lmm-api-deploy-bin

LOW

maintainer lightjunction 0 votes scanned 2026-08-22 15:17:41.736085

View on AUR

Why flagged

The package installs a prebuilt binary from GitHub Releases with strong verification (SHA256, Sigstore, and REVISION check), but grants it sudo rights for specific pacman operations; while the host is not whitelisted, the verification mitigates supply-chain risks, making it low risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from GitHub Releases with strong verification (SHA256, Sigstore, and REVISION check), but grants it sudo rights for specific pacman operations; while the host is not whitelisted, the verification mitigates supply-chain risks, making it low risk.

PKGBUILD

      1# Maintainer: LIghtJUNction <support@lmm.best>
    
      2
    
      3pkgname=lmm-api-deploy-bin
    
      4pkgver=0.1.35
    
      5pkgrel=2
    
      6pkgdesc='LMM API tooling-only production deployment operator (prebuilt)'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/LIghtJUNction/api.lmm.best'
    
      9license=('AGPL-3.0-only')
    
      10depends=('ca-certificates' 'coreutils' 'libarchive' 'pacman' 'paru' 'sudo' 'systemd' 'util-linux')
    
      11makedepends=('cosign')
    
      12provides=("lmm-api-deploy=${pkgver}")
    
      13conflicts=('lmm-api-deploy')
    
      14options=('!strip')
    
      15
    
      16_release_tag="go-v${pkgver}"
    
      17_release_revision=c0c029fa92ff140fff175e50d74975cecb8b141b
    
      18_artifact="lmm-api-go-${pkgver}-linux"
    
      19_release_base="${url}/releases/download/${_release_tag}"
    
      20source_x86_64=(
    
      21  "${_artifact}-amd64.tar.gz::${_release_base}/${_artifact}-amd64.tar.gz"
    
      22  "${_artifact}-amd64.tar.gz.sha256::${_release_base}/${_artifact}-amd64.tar.gz.sha256"
    
      23  "${_artifact}-amd64.tar.gz.sigstore.json::${_release_base}/${_artifact}-amd64.tar.gz.sigstore.json"
    
      24)
    
      25source_aarch64=(
    
      26  "${_artifact}-arm64.tar.gz::${_release_base}/${_artifact}-arm64.tar.gz"
    
      27  "${_artifact}-arm64.tar.gz.sha256::${_release_base}/${_artifact}-arm64.tar.gz.sha256"
    
      28  "${_artifact}-arm64.tar.gz.sigstore.json::${_release_base}/${_artifact}-arm64.tar.gz.sigstore.json"
    
      29)
    
      30noextract=("${_artifact}-amd64.tar.gz" "${_artifact}-arm64.tar.gz")
    
      31sha256sums_x86_64=(
    
      32  'a79090b35c0288eb52cc5ef6616eb871247526e917fb11ea803ad47bee69cb74'
    
      33  '55886fb370000c085c7595bd6f9c430e9c909b1f04b717997bc0ccd1d1f4f1bb'
    
      34  'b78c610c33c5851675bea566b9f9e9abd41a4d661a714e4d3f09a854f96642b4'
    
      35)
    
      36sha256sums_aarch64=(
    
      37  '6a7c22fb59907ea8c4a904585968919e34476f2c4ceb6de2c2e8c1865c5f0192'
    
      38  '5bd89a9e5df7df20b223b0926da5c3ec169194febff20fb52af4c5492ff0c717'
    
      39  '3d18f9f977c10e09bfca01476f913c349da9d3784142519b1220ac4b75838795'
    
      40)
    
      41
    
      42case "${CARCH}" in
    
      43  x86_64) _release_arch=amd64 ;;
    
      44  aarch64) _release_arch=arm64 ;;
    
      45  *) printf 'unsupported architecture: %s\n' "${CARCH}" >&2; return 1 ;;
    
      46esac
    
      47
    
      48prepare() {
    
      49  local archive="${_artifact}-${_release_arch}.tar.gz"
    
      50  local bundle="${srcdir}/${_artifact}-${_release_arch}"
    
      51  local expected actual revision
    
      52
    
      53  expected=$(awk 'NR == 1 { print $1 }' "${archive}.sha256")
    
      54  [[ ${expected} =~ ^[[:xdigit:]]{64}$ ]] || return 1
    
      55  actual=$(sha256sum "${archive}")
    
      56  [[ ${actual%% *} == "${expected}" ]] || return 1
    
      57  cosign verify-blob \
    
      58    --bundle "${archive}.sigstore.json" \
    
      59    --certificate-identity \
    
      60      "${url}/.github/workflows/release-go.yml@refs/tags/${_release_tag}" \
    
      61    --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
    
      62    "${archive}"
    
      63  bsdtar -xf "${archive}"
    
