)
 			if err != nil {
 				return err
 			}
-			defer cleanup()
 
 			if scriptArgs != nil {
 				res, err = builder.BuildPackageFromScript(