bpfcompat
LOW
maintainer catHeadCoffee
0 votes
scanned 2026-10-31 15:58:34.921556
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# Maintainer: coffee <catheadcoffee@gmail.com>
2
# bpfcompat — eBPF compatibility evidence and CI gate.
3
#
4
# Built from source on purpose. The released CLI is a static Go binary, but the
5
# guest-side validator is a small C program linked against libbpf, and upstream
6
# publishes it only for amd64 and statically linked. Arch ships neither libbpf.a
7
# nor libzstd.a, so `LIBBPF_LINK_MODE=static` cannot be reproduced here: the
8
# validator is linked dynamically instead, which is the normal Arch convention and
9
# also makes the package rebuildable on aarch64.
10
#
11
# Layout:
12
# /usr/bin/bpfcompat CLI (static Go, CGO off)
13
# /usr/lib/bpfcompat/bpfcompat-validator guest-side validator (C)
14
# /usr/share/bpfcompat/{matrices,suites} reference matrices/suites
15
#
16
# Why arch-validator-path.patch exists:
17
# internal/runner/runner.go resolves the validator by os.Stat() over
18
# $BPFCOMPAT_VALIDATOR_BIN
19
# /usr/local/libexec/bpfcompat/bpfcompat-validator
20
# /usr/libexec/bpfcompat/bpfcompat-validator
21
# validator/c-libbpf/bin/bpfcompat-validator (repo-relative)
22
# /usr/libexec is outside the FHS paths Arch uses (namcap: "ELF file outside of
23
# a valid path"). The patch appends /usr/lib/bpfcompat/bpfcompat-validator to
24
# that list, so the package installs to the Arch-appropriate location and
25
# `bpfcompat test` still finds the validator with no environment variable.
26
27
pkgname=bpfcompat
28
_tag=v0.3.7
29
# GitHub 的归档根目录用的是 tag 原名（v0.4.0-rc.4 -> bpfcompat-0.4.0-rc.4），
30
# 而 pkgver 去掉了连字符，所以不能拿 $pkgname-$pkgver 当目录名。
31
_srcdir="bpfcompat-${_tag#v}"
32
pkgver=0.3.7
33
pkgrel=3
34
pkgdesc="eBPF compatibility evidence and CI gate: boots real kernels in VMs to validate BPF objects and loaders"
35
arch=('x86_64' 'aarch64')
36
url="https://github.com/Kernel-Guard/bpfcompat"
37
license=('Apache-2.0')
38
depends=(
39
'glibc'
40
'libbpf' # validator: BPF object loading (its NEEDED already covers libelf + zlib)
41
'libelf' # validator: ELF parsing
42
)
43
makedepends=(
44
'go'
45
'pkgconf' # the validator Makefile runs pkg-config for libbpf cflags
46
'gcc' # the validator is C
47
)
48
optdepends=(
49
# Arch splits QEMU by target: the *package* is qemu-system-x86, which is what
50
# provides the qemu-system-x86_64 binary bpfcompat execs. Same for aarch64.
51
'qemu-system-x86: QEMU backend for x86_64 guest kernels (provides qemu-system-x86_64)'
52
'qemu-system-aarch64: QEMU backend for aarch64 guest kernels (provides qemu-system-aarch64)'
53
'qemu-img: disk image conversion used by the VM flows (provides qemu-img)'
54
'virtme-ng: boot kernels through vng instead of a hand-rolled initramfs (provides vng)'
55
'firecracker: Firecracker microVM backend (provides firecracker)'
56
'busybox: minimal initramfs for VM boots'
57
'cpio: initramfs assembly'
58
)