      64
    
      65  [[ -f ${bundle}/lmm-api-go && -x ${bundle}/lmm-api-go ]] || return 1
    
      66  [[ -f ${bundle}/REVISION && ! -L ${bundle}/REVISION ]] || return 1
    
      67  revision=$(<"${bundle}/REVISION")
    
      68  [[ ${revision} == "${_release_revision}" ]] || return 1
    
      69  if [[ -e ${bundle}/API_ROUTE_CONTRACT_REVISION ]]; then
    
      70    [[ -f ${bundle}/API_ROUTE_CONTRACT_REVISION && ! -L ${bundle}/API_ROUTE_CONTRACT_REVISION ]] || return 1
    
      71    [[ $(<"${bundle}/API_ROUTE_CONTRACT_REVISION") =~ ^[0-9a-f]{64}$ ]] || return 1
    
      72  fi
    
      73}
    
      74
    
      75package() {
    
      76  local bundle="${srcdir}/${_artifact}-${_release_arch}"
    
      77  local archive="${srcdir}/${_artifact}-${_release_arch}.tar.gz"
    
      78  local file binary_hash asset_hash
    
      79
    
      80  install -Dm0755 "${bundle}/lmm-api-go" \
    
      81    "${pkgdir}/usr/lib/lmm-api-deploy/lmm-api-go"
    
      82  install -d -m0755 "${pkgdir}/usr/bin"
    
      83  ln -s ../lib/lmm-api-deploy/lmm-api-go "${pkgdir}/usr/bin/lmm-api-deploy"
    
      84
    
      85  install -Dm0644 /dev/stdin "${pkgdir}/usr/lib/sysusers.d/lmm-api-deploy.conf" <<'EOF'
    
      86u lmm-api-deploy - "LMM API deployment operator" /var/lib/lmm-api-go-deploy/operator /usr/bin/nologin
    
      87EOF
    
      88  install -Dm0644 /dev/stdin "${pkgdir}/usr/lib/tmpfiles.d/lmm-api-deploy.conf" <<'EOF'
    
      89d /var/lib/lmm-api-go-deploy 0710 root lmm-api-deploy -
    
      90d /var/lib/lmm-api-go-deploy/operator 0700 lmm-api-deploy lmm-api-deploy -
    
      91EOF
    
      92  install -Dm0440 /dev/stdin "${pkgdir}/etc/sudoers.d/lmm-api-deploy" <<'EOF'
    
      93lmm-api-deploy ALL=(root) NOPASSWD: /usr/bin/pacman ^--upgrade --noconfirm -- /var/lib/lmm-api-go-deploy/work/[A-Za-z0-9][A-Za-z0-9._-]{0,79}/staging/lmm-api-go-bin-[A-Za-z0-9][A-Za-z0-9._+@~-]*\.pkg\.tar\.(zst|xz|gz|bz2|lz4|lrz|lzo|Z)$
    
      94lmm-api-deploy ALL=(root) NOPASSWD: /usr/bin/pacman ^--upgrade --noconfirm -- /var/lib/lmm-api-go-deploy/work/[A-Za-z0-9][A-Za-z0-9._-]{0,79}/staging/lmm-api-web-bin-[A-Za-z0-9][A-Za-z0-9._+@~-]*\.pkg\.tar\.(zst|xz|gz|bz2|lz4|lrz|lzo|Z)$
    
      95EOF
    
      96
    
      97  for file in LICENSE NOTICE THIRD-PARTY-LICENSES.md; do
    
      98    install -Dm0644 "${bundle}/${file}" \
    
      99      "${pkgdir}/usr/share/licenses/${pkgname}/${file}"
    
      100  done
    
      101  install -Dm0644 "${bundle}/REVISION" \
    
      102    "${pkgdir}/usr/share/doc/${pkgname}/REVISION"
    
      103  if [[ -f ${bundle}/API_ROUTE_CONTRACT_REVISION ]]; then
    
      104    install -Dm0644 "${bundle}/API_ROUTE_CONTRACT_REVISION" \
    
      105      "${pkgdir}/usr/share/doc/${pkgname}/API_ROUTE_CONTRACT_REVISION"
    
      106  fi
    
      107
    
      108  binary_hash=$(sha256sum "${bundle}/lmm-api-go")
    
      109  printf '%s\n' "${binary_hash%% *}" >"${srcdir}/OPERATOR_SHA256"
    
      110  install -Dm0644 "${srcdir}/OPERATOR_SHA256" \
    
      111    "${pkgdir}/usr/share/doc/${pkgname}/OPERATOR_SHA256"
    
      112  asset_hash=$(sha256sum "${archive}")
    
      113  printf '%s\n' "${asset_hash%% *}" >"${srcdir}/RELEASE_ASSET_SHA256"
    
      114  install -Dm0644 "${srcdir}/RELEASE_ASSET_SHA256" \
    
      115    "${pkgdir}/usr/share/doc/${pkgname}/RELEASE_ASSET_SHA256"
    
      116}
    
      117

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-22 15:17:41	Low	2