linux-hardener
LOW
maintainer TidyNest
0 votes
scanned 2026-08-29 07:38:41.750184
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# Maintainer: Eric Jingryd <tidynest@proton.me>
2
pkgname=linux-hardener
3
pkgver=1.6.0
4
pkgrel=1
5
pkgdesc="Linux security automation: scanning, hardening, and rollback across 8 domains"
6
arch=('x86_64')
7
url="https://github.com/tidynest/linux-hardener"
8
license=('Apache-2.0')
9
# Carries an existing install across the rename from linux-system-hardener
10
# (#51), at the moment somebody installs this package. `conflicts` stops both
11
# being installed at once, `replaces` makes the removal automatic rather than
12
# an error, and `provides` keeps anything depending on the old name
13
# satisfiable. All three are needed: `conflicts` alone makes the install fail
14
# instead of swapping, and `provides` alone leaves the old package in place.
15
#
16
# `replaces` does NOT reach out and find an existing install. pacman reads it
17
# during -Syu from a SYNC DATABASE, and the AUR is not one, so a user sitting
18
# on linux-system-hardener is never offered this package and never learns it
19
# exists. Verified on 2026-08-29: a full `yay -Syu` upgraded an unrelated
20
# package and said nothing about the rename. The install guides tell people to
21
# install this package by name for that reason; do not restore the claim that
22
# an upgrade sweep does it for them.
23
provides=('linux-system-hardener')
24
conflicts=('linux-system-hardener')
25
replaces=('linux-system-hardener')
26
depends=(
27
'cairo'
28
'desktop-file-utils'
29
'gcc-libs'
30
'gdk-pixbuf2'
31
'glib2'
32
'glibc'
33
'gtk3'
34
'hicolor-icon-theme'
35
'libsoup3'
36
'openssl'
37
'pango'
38
'polkit'
39
'webkit2gtk-4.1'
40
'libxcb'
41
'libxkbcommon'
42
'systemd'
43
)
44
makedepends=(
45
'git'
46
'musl'
47
'openssl'
48
'librsvg'
49
'rust'
50
'cargo'
51
'trunk'
52
'pkg-config'
53
)
54
optdepends=(
55
'polkit-gnome: polkit agent for GNOME, XFCE, Hyprland, Sway, i3'
56
'polkit-kde-agent: polkit agent for KDE Plasma'
57
'xfce-polkit: native polkit agent for XFCE'
58
)
59
# package() installs config.toml into /etc, so without this pacman replaces it
60
# on every upgrade and an operator's exceptions, approvers and directive
61
# overrides are gone with no .pacnew to recover them from. The RPM says the same
62
# thing as %config(noreplace) and the Debian package gets it from debhelper,
63
# which is what docs/guide/installation.md promises for every packaging.
64
backup=('etc/linux-hardener/config.toml')
65
source=("$pkgname-$pkgver.tar.gz::https://github.com/tidynest/$pkgname/archive/refs/tags/v$pkgver.tar.gz")
66
sha256sums=('5583a5ad67635176f1fde314a863039ca165ec22e9911d0f5c0cafc2eef99451')
67
68
build() {
69
cd "$pkgname-$pkgver"
70
71
# Strip GCC LTO from CFLAGS - GCC LTO bytecode is incompatible with
72
# Rust's linkers (musl self-contained and rust-lld) and causes undefined
73
# references in native C/asm libraries (ring, libsqlite3-sys).
74
# Rust applies its own LTO via [profile.release] lto = true.
75
export CFLAGS="${CFLAGS//-flto=auto/}"
76
export CXXFLAGS="${CXXFLAGS//-flto=auto/}"
77
78
# Remap absolute source paths embedded by panic!/unwrap/tracing to
79
# relative prefixes - prevents $srcdir and $HOME leaking into binaries.
80
_remap="--remap-path-prefix=$srcdir=src: --remap-path-prefix=$HOME/.cargo/registry/src/=registry: --remap-path-prefix=$HOME/.rustup/toolchains/=toolchain:"
81
export RUSTFLAGS="${RUSTFLAGS:-} ${_remap}"
82
83
# Pin the target dir inside the build root. A user-level cargo config
84
# (a global [build] target-dir) would otherwise relocate the artifacts
85
# that package() installs from relative target/ paths.
86
export CARGO_TARGET_DIR="$srcdir/$pkgname-$pkgver/target"
87
88
cargo build --release --target x86_64-unknown-linux-musl -p hardener-cli
89
90
# Build the Leptos WASM frontend (Tauri embeds these assets from dist/).
91
# Use --public-url="." so asset paths are relative (required for Tauri's
92
# custom-protocol; absolute paths like /foo.js don't resolve).
93
cd crates/hardener-ui && trunk build --release --public-url="." && cd ../..
94
95
cd src-tauri && cargo build --release --features tauri/custom-protocol
96
}
97
98
package() {
99
cd "$pkgname-$pkgver"
100
101
# CLI binary (static musl)
102
install -Dm755 "target/x86_64-unknown-linux-musl/release/hardener" \
103
"$pkgdir/usr/bin/hardener"
104
105
# Desktop binary + wrapper (sets WebKit Wayland workaround)
106
install -Dm755 "target/release/linux-hardener-desktop" \
107
"$pkgdir/usr/lib/linux-hardener/linux-hardener-desktop"
108
install -Dm755 /dev/stdin "$pkgdir/usr/bin/linux-hardener-desktop" <<'WRAPPER'
109
#!/bin/sh
110
export WEBKIT_DISABLE_COMPOSITING_MODE=1
111
exec /usr/lib/linux-hardener/linux-hardener-desktop "$@"
112
WRAPPER
113
114
# Systemd units
115
install -Dm644 "packaging/systemd/linux-hardener.service" \
116
"$pkgdir/usr/lib/systemd/system/linux-hardener.service"
117
install -Dm644 "packaging/systemd/linux-hardener.timer" \
118
"$pkgdir/usr/lib/systemd/system/linux-hardener.timer"
119
120
# Desktop entry
121
install -Dm644 "packaging/assets/linux-hardener.desktop" \
122
"$pkgdir/usr/share/applications/linux-hardener.desktop"
123
124
# Man page
125
install -Dm644 "packaging/assets/hardener.1" \
126
"$pkgdir/usr/share/man/man1/hardener.1"
127
128
# Polkit policy
129
install -Dm644 "packaging/assets/com.tidynest.linux-hardener.policy" \
130
"$pkgdir/usr/share/polkit-1/actions/com.tidynest.linux-hardener.policy"
131
132
# Default config
133
install -Dm644 "packaging/assets/config.toml.example" \
134
"$pkgdir/usr/share/doc/$pkgname/config.toml.example"
135
install -Dm644 "packaging/assets/config.toml.example" \
136
"$pkgdir/etc/linux-hardener/config.toml"
137
138
# Directories
139
install -dm755 "$pkgdir/etc/linux-hardener"
140
install -dm755 "$pkgdir/var/lib/linux-hardener"
141
install -dm700 "$pkgdir/var/log/linux-hardener"
142
143
# Licence and docs
144
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
145
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
146
}
147
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-29 07:38:41 | Low | 1 |