59
# Prints the optional setcap command (see bpfcompat.install). Capabilities cannot
60
# ship inside the package: pacman does not store security.capability, and the file
61
# is replaced on every upgrade anyway.
62
install="$pkgname.install"
63
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/$_tag.tar.gz"
64
"arch-validator-path.patch")
65
sha256sums=('e0e00f4d4f4614998b61ce95f6749cea84ae8c3710411eeb9c34d5f5b2455a2f'
66
'5be2c7f80561b6da6125b2900a7a13da061649e05e455534f7f21f151bda9922')
67
68
prepare() {
69
cd "$_srcdir"
70
patch -Np1 -i "$srcdir/arch-validator-path.patch"
71
}
72
73
build() {
74
cd "$_srcdir"
75
76
# -mod=vendor: the tree ships vendor/, so no module downloads.
77
# -buildvcs=false: a release tarball has no .git to stamp.
78
# CGO_ENABLED=0: the CLI has no cgo imports, giving a fully static binary
79
# (verified: `ldd bin/bpfcompat` -> "not a dynamic executable").
80
export GOFLAGS="-mod=vendor -buildvcs=false"
81
export CGO_ENABLED=0
82
83
# makepkg exports its own LDFLAGS (-Wl,-O1,--sort-common,...), while upstream's
84
# Makefile uses `LDFLAGS ?=` for the Go -X version stamp. The collision makes
85
# `go build -ldflags` receive linker flags and die with
86
# flag provided but not defined: -Wl,-O1,--sort-common,...
87
# so drop it for the Go step and let the Makefile's own default apply.
88
unset LDFLAGS CGO_LDFLAGS
89
90
# A tarball has no .git, so the Makefile's `git describe` fallback would stamp
91
# 0.1.0-dev; pass the real tag. $_tag keeps upstream's spelling
92
# (v0.4.0-rc.1), which $pkgver cannot: Arch pkgver may not contain '-'.
93
make build VERSION="$_tag"
94
95
# makepkg strips *static* binaries with `strip -S`, which keeps .symtab, so
96
# namcap still reports "is unstripped". Strip all of it: 23.9 MB -> 16.1 MB.
97
# Safe for Go: backtraces read the runtime's pclntab, not .symtab, and
98
# `bin/bpfcompat version` was verified to work afterwards.
99
strip -s bin/bpfcompat
100
101
# Guest-side C validator. Its Makefile links through LIBBPF_LIBS only, so
102
# makepkg's LDFLAGS never reach it; add the hardening explicitly:
103
# -fPIE -pie PIE (namcap: "lacks PIE")
104
# -Wl,-z,relro,-z,now full RELRO (namcap: "lacks FULL RELRO")
105
# -Wl,--as-needed don't record libz/libzstd as NEEDED when libbpf
106
# already pulls them in (namcap: "unused shared library")
107
# CFLAGS keeps upstream's -Wall -Wextra -std=c11 on top of the distro flags,
108
# which would otherwise override the Makefile's `CFLAGS ?=`.
109
make -C validator/c-libbpf clean all LIBBPF_LINK_MODE=dynamic \
110
CFLAGS="${CFLAGS:--O2} -Wall -Wextra -std=c11 -fPIE" \
111
LIBBPF_LIBS="-pie -Wl,-z,relro,-z,now -Wl,--as-needed -lbpf -lelf -lz -lzstd"
112
}
113
114
check() {
115
cd "$_srcdir"
116
./bin/bpfcompat version
117
./validator/c-libbpf/bin/bpfcompat-validator --help > /dev/null
118
}
119
120
package() {
121
cd "$_srcdir"
122
123
install -Dm755 bin/bpfcompat "$pkgdir/usr/bin/bpfcompat"
124
125
# Path added by arch-validator-path.patch, so the CLI auto-discovers it.
126
install -Dm755 validator/c-libbpf/bin/bpfcompat-validator \
127
"$pkgdir/usr/lib/bpfcompat/bpfcompat-validator"
128
129
# Example matrices/suites (~116 KiB). Upstream's installer ships neither, but
130
# every test/suite run needs a matrix, so the reference ones are useful:
131
# bpfcompat profile list --matrix /usr/share/bpfcompat/matrices/dev-one.yaml
132
install -d "$pkgdir/usr/share/bpfcompat"
133
cp -r matrices suites "$pkgdir/usr/share/bpfcompat/"
134
135
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
136
install -Dm644 NOTICE "$pkgdir/usr/share/licenses/$pkgname/NOTICE"
137
}
138
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-31 15:58:34 | Low | 1 |