paruguard-git
LOW
maintainer stratosmacker
0 votes
scanned 2026-09-17 21:26:26.072849
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# SPDX-License-Identifier: GPL-3.0-or-later
2
# Maintainer: Jesse Osiecki <jesse@jjo.ninja>
3
#
4
# This is a -git PKGBUILD: it builds paruguard from the tip of the git repo.
5
# When you cut tagged releases, copy this to a `paruguard` PKGBUILD with a
6
# fixed `source=("...::git+URL#tag=v$pkgver")` and drop the pkgver() function.
7
8
pkgname=paruguard-git
9
_pkgname=paruguard
10
pkgver=1.1.0.r0.ga0a796d
11
pkgrel=1
12
pkgdesc="Zero-trust AUR installer: hardened, auditable wrapper around paru/pacman"
13
arch=('any')
14
url="https://github.com/jesse-osiecki/paruguard"
15
license=('GPL-3.0-or-later')
16
17
# Runtime tools paruguard asserts at startup (PLAN.md §9.2). paru and
18
# ks-aur-scanner live in the AUR; an AUR helper resolves them.
19
depends=(
20
'bash'
21
'pacman'
22
'devtools' # makechrootpkg, arch-nspawn, mkarchroot, repo-add
23
'paru' # AUR: the helper paruguard orchestrates (never forks)
24
'ks-aur-scanner' # AUR: provides the `aur-scan` static-analysis gate
25
'jq'
26
'curl'
27
'git'
28
'libarchive' # bsdtar
29
'util-linux' # unshare
30
'sudo'
31
'bubblewrap' # bwrap (advisory --replay-hook sandbox)
32
'expac'
33
)
34
optdepends=(
35
'flatpak: fold `flatpak update` into full upgrades'
36
'bpf: eBPF rootkit-map IOC self-check (bpftool)'
37
'bat: nicer PKGBUILD/.install diff rendering in the gate'
38
)
39
# git is already in depends (runtime), so it's available at build too — no
40
# separate makedepends needed for cloning the -git source.
41
provides=("$_pkgname")
42
conflicts=("$_pkgname")
43
options=('!strip') # nothing to strip; pure Bash
44
45
source=("$_pkgname::git+https://github.com/jesse-osiecki/paruguard.git")
46
sha256sums=('SKIP')
47
48
pkgver() {
49
cd "$srcdir/$_pkgname"
50
# Branch on git describe's real exit status: a piped `... | sed` would
51
# swallow the "no tags" failure (sed exits 0 on empty input), leaving an
52
# empty pkgver. Tag form when tags exist; else 0.r<commits>.<shorthash>.
53
local desc
54
if desc=$(git describe --long --tags 2>/dev/null) && [[ -n "$desc" ]]; then
55
printf '%s' "$desc" | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
56
else
57
printf '0.r%s.%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
58
fi
59
}
60
61
build() {
62
cd "$srcdir/$_pkgname"
63
make build
64
}
65
66
check() {
67
cd "$srcdir/$_pkgname"
68
# fast, non-privileged tier only; the live tier needs a real chroot + sudo
69
# and is exercised via testrig/ (a VM), not during package build.
70
make test
71
}
72
73
package() {
74
cd "$srcdir/$_pkgname"
75
make PREFIX=/usr DESTDIR="$pkgdir" install
76
}
77
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 21:26:26 | Low | 1 |