linux-hardener

LOW
maintainer TidyNest 0 votes scanned 2026-08-29 07:38:41.750184
View on AUR
Why flagged

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

1# Maintainer: Eric Jingryd <tidynest@proton.me>
2pkgname=linux-hardener
3pkgver=1.6.0
4pkgrel=1
5pkgdesc="Linux security automation: scanning, hardening, and rollback across 8 domains"
6arch=('x86_64')
7url="https://github.com/tidynest/linux-hardener"
8license=('Apache-2.0')
9# Carries an existing install across the rename from linux-system-hardener
10# (#51), at the moment somebody installs this package. `conflicts` stops both
11# being installed at once, `replaces` makes the removal automatic rather than
12# an error, and `provides` keeps anything depending on the old name
13# satisfiable. All three are needed: `conflicts` alone makes the install fail
14# instead of swapping, and `provides` alone leaves the old package in place.
15#
16# `replaces` does NOT reach out and find an existing install. pacman reads it
17# during -Syu from a SYNC DATABASE, and the AUR is not one, so a user sitting
18# on linux-system-hardener is never offered this package and never learns it
19# exists. Verified on 2026-08-29: a full `yay -Syu` upgraded an unrelated
20# package and said nothing about the rename. The install guides tell people to
21# install this package by name for that reason; do not restore the claim that
22# an upgrade sweep does it for them.
23provides=('linux-system-hardener')
24conflicts=('linux-system-hardener')
25replaces=('linux-system-hardener')
26depends=(
27 'cairo'
28 'desktop-file-utils'
29 'gcc-libs'
30 'gdk-pixbuf2'
31 'glib2'
32 'glibc'
33 'gtk3'
34 'hicolor-icon-theme'
35 'libsoup3'
36 'openssl'
37 'pango'
38 'polkit'
39 'webkit2gtk-4.1'
40 'libxcb'
41 'libxkbcommon'
42 'systemd'
43)
44makedepends=(
45 'git'
46 'musl'
47 'openssl'
48 'librsvg'
49 'rust'
50 'cargo'
51 'trunk'
52 'pkg-config'
53)
54optdepends=(
55 'polkit-gnome: polkit agent for GNOME, XFCE, Hyprland, Sway, i3'
56 'polkit-kde-agent: polkit agent for KDE Plasma'
57 'xfce-polkit: native polkit agent for XFCE'
58)
59# package() installs config.toml into /etc, so without this pacman replaces it
60# on every upgrade and an operator's exceptions, approvers and directive
61# overrides are gone with no .pacnew to recover them from. The RPM says the same
62# thing as %config(noreplace) and the Debian package gets it from debhelper,
63# which is what docs/guide/installation.md promises for every packaging.
64backup=('etc/linux-hardener/config.toml')
65source=("$pkgname-$pkgver.tar.gz::https://github.com/tidynest/$pkgname/archive/refs/tags/v$pkgver.tar.gz")
66sha256sums=('5583a5ad67635176f1fde314a863039ca165ec22e9911d0f5c0cafc2eef99451')
67
68build() {
69 cd "$pkgname-$pkgver"
70
71 # Strip GCC LTO from CFLAGS - GCC LTO bytecode is incompatible with
72 # Rust's linkers (musl self-contained and rust-lld) and causes undefined
73 # references in native C/asm libraries (ring, libsqlite3-sys).
74 # Rust applies its own LTO via [profile.release] lto = true.
75 export CFLAGS="${CFLAGS//-flto=auto/}"
76 export CXXFLAGS="${CXXFLAGS//-flto=auto/}"
77
78 # Remap absolute source paths embedded by panic!/unwrap/tracing to
79 # relative prefixes - prevents $srcdir and $HOME leaking into binaries.
80 _remap="--remap-path-prefix=$srcdir=src: --remap-path-prefix=$HOME/.cargo/registry/src/=registry: --remap-path-prefix=$HOME/.rustup/toolchains/=toolchain:"
81 export RUSTFLAGS="${RUSTFLAGS:-} ${_remap}"
82
83 # Pin the target dir inside the build root. A user-level cargo config
84 # (a global [build] target-dir) would otherwise relocate the artifacts
85 # that package() installs from relative target/ paths.
86 export CARGO_TARGET_DIR="$srcdir/$pkgname-$pkgver/target"
87
88 cargo build --release --target x86_64-unknown-linux-musl -p hardener-cli
89
90 # Build the Leptos WASM frontend (Tauri embeds these assets from dist/).
91 # Use --public-url="." so asset paths are relative (required for Tauri's
92 # custom-protocol; absolute paths like /foo.js don't resolve).
93 cd crates/hardener-ui && trunk build --release --public-url="." && cd ../..
94
95 cd src-tauri && cargo build --release --features tauri/custom-protocol
96}
97
98package() {
99 cd "$pkgname-$pkgver"
100
101 # CLI binary (static musl)
102 install -Dm755 "target/x86_64-unknown-linux-musl/release/hardener" \
103 "$pkgdir/usr/bin/hardener"
104
105 # Desktop binary + wrapper (sets WebKit Wayland workaround)
106 install -Dm755 "target/release/linux-hardener-desktop" \
107 "$pkgdir/usr/lib/linux-hardener/linux-hardener-desktop"
108 install -Dm755 /dev/stdin "$pkgdir/usr/bin/linux-hardener-desktop" <<'WRAPPER'
109#!/bin/sh
110export WEBKIT_DISABLE_COMPOSITING_MODE=1
111exec /usr/lib/linux-hardener/linux-hardener-desktop "$@"
112WRAPPER
113
114 # Systemd units
115 install -Dm644 "packaging/systemd/linux-hardener.service" \
116 "$pkgdir/usr/lib/systemd/system/linux-hardener.service"
117 install -Dm644 "packaging/systemd/linux-hardener.timer" \
118 "$pkgdir/usr/lib/systemd/system/linux-hardener.timer"
119
120 # Desktop entry
121 install -Dm644 "packaging/assets/linux-hardener.desktop" \
122 "$pkgdir/usr/share/applications/linux-hardener.desktop"
123
124 # Man page
125 install -Dm644 "packaging/assets/hardener.1" \
126 "$pkgdir/usr/share/man/man1/hardener.1"
127
128 # Polkit policy
129 install -Dm644 "packaging/assets/com.tidynest.linux-hardener.policy" \
130 "$pkgdir/usr/share/polkit-1/actions/com.tidynest.linux-hardener.policy"
131
132 # Default config
133 install -Dm644 "packaging/assets/config.toml.example" \
134 "$pkgdir/usr/share/doc/$pkgname/config.toml.example"
135 install -Dm644 "packaging/assets/config.toml.example" \
136 "$pkgdir/etc/linux-hardener/config.toml"
137
138 # Directories
139 install -dm755 "$pkgdir/etc/linux-hardener"
140 install -dm755 "$pkgdir/var/lib/linux-hardener"
141 install -dm700 "$pkgdir/var/log/linux-hardener"
142
143 # Licence and docs
144 install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
145 install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
146}
147

Scan history

Scanned at (UTC)SeverityRules
2026-08-29 07:38:41 Low 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion